a8908e6188e828c37eb51771ec60f7468dfbae22c00e0737825c4b97d0004411

Analysis

max time kernel
131s
max time network
127s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
22/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
oeC6.elf
Size 98KB
Sample260722-dc1f2aaa24
SHA256 a8908e6188e828c37eb51771ec60f7468dfbae22c00e0737825c4b97d0004411
MD5 fac71ec093c24565c5c72ac2a3af2e7b
SHA1 51af14ae139df08040217c37df67d766258a310f
SHA512 ed2e26a7fada2d25137feaa8a07e7c1332ab83f9676866057681cf6b40614eeea67737c6751eab8e329e2879e26a31f8be6b2daf1edd2afcba60eb98063096a7
SSDEEP 1536:zKAeGLVAMtCde3xXi60QAzVm7qauTKN810g5lU02kxXBgz04EE7:7L+ywe3xXD0nzVyioYxX
TLSH
T134A3FA1EAF611DBBD81BDD3305AC070274CCA61772643B793538C528BB8A54B8AD3CB9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	oeC6.elf
File opened for modification	/etc/crontab	oeC6.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	oeC6.elf

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	oeC6.elf

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	oeC6.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/28/cmdline	oeC6.elf
File opened for reading	/proc/382/cmdline	oeC6.elf
File opened for reading	/proc/834/cmdline	oeC6.elf
File opened for reading	/proc/9/cmdline	oeC6.elf
File opened for reading	/proc/872/exe	oeC6.elf
File opened for reading	/proc/888/cmdline	oeC6.elf
File opened for reading	/proc/387/exe	oeC6.elf
File opened for reading	/proc/694/exe	oeC6.elf
File opened for reading	/proc/831/exe	oeC6.elf
File opened for reading	/proc/835/cmdline	oeC6.elf
File opened for reading	/proc/6/cmdline	oeC6.elf
File opened for reading	/proc/34/cmdline	oeC6.elf
File opened for reading	/proc/374/cmdline	oeC6.elf
File opened for reading	/proc/823/cmdline	oeC6.elf
File opened for reading	/proc/866/cmdline	oeC6.elf
File opened for reading	/proc/892/cmdline	oeC6.elf
File opened for reading	/proc/351/exe	oeC6.elf
File opened for reading	/proc/804/cmdline	oeC6.elf
File opened for reading	/proc/837/exe	oeC6.elf
File opened for reading	/proc/861/cmdline	oeC6.elf
File opened for reading	/proc/868/cmdline	oeC6.elf
File opened for reading	/proc/35/cmdline	oeC6.elf
File opened for reading	/proc/416/cmdline	oeC6.elf
File opened for reading	/proc/889/cmdline	oeC6.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/32/cmdline	oeC6.elf
File opened for reading	/proc/764/cmdline	oeC6.elf
File opened for reading	/proc/860/exe	oeC6.elf
File opened for reading	/proc/870/exe	oeC6.elf
File opened for reading	/proc/873/exe	oeC6.elf
File opened for reading	/proc/884/exe	oeC6.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/836/cmdline	oeC6.elf
File opened for reading	/proc/868/exe	oeC6.elf
File opened for reading	/proc/886/cmdline	oeC6.elf
File opened for reading	/proc/891/cmdline	oeC6.elf
File opened for reading	/proc/661/exe	oeC6.elf
File opened for reading	/proc/mounts	oeC6.elf
File opened for reading	/proc/761/cmdline	oeC6.elf
File opened for reading	/proc/846/exe	oeC6.elf
File opened for reading	/proc/862/cmdline	oeC6.elf
File opened for reading	/proc/374/exe	oeC6.elf
File opened for reading	/proc/19/cmdline	oeC6.elf
File opened for reading	/proc/879/cmdline	oeC6.elf
File opened for reading	/proc/138/cmdline	oeC6.elf
File opened for reading	/proc/872/cmdline	oeC6.elf
File opened for reading	/proc/258/exe	oeC6.elf
File opened for reading	/proc/830/cmdline	oeC6.elf
File opened for reading	/proc/836/exe	oeC6.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/388/exe	oeC6.elf
File opened for reading	/proc/416/exe	oeC6.elf
File opened for reading	/proc/47/cmdline	oeC6.elf
File opened for reading	/proc/840/exe	oeC6.elf
File opened for reading	/proc/834/exe	oeC6.elf
File opened for reading	/proc/841/cmdline	oeC6.elf
File opened for reading	/proc/865/exe	oeC6.elf
File opened for reading	/proc/878/cmdline	oeC6.elf
File opened for reading	/proc/882/cmdline	oeC6.elf
File opened for reading	/proc/203/cmdline	oeC6.elf
File opened for reading	/proc/112/cmdline	oeC6.elf
File opened for reading	/proc/698/cmdline	oeC6.elf
File opened for reading	/proc/807/cmdline	oeC6.elf

/tmp/oeC6.elf
/tmp/oeC6.elf
1⤵
- Creates/modifies Cron job
- Modifies rc script
- Modifies systemd
- Checks CPU configuration
- Reads runtime system information
PID:798
- /usr/local/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:818
- /usr/local/sbin/systemctl
  systemctl enable crond.service
  2⤵
  PID:819
- /usr/local/bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:818
- /usr/local/bin/systemctl
  systemctl enable crond.service
  2⤵
  PID:819
- /usr/sbin/systemctl
  systemctl enable crond.service
  2⤵
  PID:819
- /usr/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:818
- /usr/local/sbin/chattr
  chattr +i /var/crond
  2⤵
  PID:882
- /usr/local/sbin/chattr
  chattr +i /usr/local/sbin/crond
  2⤵
  PID:881
- /usr/local/bin/chattr
  chattr +i /usr/local/sbin/crond
  2⤵
  PID:881
- /usr/local/bin/chattr
  chattr +i /var/crond
  2⤵
  PID:882
- /usr/sbin/chattr
  chattr +i /usr/local/sbin/crond
  2⤵
  PID:881
- /usr/sbin/chattr
  chattr +i /var/crond
  2⤵
  PID:882
- /usr/bin/chattr
  chattr +i /usr/local/sbin/crond
  2⤵
  PID:881
- /usr/bin/chattr
  chattr +i /var/crond
  2⤵
  PID:882
- /usr/local/sbin/chattr
  chattr +i /data/crond
  2⤵
  PID:883
- /usr/local/bin/chattr
  chattr +i /data/crond
  2⤵
  PID:883
- /usr/local/sbin/chattr
  chattr +i /home/crond
  2⤵
  PID:884
- /usr/sbin/chattr
  chattr +i /data/crond
  2⤵
  PID:883
- /usr/local/bin/chattr
  chattr +i /home/crond
  2⤵
  PID:884
- /usr/bin/chattr
  chattr +i /data/crond
  2⤵
  PID:883
- /usr/sbin/chattr
  chattr +i /home/crond
  2⤵
  PID:884
- /usr/local/sbin/chattr
  chattr +i /mnt/flash/crond
  2⤵
  PID:885
- /usr/bin/chattr
  chattr +i /home/crond
  2⤵
  PID:884
- /usr/local/bin/chattr
  chattr +i /mnt/flash/crond
  2⤵
  PID:885
- /usr/sbin/chattr
  chattr +i /mnt/flash/crond
  2⤵
  PID:885
- /usr/bin/chattr
  chattr +i /mnt/flash/crond
  2⤵
  PID:885
- /usr/local/sbin/chattr
  chattr +i /root/crond
  2⤵
  PID:886
- /usr/local/bin/chattr
  chattr +i /root/crond
  2⤵
  PID:886
- /usr/sbin/chattr
  chattr +i /root/crond
  2⤵
  PID:886
- /usr/local/sbin/chattr
  chattr +i /etc/crond
  2⤵
  PID:887
- /usr/bin/chattr
  chattr +i /root/crond
  2⤵
  PID:886
- /usr/local/bin/chattr
  chattr +i /etc/crond
  2⤵
  PID:887
- /usr/sbin/chattr
  chattr +i /etc/crond
  2⤵
  PID:887
- /usr/local/sbin/chattr
  chattr +i //crond
  2⤵
  PID:888
- /usr/bin/chattr
  chattr +i /etc/crond
  2⤵
  PID:887
- /usr/local/bin/chattr
  chattr +i //crond
  2⤵
  PID:888
- /usr/sbin/chattr
  chattr +i //crond
  2⤵
  PID:888
- /usr/local/sbin/chattr
  chattr +i /var/lib/crond
  2⤵
  PID:889
- /usr/local/bin/chattr
  chattr +i /var/lib/crond
  2⤵
  PID:889
- /usr/local/sbin/chattr
  chattr +i /var/spool/crond
  2⤵
  PID:890
- /usr/sbin/chattr
  chattr +i /var/lib/crond
  2⤵
  PID:889
- /usr/local/sbin/chattr
  chattr +i /var/cache/crond
  2⤵
  PID:891
- /usr/bin/chattr
  chattr +i /var/lib/crond
  2⤵
  PID:889
- /usr/local/bin/chattr
  chattr +i /var/spool/crond
  2⤵
  PID:890
- /usr/local/bin/chattr
  chattr +i /var/cache/crond
  2⤵
  PID:891
- /usr/sbin/chattr
  chattr +i /var/spool/crond
  2⤵
  PID:890
- /usr/bin/chattr
  chattr +i //crond
  2⤵
  PID:888
- /usr/local/sbin/chattr
  chattr +i /var/backups/crond
  2⤵
  PID:892
- /usr/sbin/chattr
  chattr +i /var/cache/crond
  2⤵
  PID:891
- /usr/bin/chattr
  chattr +i /var/spool/crond
  2⤵
  PID:890
- /usr/local/bin/chattr
  chattr +i /var/backups/crond
  2⤵
  PID:892
- /usr/sbin/chattr
  chattr +i /var/backups/crond
  2⤵
  PID:892
- /usr/bin/chattr
  chattr +i /var/backups/crond
  2⤵
  PID:892
- /usr/bin/chattr
  chattr +i /var/cache/crond
  2⤵
  PID:891
- /usr/local/sbin/chattr
  chattr +i /data/local/crond
  2⤵
  PID:893
- /usr/local/bin/chattr
  chattr +i /data/local/crond
  2⤵
  PID:893
- /usr/local/sbin/chattr
  chattr +i /data/misc/crond
  2⤵
  PID:894
- /usr/sbin/chattr
  chattr +i /data/local/crond
  2⤵
  PID:893
- /usr/local/bin/chattr
  chattr +i /data/misc/crond
  2⤵
  PID:894
- /usr/bin/chattr
  chattr +i /data/local/crond
  2⤵
  PID:893
- /usr/local/sbin/chattr
  chattr +i /home/root/crond
  2⤵
  PID:895
- /usr/sbin/chattr
  chattr +i /data/misc/crond
  2⤵
  PID:894
- /usr/local/bin/chattr
  chattr +i /home/root/crond
  2⤵
  PID:895
- /usr/sbin/chattr
  chattr +i /home/root/crond
  2⤵
  PID:895
- /usr/bin/chattr
  chattr +i /home/root/crond
  2⤵
  PID:895
- /usr/bin/chattr
  chattr +i /data/misc/crond
  2⤵
  PID:894
- /usr/local/sbin/chattr
  chattr +i /home/admin/crond
  2⤵
  PID:896
- /usr/local/bin/chattr
  chattr +i /home/admin/crond
  2⤵
  PID:896
- /usr/sbin/chattr
  chattr +i /home/admin/crond
  2⤵
  PID:896
- /usr/local/sbin/chattr
  chattr +i /mnt/flash/data/crond
  2⤵
  PID:897
- /usr/local/sbin/chattr
  chattr +i /usr/local/bin/crond
  2⤵
  PID:898
- /usr/bin/chattr
  chattr +i /home/admin/crond
  2⤵
  PID:896
- /usr/local/bin/chattr
  chattr +i /mnt/flash/data/crond
  2⤵
  PID:897
- /usr/sbin/chattr
  chattr +i /mnt/flash/data/crond
  2⤵
  PID:897
- /usr/local/sbin/chattr
  chattr +i /opt/crond
  2⤵
  PID:899
- /usr/bin/chattr
  chattr +i /mnt/flash/data/crond
  2⤵
  PID:897
- /usr/local/bin/chattr
  chattr +i /usr/local/bin/crond
  2⤵
  PID:898
- /usr/local/bin/chattr
  chattr +i /opt/crond
  2⤵
  PID:899
- /usr/sbin/chattr
  chattr +i /usr/local/bin/crond
  2⤵
  PID:898
- /usr/bin/chattr
  chattr +i /usr/local/bin/crond
  2⤵
  PID:898
- /usr/sbin/chattr
  chattr +i /opt/crond
  2⤵
  PID:899
- /usr/bin/chattr
  chattr +i /opt/crond
  2⤵
  PID:899
- /usr/local/sbin/chattr
  chattr +i /srv/crond
  2⤵
  PID:900
- /usr/local/bin/chattr
  chattr +i /srv/crond
  2⤵
  PID:900
- /usr/sbin/chattr
  chattr +i /srv/crond
  2⤵
  PID:900
- /usr/bin/chattr
  chattr +i /srv/crond
  2⤵
  PID:900
- /usr/local/sbin/systemctl
  systemctl stop crond.service
  2⤵
  PID:901
- /usr/local/bin/systemctl
  systemctl stop crond.service
  2⤵
  PID:901
- /usr/local/sbin/systemctl
  systemctl disable crond.service
  2⤵
  PID:902
- /usr/sbin/systemctl
  systemctl stop crond.service
  2⤵
  PID:901
- /usr/local/bin/systemctl
  systemctl disable crond.service
  2⤵
  PID:902
- /usr/sbin/systemctl
  systemctl disable crond.service
  2⤵
  PID:902
- /usr/local/sbin/systemctl
  systemctl daemon-reload
  2⤵
  PID:903

/usr/bin/systemctl
systemctl enable crond.service
1⤵
PID:819

/usr/bin/systemctl
systemctl daemon-reload
1⤵
- Reads runtime system information
PID:818

/usr/local/bin/systemctl
systemctl daemon-reload
1⤵
PID:903

/usr/sbin/systemctl
systemctl daemon-reload
1⤵
PID:903

/usr/bin/systemctl
systemctl stop crond.service
1⤵
- Reads runtime system information
PID:901

/usr/bin/systemctl
systemctl daemon-reload
1⤵
- Reads runtime system information
PID:903

/usr/bin/systemctl
systemctl disable crond.service
1⤵
- Reads runtime system information
PID:902

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 30B
SHA256 2cdee3b66599c9e11ec5e0eadb0117dca7da7514e74ef64a4d0484403bdb7e2c
MD5 3e740e8752c9503e49594de9d60a02d1
SHA1 2ff9c1b9b1d412e0ccb7a52e6514fbb6b84f95be
SHA512 b659f0956b25b154945ede6f82d6344d6b071ab3ad7500946f83a1f2c953673d6efd68b1a697d62171f38686ae5debab69f5638c7f8e18ff5b247a17d38c9877
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 34B
SHA256 e5ab6bdcca897ee4fa990e62acc4f309ffb4ff60880a3cb0c98a39ca9d71401d
MD5 eb3779a2ac8fab3d7a1e9594b4c075cf
SHA1 b2a5e3484e7b7405725f17d1adb3eb6bdb634bc4
SHA512 bfa5e0cf3bd9f7a79321cc3f000836e34b3aec0f816587e9d57dd25081733dcb49ee952acfc2b978787f4a7fa49ca997e8a9f191a5a00b83c3e8cbb4e80cfee9
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 193B
SHA256 ce8930cfef5a3bced772db4a8aa7cfabcfa3139017815c0edb39ad253066ca5f
MD5 fc054e0b23300f7f8474ea3020afdd85
SHA1 15b9022ed7fcbc5619e2ebffa6b3af40dfaf7286
SHA512 804989cff0bb7bda45bd25521038c5d2f901aa891d1acbdc6bf838fc1b1b928a93b6007d07662f3f11c48bbef70bc6c86eaf65d459c91b4e941ac2df2114b9d0
TLSH
T1BAC02223943214A0898F29E2AEAA2B448CA102411ACF92F00FE418291FE20E715218AE
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads