aa33ec05cee64b5aa1a7fd0b79f2875816d1ac2518f6afafe26a45f9d8b27a23 | Triage™

Login
Reports

Overview

overview

7

Static

static

1

sources/debian/rules

ubuntu-18.04-amd64

1

sources/debian/rules

debian-9-armhf

1

sources/debian/rules

debian-9-mips

sources/debian/rules

debian-9-mipsel

sources/us...ess.sh

ubuntu-18.04-amd64

1

sources/us...ess.sh

debian-9-armhf

1

sources/us...ess.sh

debian-9-mips

sources/us...ess.sh

debian-9-mipsel

sources/us...erf.sh

ubuntu-18.04-amd64

1

sources/us...erf.sh

debian-9-armhf

1

sources/us...erf.sh

debian-9-mips

sources/us...erf.sh

debian-9-mipsel

sources/us...ram.sh

ubuntu-18.04-amd64

7

sources/us...ram.sh

debian-9-armhf

7

sources/us...ram.sh

debian-9-mips

sources/us...ram.sh

debian-9-mipsel

Sharing

Copy URL Twitter E-mail

General

Target
adaptation-droidian-exynos9810_5+git20240106213304.36dabf6.trixie.production.tar.xz
Size 18KB
Sample260724-11c2zathmh
SHA256 aa33ec05cee64b5aa1a7fd0b79f2875816d1ac2518f6afafe26a45f9d8b27a23
MD5 a82f04001ee359269b1913a3e2427cd1
SHA1 e9918345d8585373135ee686af147419c623eba9
SHA512 92bca4ec26167f676c85adc95f9d16922fb922b1a4bcd911b122a09e9b7cecd01220860d23675efc20793ff9235090d4b3e79db999d0b64b6f8698521340bd54
SSDEEP 384:6MuDytV81LOe5lxpCfJJUGZ5VozOYEs3D/lv3G/+crSc:6MuDytm1LOeahJU+ls3l3jwv
TLSH
T15682D1100A0433D1F57DB89F98ECBD25AB869D0DF33425DD41A2A8AE781A042CADADC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery linux privilege_escalation rootkit

Static task

static1

Behavioral task

behavioral1

Sample

sources/debian/rules

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

sources/debian/rules

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

sources/debian/rules

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

sources/debian/rules

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

sources/usr/bin/droid/droid-get-bt-address.sh

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

sources/usr/bin/droid/droid-get-bt-address.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

sources/usr/bin/droid/droid-get-bt-address.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

sources/usr/bin/droid/droid-get-bt-address.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

sources/usr/bin/droidian-perf.sh

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

sources/usr/bin/droidian-perf.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

sources/usr/bin/droidian-perf.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

sources/usr/bin/droidian-perf.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

sources/usr/bin/setup-zram.sh

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

4 signatures

150 seconds

defense_evasion discovery privilege_escalation rootkit

Behavioral task

behavioral14

Sample

sources/usr/bin/setup-zram.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

4 signatures

150 seconds

defense_evasion discovery privilege_escalation rootkit

Behavioral task

behavioral15

Sample

sources/usr/bin/setup-zram.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

sources/usr/bin/setup-zram.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Malware Config

Targets

- Target
  sources/debian/rules
- Size 832B
- SHA256 7cdba9350b6e1dc32ea85cdd875ce5535baf354fac03de81b074288d700732e2
- MD5 65bd6010e423c60fc405c555e1ad64ec
- SHA1 06d8fb164b3f6d70c7da65b3660bc0d29f968b41
- SHA512 5f8453ae5f8739ecdffc3bcc978287d89924748f7fd0c47b51a23d114c2f0e854ee4f53ee2ca98ca7aff84a6ce611953fe43a3c2790ac1fa8a8342f23d792c6f
- TLSH
  T196014CB3C7CEA4313C27D805FC634101EC61EEB9609A392007F6712995D7B87223AC12
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  sources/usr/bin/droid/droid-get-bt-address.sh
- Size 283B
- SHA256 997684a07066c84650a8ed287910eb7ec8f42c727173620e59791b87e34dad93
- MD5 58bc8881126fa77b5f2d1a03ffc62b63
- SHA1 1b2e4273357d26b3a096d9b94c861b852d13a888
- SHA512 fd2df8ecdaf6fc8ebaf9a3d0ef0f7b4f85ab25a9e3270dcddc430245cf6c65cc65da1bfef9324526411f292a53a5569f3eb10fcb1c682c69c0e7e6e0bd7b5318
- TLSH
  T157D0124B96062A756CF837DEF65DD5DDDEC51AC1081204642044F055FED0E649CFC2C1
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  sources/usr/bin/droidian-perf.sh
- Size 4KB
- SHA256 ada1ba5fd09f5b04bb114fa742799fc6471e50fed6f00277356a5d8664e6439a
- MD5 78214fe59383bacfe4c75a476c40efa7
- SHA1 84dad733dfb0ea4c23eeeb805cb8f4ed2fa4af03
- SHA512 00c412ad0adc67988f78d1e91e8c2b3b93a9d8e06e5a86189226e1c0d067f22e610412538612b76e0e065278163a252cf0ad1bf323f5a57cab8d616ef50cb483
- SSDEEP 96:HeQdeQxeQXeQOJ5k0InmeQ9eQkeQneQ41eQMeQwhwqemeQteQWXZeMoN6zPIeQ0f:HbdbxbXbOJ9b9bkbnbObMb4wqZbtbwdn
- TLSH
  T15A91DAF3B565C61577FA20DB968EC342AD8B84DE338829144F0D41BC736EC85C1BBA66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  sources/usr/bin/setup-zram.sh
- Size 426B
- SHA256 7504c2d6184d2ef2247cd541e66a05a705691f3bf0a1d9017a55a004ab98ea46
- MD5 2a8b9d10a592755291d3ae5bb1a0ae24
- SHA1 aac9eae8265c839b40a1e73a75072aa4e04e939c
- SHA512 ac053e4f4fcf0f0b87bff51712e22b48d3584e21ab8987136343215a581aba9a88ff7320a2f06186c30fb1b8d7f6c39cbf41efc503034a44e50f1444b64b608f
- TLSH
  T115E0ABEFD8E12AE4300F90B62CDE2CAAA02B0719AD761BF23125002978BED0C317C000
- MD5 SHA1 SHA512 TLSH
Score

7^/10

defense_evasion discovery privilege_escalation rootkit
- Loads a kernel module
  Loads a Linux kernel module, potentially to achieve persistence
  rootkit
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  Abuse sudo or cached sudo credentials to execute code.
  privilege_escalation defense_evasion
behavioral13 behavioral14 behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Sudo and Sudo Caching

Defense Evasion

Abuse Elevation Control Mechanism

Sudo and Sudo Caching

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

defense_evasiondiscoveryprivilege_escalationrootkit

behavioral14

defense_evasiondiscoveryprivilege_escalationrootkit

behavioral15

behavioral16

© 2018-2026

Terms | Privacy