Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    04/08/2026, 07:32

General

  • Target
    e4c98ffa0389bb00f0fa639e31b0cce9
  • Size 710KB
  • Sample260804-jdbrysfc68
  • SHA256 867d505204d8d593c6ebd2ac0ba93204627ae8898a2efd62461ee147258b62d6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

  • Traces itself 1 IoCs

    Traces itself to prevent debugging attempts

  • Creates/modifies Cron job 1 TTPs 5 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

  • Creates/modifies environment variables 1 TTPs 7 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

  • Deletes log files 1 TTPs 1 IoCs

    Deletes log files on the system.

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

  • Modifies systemd 2 TTPs 2 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

  • Write file to user bin folder 4 IoCs
  • Writes file to system bin folder 1 IoCs
  • Modifies Bash startup script 2 TTPs 6 IoCs
  • Changes its process name 4 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

  • Creates a desktop entry file 3 TTPs 1 IoCs

    A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 9 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to shm directory 2 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/e4c98ffa0389bb00f0fa639e31b0cce9
    /tmp/e4c98ffa0389bb00f0fa639e31b0cce9
    1⤵
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Traces itself
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Deletes log files
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Write file to user bin folder
    • Writes file to system bin folder
    • Modifies Bash startup script
    • Changes its process name
    • Checks CPU configuration
    • Creates a desktop entry file
    • Reads CPU attributes
    • Reads runtime system information
    • Writes file to shm directory
    • Writes file to tmp directory
    PID:792
    • /usr/local/sbin/systemctl
      systemctl daemon-reload
      2⤵
        PID:800
      • /usr/local/bin/systemctl
        systemctl daemon-reload
        2⤵
          PID:800
        • /usr/sbin/systemctl
          systemctl daemon-reload
          2⤵
            PID:800
          • /usr/bin/systemctl
            systemctl daemon-reload
            2⤵
            • Reads runtime system information
            PID:800
          • /usr/local/sbin/systemctl
            systemctl enable network-dispatch.service
            2⤵
              PID:817
            • /usr/local/bin/systemctl
              systemctl enable network-dispatch.service
              2⤵
                PID:817
              • /usr/sbin/systemctl
                systemctl enable network-dispatch.service
                2⤵
                  PID:817
                • /usr/bin/systemctl
                  systemctl enable network-dispatch.service
                  2⤵
                  • Reads runtime system information
                  PID:817
                • /usr/local/sbin/systemctl
                  systemctl enable network-dispatch.timer
                  2⤵
                    PID:820
                  • /usr/local/bin/systemctl
                    systemctl enable network-dispatch.timer
                    2⤵
                      PID:820
                    • /usr/sbin/systemctl
                      systemctl enable network-dispatch.timer
                      2⤵
                        PID:820
                      • /usr/bin/systemctl
                        systemctl enable network-dispatch.timer
                        2⤵
                        • Reads runtime system information
                        PID:820
                      • /usr/local/sbin/systemctl
                        systemctl enable network-dispatch.path
                        2⤵
                          PID:821
                        • /usr/local/bin/systemctl
                          systemctl enable network-dispatch.path
                          2⤵
                            PID:821
                          • /usr/sbin/systemctl
                            systemctl enable network-dispatch.path
                            2⤵
                              PID:821
                            • /usr/bin/systemctl
                              systemctl enable network-dispatch.path
                              2⤵
                              • Reads runtime system information
                              PID:821
                            • /usr/local/sbin/nvram
                              nvram set "rc_startup=/etc/init.d/network-dispatch start"
                              2⤵
                                PID:822
                              • /usr/local/bin/nvram
                                nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                2⤵
                                  PID:822
                                • /usr/sbin/nvram
                                  nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                  2⤵
                                    PID:822
                                  • /usr/bin/nvram
                                    nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                    2⤵
                                      PID:822
                                    • /sbin/nvram
                                      nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                      2⤵
                                        PID:822
                                      • /bin/nvram
                                        nvram set "rc_startup=/etc/init.d/network-dispatch start"
                                        2⤵
                                          PID:822
                                        • /usr/local/sbin/nvram
                                          nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                          2⤵
                                            PID:823
                                          • /usr/local/bin/nvram
                                            nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                            2⤵
                                              PID:823
                                            • /usr/sbin/nvram
                                              nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                              2⤵
                                                PID:823
                                              • /usr/bin/nvram
                                                nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                2⤵
                                                  PID:823
                                                • /sbin/nvram
                                                  nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                  2⤵
                                                    PID:823
                                                  • /bin/nvram
                                                    nvram set "rc_service=/usr/local/bin/network-dispatch &"
                                                    2⤵
                                                      PID:823
                                                    • /usr/local/sbin/nvram
                                                      nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                      2⤵
                                                        PID:824
                                                      • /usr/local/bin/nvram
                                                        nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                        2⤵
                                                          PID:824
                                                        • /usr/sbin/nvram
                                                          nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                          2⤵
                                                            PID:824
                                                          • /usr/bin/nvram
                                                            nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                            2⤵
                                                              PID:824
                                                            • /sbin/nvram
                                                              nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                              2⤵
                                                                PID:824
                                                              • /bin/nvram
                                                                nvram set "sys_startup=/usr/local/bin/network-dispatch &"
                                                                2⤵
                                                                  PID:824
                                                                • /usr/local/sbin/nvram
                                                                  nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                  2⤵
                                                                    PID:825
                                                                  • /usr/local/bin/nvram
                                                                    nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                    2⤵
                                                                      PID:825
                                                                    • /usr/sbin/nvram
                                                                      nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                      2⤵
                                                                        PID:825
                                                                      • /usr/bin/nvram
                                                                        nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                        2⤵
                                                                          PID:825
                                                                        • /sbin/nvram
                                                                          nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                          2⤵
                                                                            PID:825
                                                                          • /bin/nvram
                                                                            nvram set "custom_script=/usr/local/bin/network-dispatch &"
                                                                            2⤵
                                                                              PID:825
                                                                            • /usr/local/sbin/nvram
                                                                              nvram commit
                                                                              2⤵
                                                                                PID:828
                                                                              • /usr/local/bin/nvram
                                                                                nvram commit
                                                                                2⤵
                                                                                  PID:828
                                                                                • /usr/sbin/nvram
                                                                                  nvram commit
                                                                                  2⤵
                                                                                    PID:828
                                                                                  • /usr/bin/nvram
                                                                                    nvram commit
                                                                                    2⤵
                                                                                      PID:828
                                                                                    • /sbin/nvram
                                                                                      nvram commit
                                                                                      2⤵
                                                                                        PID:828
                                                                                      • /bin/nvram
                                                                                        nvram commit
                                                                                        2⤵
                                                                                          PID:828
                                                                                        • /usr/local/sbin/fw_printenv
                                                                                          fw_printenv bootcmd
                                                                                          2⤵
                                                                                            PID:829
                                                                                          • /usr/local/bin/fw_printenv
                                                                                            fw_printenv bootcmd
                                                                                            2⤵
                                                                                              PID:829
                                                                                            • /usr/sbin/fw_printenv
                                                                                              fw_printenv bootcmd
                                                                                              2⤵
                                                                                                PID:829
                                                                                              • /usr/bin/fw_printenv
                                                                                                fw_printenv bootcmd
                                                                                                2⤵
                                                                                                  PID:829
                                                                                                • /usr/local/sbin/fw_setenv
                                                                                                  fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                                                                  2⤵
                                                                                                    PID:830
                                                                                                  • /usr/local/bin/fw_setenv
                                                                                                    fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                                                                    2⤵
                                                                                                      PID:830
                                                                                                    • /usr/sbin/fw_setenv
                                                                                                      fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                                                                      2⤵
                                                                                                        PID:830
                                                                                                      • /usr/bin/fw_setenv
                                                                                                        fw_setenv preboot "sh /usr/local/bin/network-dispatch &"
                                                                                                        2⤵
                                                                                                          PID:830
                                                                                                        • /etc/init.d/network-dispatch
                                                                                                          /etc/init.d/network-dispatch enable
                                                                                                          2⤵
                                                                                                            PID:831
                                                                                                          • /usr/local/sbin/rc-update
                                                                                                            rc-update add network-dispatch
                                                                                                            2⤵
                                                                                                              PID:832
                                                                                                            • /usr/local/bin/rc-update
                                                                                                              rc-update add network-dispatch
                                                                                                              2⤵
                                                                                                                PID:832
                                                                                                              • /usr/sbin/rc-update
                                                                                                                rc-update add network-dispatch
                                                                                                                2⤵
                                                                                                                  PID:832
                                                                                                                • /usr/bin/rc-update
                                                                                                                  rc-update add network-dispatch
                                                                                                                  2⤵
                                                                                                                    PID:832
                                                                                                                  • /sbin/rc-update
                                                                                                                    rc-update add network-dispatch
                                                                                                                    2⤵
                                                                                                                      PID:832
                                                                                                                    • /bin/rc-update
                                                                                                                      rc-update add network-dispatch
                                                                                                                      2⤵
                                                                                                                        PID:832

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          .network-dispatch

                                                                                                                          • Path /dev/mqueue/.network-dispatch
                                                                                                                          • Size 4KB
                                                                                                                          • SHA256 e6d31f0768a8a7b216c63e24b69b194eb91bbcebc2808a846e5224bda5101b08
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          99-net

                                                                                                                          • Path /etc/NetworkManager/dispatcher.d/99-net
                                                                                                                          • Size 210B
                                                                                                                          • SHA256 776d1761eae08b8cfc6e2a8e8699b9f4d03612652dccdce1945faeb689bfeafb
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          99-net

                                                                                                                          • Path /etc/apt/apt.conf.d/99-net
                                                                                                                          • Size 106B
                                                                                                                          • SHA256 1b1231ac2da301495d86a53afc51256f9bb669db34eb313681f4d6f6c3999fff
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          network-dispatch

                                                                                                                          • Path /etc/cron.d/network-dispatch
                                                                                                                          • Size 53B
                                                                                                                          • SHA256 dc0d6fb40d96137f3c6505b3eef4071011f9fd05d4d4697fb2e53509b941bfb9
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          network-dispatch

                                                                                                                          • Path /etc/cron.hourly/network-dispatch
                                                                                                                          • Size 153B
                                                                                                                          • SHA256 e697cfb597843583c2ba1fead9bb44cd19a77964d1d80e4b5a654cf5b7716049
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          net

                                                                                                                          • Path /etc/dhcp/dhclient-exit-hooks.d/net
                                                                                                                          • Size 155B
                                                                                                                          • SHA256 060d71aff2e29495b1504502181fcafc057a357e1eea08bcf577139fb856eda7
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          network-dispatch

                                                                                                                          • Path /etc/dinit.d/network-dispatch
                                                                                                                          • Size 113B
                                                                                                                          • SHA256 4b7155af80fe3e49f510c8f6eae1ece9fe0e8ef049a0f03e3e6541e4279dc094
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          inetd.conf

                                                                                                                          • Path /etc/inetd.conf
                                                                                                                          • Size 94B
                                                                                                                          • SHA256 57fae5c95bbd8f5a4d0b1bb7a8dbc013da6af6719109b42e76fcd76c78714e91
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          network-dispatch

                                                                                                                          • Path /etc/init.d/network-dispatch
                                                                                                                          • Size 274B
                                                                                                                          • SHA256 789ca44e264ccab23b87f19a7caad559621c915965f2c5c79b7750a77fd03e68
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          network-dispatch

                                                                                                                          • Path /etc/init.d/network-dispatch
                                                                                                                          • Size 212B
                                                                                                                          • SHA256 0a37c1a8d049918041b5ce44091ff75ff30399afde95f3ed5f3d1c4f9ae6340d
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          network-dispatch

                                                                                                                          • Path /etc/init.d/network-dispatch
                                                                                                                          • Size 162B
                                                                                                                          • SHA256 b4b2f8b02d369f1e66c96ed4f829ad1ce9338ef5e0b34c3e9de4943fe97fcd2a
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          inittab

                                                                                                                          • Path /etc/inittab
                                                                                                                          • Size 43B
                                                                                                                          • SHA256 da40a0f49a0445ccce643f0bdd1b0d7a973887049de319715e42b05b14e4c1a3
                                                                                                                          • MD5 SHA1 SHA512

                                                                                                                          network-dispatch.start

                                                                                                                          • Path /etc/local.d/network-dispatch.start
                                                                                                                          • Size 88B
                                                                                                                          • SHA256 6c9c89370a346bffd0fb49fbacd5e6cc0419ccbea43fe3640494dc9163fb3f86
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          keeprc.conf

                                                                                                                          • Path /etc/opkg/keeprc.conf
                                                                                                                          • Size 54B
                                                                                                                          • SHA256 7cf39b594679820bedec1cbb2aca992ae9e02106ae2e2b7db2036355e6644c0d
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          00-net.sh

                                                                                                                          • Path /etc/profile.d/00-net.sh
                                                                                                                          • Size 104B
                                                                                                                          • SHA256 f48aa622f48b7b1d21ae011bbd029444bbe64d3db4455583c1502ab3234f8237
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          rc.local

                                                                                                                          • Path /etc/rc.local
                                                                                                                          • Size 41B
                                                                                                                          • SHA256 89f0ba0c08ba4dcf993bde361344fc7ef9dbb435603178aac80986626f67867e
                                                                                                                          • MD5 SHA1 SHA512

                                                                                                                          run

                                                                                                                          • Path /etc/sv/network-dispatch/run
                                                                                                                          • Size 47B
                                                                                                                          • SHA256 4537f63d79de8a03f2be6832ef308d6f91d99b1878831970b11972bfa66c80cd
                                                                                                                          • MD5 SHA1 SHA512

                                                                                                                          network-dispatch-gen

                                                                                                                          • Path /etc/systemd/system-generators/network-dispatch-gen
                                                                                                                          • Size 387B
                                                                                                                          • SHA256 8ba6bf8e42767ace35afdc90bcdeeec40343e05a662c1b1d21217190806ec325
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          network-dispatch.service

                                                                                                                          • Path /etc/systemd/system/network-dispatch.service
                                                                                                                          • Size 228B
                                                                                                                          • SHA256 f0a4522d9cacf37bc711ef07c7a07d2627ac3fb2a25e13e1695db14896da415e
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          99-network-dispatch.rules

                                                                                                                          • Path /etc/udev/rules.d/99-network-dispatch.rules
                                                                                                                          • Size 144B
                                                                                                                          • SHA256 42a9eef129fbeeaca0319f9309d96f1395b8fb80f3b50bec77550acf10d4b376
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          network-dispatch.desktop

                                                                                                                          • Path /etc/xdg/autostart/network-dispatch.desktop
                                                                                                                          • Size 150B
                                                                                                                          • SHA256 9e4b415925f30fa0dc525855d2269f7a90d712714ba5ec64b4cdd9e628a517b6
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          .bash_profile

                                                                                                                          • Path /root/.bash_profile
                                                                                                                          • Size 95B
                                                                                                                          • SHA256 e89e5301a59ce3fb142a5e91407aa628339ca08123fb850acfea056ee059db91
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          network-dispatch.service

                                                                                                                          • Path /root/.config/systemd/user/network-dispatch.service
                                                                                                                          • Size 152B
                                                                                                                          • SHA256 8493e90ac274688355fba972b6898b69fa003b1c742ad77b026a3518fbbea18d
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          network-dispatch

                                                                                                                          • Path /usr/local/bin/network-dispatch
                                                                                                                          • Size 710KB
                                                                                                                          • SHA256 867d505204d8d593c6ebd2ac0ba93204627ae8898a2efd62461ee147258b62d6
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                                                          watchdog-net

                                                                                                                          • Path /usr/local/bin/watchdog-net
                                                                                                                          • Size 186B
                                                                                                                          • SHA256 39524eda228aa5586b775c3fa9b2b3a5b4e114ae0cf1e3f284fb5d0a2a87a8e5
                                                                                                                          • MD5 SHA1 SHA512 TLSH

                                                                                                                          root

                                                                                                                          • Path /var/spool/cron/crontabs/root
                                                                                                                          • Size 126B
                                                                                                                          • SHA256 84512cb49c634de2560f05a51fd68808c610dd6af6c4adccb5e5b022f1006e7a
                                                                                                                          • MD5 SHA1 SHA512 TLSH