3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892

Analysis

max time kernel
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/08/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892.sh
Size 1KB
Sample260810-22dwbswsfz
SHA256 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892
MD5 2ca1a863f6a115127d623d3d181ab9b4
SHA1 58c15d76520685b6c151cd48b09375bb94b825be
SHA512 a0ae4c381d90f162558cbfd1b79a85716937d6899399a5a13b2846611e545388c69e02ad819701f60cafb1ae2cb8d026a5fb2ea790a6aa050478036d696c31ee
TLSH
T1AB21BE8EABA1ED3120D9D528B7F2493E5E62F29A2C107411358631FCE4DC62032EDC7A
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.eBbgBx	crontab

Removes the immutable protection flag from a file 1 TTPs 29 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
675	chattr
682	grep
689	grep
698	grep
704	grep
719	chattr
722	chattr
726	grep
676	grep
681	chattr
695	grep
703	chattr
723	grep
679	chattr
686	grep
697	chattr
701	chattr
702	chattr
725	chattr
672	chattr
680	chattr
688	chattr
692	grep
694	chattr
707	grep
685	chattr
691	chattr
700	chattr
720	grep

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 31 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/clean_file	3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892.sh

/tmp/3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892.sh
/tmp/3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892.sh
1⤵
- Writes file to tmp directory
PID:644
- /bin/systemctl
  systemctl disable c3pool_miner
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:649
- /bin/systemctl
  systemctl stop c3pool_miner
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:657
- /bin/systemctl
  systemctl disable bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:667
- /bin/systemctl
  systemctl stop bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:669
- /usr/bin/chattr
  chattr -ia /var/spool/cron/crontabs
  2⤵
  - Removes the immutable protection flag from a file
  PID:672
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:675
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:676
- /bin/mv
  mv -f /tmp/clean_file /etc/crontab
  2⤵
  - Reads runtime system information
  PID:678
- /usr/bin/chattr
  chattr -ia /etc/cron.hourly
  2⤵
  - Removes the immutable protection flag from a file
  PID:679
- /usr/bin/chattr
  chattr -ia /etc/cron.daily
  2⤵
  - Removes the immutable protection flag from a file
  PID:680
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/apt-compat
  2⤵
  - Removes the immutable protection flag from a file
  PID:681
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/apt-compat
  2⤵
  - Removes the immutable protection flag from a file
  PID:682
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/apt-compat
  2⤵
  - Reads runtime system information
  PID:684
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/bsdmainutils
  2⤵
  - Removes the immutable protection flag from a file
  PID:685
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/bsdmainutils
  2⤵
  - Removes the immutable protection flag from a file
  PID:686
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/bsdmainutils
  2⤵
  - Reads runtime system information
  PID:687
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/dpkg
  2⤵
  - Removes the immutable protection flag from a file
  PID:688
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/dpkg
  2⤵
  - Removes the immutable protection flag from a file
  PID:689
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/dpkg
  2⤵
  - Reads runtime system information
  PID:690
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/exim4-base
  2⤵
  - Removes the immutable protection flag from a file
  PID:691
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/exim4-base
  2⤵
  - Removes the immutable protection flag from a file
  PID:692
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/exim4-base
  2⤵
  - Reads runtime system information
  PID:693
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/logrotate
  2⤵
  - Removes the immutable protection flag from a file
  PID:694
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/logrotate
  2⤵
  - Removes the immutable protection flag from a file
  PID:695
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/logrotate
  2⤵
  - Reads runtime system information
  PID:696
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/passwd
  2⤵
  - Removes the immutable protection flag from a file
  PID:697
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/passwd
  2⤵
  - Removes the immutable protection flag from a file
  PID:698
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/passwd
  2⤵
  - Reads runtime system information
  PID:699
- /usr/bin/chattr
  chattr -ia /etc/cron.weekly
  2⤵
  - Removes the immutable protection flag from a file
  PID:700
- /usr/bin/chattr
  chattr -ia /etc/cron.monthly
  2⤵
  - Removes the immutable protection flag from a file
  PID:701
- /usr/bin/chattr
  chattr -ia /etc/cron.d
  2⤵
  - Removes the immutable protection flag from a file
  PID:702
- /usr/bin/chattr
  chattr -ia /etc/anacrontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:703
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/anacrontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:704
- /bin/mv
  mv -f /tmp/clean_file /etc/anacrontab
  2⤵
  - Reads runtime system information
  PID:705
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d"
  2⤵
  - Removes the immutable protection flag from a file
  PID:707
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:706
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:708
- /bin/grep
  grep -q /tmp
  2⤵
  PID:711
- /bin/grep
  grep -q /var/tmp
  2⤵
  PID:713
- /usr/bin/find
  find /var/tmp -mindepth 1 -maxdepth 1 -exec rm -rf -- "{}" +
  2⤵
  - Reads runtime system information
  PID:714
- - /usr/local/sbin/rm
    rm -rf -- /var/tmp/systemd-private-7283243e3ee14c7ebfefb807e8d286c2-systemd-timedated.service-4zBMN9
    3⤵
    PID:715
- - /usr/local/bin/rm
    rm -rf -- /var/tmp/systemd-private-7283243e3ee14c7ebfefb807e8d286c2-systemd-timedated.service-4zBMN9
    3⤵
    PID:715
- - /usr/sbin/rm
    rm -rf -- /var/tmp/systemd-private-7283243e3ee14c7ebfefb807e8d286c2-systemd-timedated.service-4zBMN9
    3⤵
    PID:715
- - /usr/bin/rm
    rm -rf -- /var/tmp/systemd-private-7283243e3ee14c7ebfefb807e8d286c2-systemd-timedated.service-4zBMN9
    3⤵
    PID:715
- - /sbin/rm
    rm -rf -- /var/tmp/systemd-private-7283243e3ee14c7ebfefb807e8d286c2-systemd-timedated.service-4zBMN9
    3⤵
    PID:715
- - /bin/rm
    rm -rf -- /var/tmp/systemd-private-7283243e3ee14c7ebfefb807e8d286c2-systemd-timedated.service-4zBMN9
    3⤵
    PID:715
- /bin/grep
  grep -q /dev/shm
  2⤵
  PID:717
- /usr/bin/find
  find /dev/shm -mindepth 1 -maxdepth 1 -exec rm -rf -- "{}" +
  2⤵
  - Reads runtime system information
  PID:718
- /usr/bin/chattr
  chattr -ia /root/.bashrc
  2⤵
  - Removes the immutable protection flag from a file
  PID:719
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /root/.bashrc
  2⤵
  - Removes the immutable protection flag from a file
  PID:720
- /bin/mv
  mv -f /tmp/clean_file /root/.bashrc
  2⤵
  - Reads runtime system information
  PID:721
- /usr/bin/chattr
  chattr -ia /root/.bash_profile
  2⤵
  - Removes the immutable protection flag from a file
  PID:722
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /root/.bash_profile
  2⤵
  - Removes the immutable protection flag from a file
  PID:723
- /bin/mv
  mv -f /tmp/clean_file /root/.bash_profile
  2⤵
  - Reads runtime system information
  PID:724
- /usr/bin/chattr
  chattr -ia /root/.profile
  2⤵
  - Removes the immutable protection flag from a file
  PID:725
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /root/.profile
  2⤵
  - Removes the immutable protection flag from a file
  PID:726
- /bin/mv
  mv -f /tmp/clean_file /root/.profile
  2⤵
  - Reads runtime system information
  PID:727

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clean_file

Path /tmp/clean_file
Size 3KB
SHA256 70633db2fbb6f06c7eb01bdf1d094f602d3a86af456aa5e9cbf38732c84b2a81
MD5 c68ec131874aa008336272933b70de85
SHA1 23e71f7d1d77f35acda2422d6a3e172500e7f3e1
SHA512 49eddd530ab548984801c5de01c0486d985f0091af9956f89682f00ee9f6a8d4ae66c44d469ed752d236861c3ebcfe6aad4923a6f1a431b7ed8125f9db166d19
TLSH
T108819285E37CA730144C09AC29BC15266AB5042F5D11BF60B4DCF24C6B8AE9972FEF8C
MD5 SHA1 SHA512 TLSH

Submit Download

clean_file

Path /tmp/clean_file
Size 722B
SHA256 0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354
MD5 8f111d100ea459f68d333d63a8ef2205
SHA1 077ca9c46a964de67c0f7765745d5c6f9e2065c3
SHA512 d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb
TLSH
T14B019C6A9366B3BF464CDDE166D7BDAC226230641C007D0B94BD2580B24FB625050C6E
MD5 SHA1 SHA512 TLSH

Submit Download

clean_file

Path /tmp/clean_file
Size 1KB
SHA256 8eeae3a9df22621d51062e4dadfc5c63b49732b38a37b5d4e52c99c2237e5767
MD5 bc4a71cbcaeed4179f25d798257fa980
SHA1 61445721d0b5d86ac0a8386a4ceef450118f4fbb
SHA512 709badb4dd1a15a10b34f82d31ed4bbab81698190d2ec94e2ad3dcdc90d97b893eb61cde72f08e517a8beea08ec1d675385fd42a9e77530981b7d83c6bd3548c
TLSH
T1FE31320172CA19BD16B7189C169BA21CAF6A349B45193610F8CD7460AF70931F571EBF
MD5 SHA1 SHA512 TLSH

Submit Download

clean_file

Path /tmp/clean_file
Size 279B
SHA256 340dfc483eb79b83b0630b1c0b339e30ebd724ef2f58bb87ba92946472e8e63d
MD5 911a774fe040993b929504f3d9415ab3
SHA1 55ccc8e95097f005abf9f4d91a14394e6d0f5da5
SHA512 1eb8fd8dc6fd444ba2fa3ca7e863894cfb19383e5b20c700ed24aa615402340424d093a761632cf27a3e789ecd548ca972806e154161635da4f97b415d6fc64f
TLSH
T1E1D02BC6EC444330BC1D45A7645B1FA6E0C6167F1A15BCB480F93F10B1E56B830D290E
MD5 SHA1 SHA512 TLSH

Submit Download

clean_file

Path /tmp/clean_file
Size 1KB
SHA256 eff406c0943e1399e3e15fdb6ca2893a187d6b273f5bd9d17eec4e4b4c52b8cd
MD5 30e858769aacd9cc309502f8d5c6aa0f
SHA1 927c06dd4d6cbb5ca02e9505011c8667c47f2d6e
SHA512 f7f6e70925afe54fc2fdaae13a750b3c49fde9fa59d80af321885d270112ebb2291f034037708f1ba8515f3e3e1ca0a493cd1e002895aa699c469e0365ccde3c
TLSH
T17F31745F43004E7D558308E89DA68EC0DA0460B757B4314436AEF6F52F8B332F6A756C
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.eBbgBx

Path /var/spool/cron/crontabs/tmp.eBbgBx
Size 175B
SHA256 3de1b64c9b1b4b3402eb7bfb35dc1cdb1e6e8b986b272616e6f6547b60bbf5e7
MD5 d551be7de3af867b62d5a8e6e046aa45
SHA1 fe0e9f4110dfb85f8dea71875130c2a04513a657
SHA512 792f9943248ac6d4932fb6e2bba5f353e29618f63a3352c368ce96d3d19714687b545994c2638976b173c8ba642ec3eac140644aa2faaedc81a754e154a9feb5
TLSH
T12AC0C00C7F1064306D810704221A22196841903DC00DFE20F1EC0004034368C7B41571
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads