Overview

overview

6

Static

static

1

1htR

debian-12-armhf

6

Analysis

  • max time kernel
    40s
  • max time network
    42s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260127-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    10/08/2026, 10:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1htR
  • Size 86KB
  • Sample260810-msh2cs1zew
  • SHA256 954dd815b49eafe68cf6f493ca1cd9a409a6f1af48c25084c844a24f06ffa38a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/1htR
    /tmp/1htR
    1⤵
    • Creates/modifies Cron job
    • Modifies rc script
    • Modifies systemd
    • Reads runtime system information
    PID:786
    • /usr/local/sbin/systemctl
      systemctl daemon-reload
      2⤵
        PID:813
      • /usr/local/sbin/systemctl
        systemctl enable crond.service
        2⤵
          PID:814
        • /usr/local/bin/systemctl
          systemctl enable crond.service
          2⤵
            PID:814
          • /usr/local/bin/systemctl
            systemctl daemon-reload
            2⤵
              PID:813
            • /usr/sbin/systemctl
              systemctl enable crond.service
              2⤵
                PID:814
              • /usr/sbin/systemctl
                systemctl daemon-reload
                2⤵
                  PID:813
              • /usr/bin/systemctl
                systemctl enable crond.service
                1⤵
                  PID:814
                • /usr/bin/systemctl
                  systemctl daemon-reload
                  1⤵
                    PID:813

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        crond
                        • Path /etc/cron.d/crond
                        • Size 26B
                        • SHA256 7eb6f4b1d5d2a4a1a4386c7d6f7d8736af8b080711aa1bde94b93d6a639e61e3
                        • MD5 SHA1 SHA512
                        Submit Download

                        rc.local
                        • Path /etc/rc.local
                        • Size 10B
                        • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                        • MD5 SHA1 SHA512
                        Submit Download

                        rc.local
                        • Path /etc/rc.local
                        • Size 30B
                        • SHA256 5ca2feae5ecf652d4ab66d027a3006f43804864d71a6b1b0d9149065510a6e5b
                        • MD5 SHA1 SHA512
                        Submit Download

                        crond.service
                        • Path /etc/systemd/system/crond.service
                        • Size 189B
                        • SHA256 48a6e350af298bb474feb2af1a338c42211f22d9e5bceb0ccdab87f16e25a688
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download