08358d066e0d757582926ff181e0d2ad647e6bd50816db9ead0e59f95184d565

Analysis

max time kernel
5s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/08/2026, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
execute
Size 543B
Sample260810-wyy47seq2z
SHA256 08358d066e0d757582926ff181e0d2ad647e6bd50816db9ead0e59f95184d565
MD5 dfba91109b2050937e45c605dd8f7eec
SHA1 d044cc8c9be883d94391cbd637dd376a291894ed
SHA512 a9efc5e6742f941b99b6442f4f5c46499a5ce8ed3c9e994a0dba5ccd507a5e888d3869b82857fb5f8610a4d77ce07fca293eeccd922903ac63195ef405d45717
TLSH
T15CF02B56F2305EB47C9948589947F68829837FA1889C73B0B0CBAE0E74CC51AB154FB3
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
667	sh
669	chmod

Enumerates kernel/hardware configuration 1 TTPs 7 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl

/tmp/execute
/tmp/execute
1⤵
PID:657
- /usr/bin/whoami
  whoami
  2⤵
  PID:660
- /bin/sh
  sh -c "/bin/monitor > /dev/null 2>&1 &"
  2⤵
  PID:664
- /bin/sh
  sh -c "chmod 755 /bin/save > /dev/null 2>&1 &"
  2⤵
  - File and Directory Permissions Modification
  PID:667
- /bin/sh
  sh -c "systemctl enable crond > /dev/null 2>&1 &"
  2⤵
  PID:670
- /bin/sh
  sh -c "systemctl start crond > /dev/null 2>&1 &"
  2⤵
  PID:674
- /bin/sh
  sh -c "/etc/init.d/crond start > /dev/null 2>&1 &"
  2⤵
  PID:679
- /bin/sh
  sh -c "systemctl enable cron > /dev/null 2>&1 &"
  2⤵
  PID:681
- /bin/sh
  sh -c "systemctl start cron > /dev/null 2>&1 &"
  2⤵
  PID:687
- /bin/sh
  sh -c "/etc/init.d/cron start > /dev/null 2>&1 &"
  2⤵
  PID:690

/bin/monitor
/bin/monitor
1⤵
PID:666

/bin/chmod
chmod 755 /bin/save
1⤵
- File and Directory Permissions Modification
PID:669

/bin/systemctl
systemctl enable crond
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:673

/bin/systemctl
systemctl start crond
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:676

/etc/init.d/crond
/etc/init.d/crond start
1⤵
PID:680

/bin/systemctl
systemctl enable cron
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:686
- /lib/systemd/systemd-sysv-install
  /lib/systemd/systemd-sysv-install enable cron
  2⤵
  PID:694
- - /usr/bin/getopt
    getopt -o r: --long root: -- enable cron
    3⤵
    PID:697
- - /usr/sbin/update-rc.d
    /usr/sbin/update-rc.d cron defaults
    3⤵
    PID:698
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:721
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:721
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:721
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:721
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:721
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:721
- - /usr/sbin/update-rc.d
    /usr/sbin/update-rc.d cron enable
    3⤵
    PID:735
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:736
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:736
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:736
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:736
  - - /sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:736
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:736

/bin/systemctl
systemctl start cron
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:689

/etc/init.d/cron
/etc/init.d/cron start
1⤵
PID:691
- /bin/run-parts
  run-parts --lsbsysinit --list /lib/lsb/init-functions.d
  2⤵
  PID:692
- /bin/systemctl
  systemctl -p LoadState --value show cron.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:695
- /bin/egrep
  egrep "^LANG=" /etc/default/locale
  2⤵
  PID:702
- /usr/bin/tail
  tail -n1
  2⤵
  PID:703
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:704
- /bin/grep
  grep -E "^LANG=" /etc/default/locale
  2⤵
  PID:702
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:709
- /usr/bin/tail
  tail -n1
  2⤵
  PID:708
- /bin/egrep
  egrep "^LANGUAGE=" /etc/default/locale
  2⤵
  PID:707
- /bin/grep
  grep -E "^LANGUAGE=" /etc/default/locale
  2⤵
  PID:707
- /usr/bin/tail
  tail -n1
  2⤵
  PID:713
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:714
- /bin/egrep
  egrep "^LC_ALL=" /etc/default/locale
  2⤵
  PID:712
- /bin/grep
  grep -E "^LC_ALL=" /etc/default/locale
  2⤵
  PID:712
- /bin/egrep
  egrep "^LC_CTYPE=" /etc/default/locale
  2⤵
  PID:716
- /usr/bin/tail
  tail -n1
  2⤵
  PID:717
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:718
- /bin/grep
  grep -E "^LC_CTYPE=" /etc/default/locale
  2⤵
  PID:716
- /bin/cat
  cat /etc/timezone
  2⤵
  PID:719
- /sbin/start-stop-daemon
  /sbin/start-stop-daemon --start --nicelevel 0 --quiet --oknodo --chdir /tmp --exec /usr/sbin/cron --oknodo --pidfile /var/run/crond.pid --
  2⤵
  PID:720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads