Overview

overview

3

Static

static

1

f5aa9f4992...ff.bin

ubuntu-18.04-amd64

3

f5aa9f4992...ff.bin

debian-9-armhf

3

f5aa9f4992...ff.bin

debian-9-mips

3

f5aa9f4992...ff.bin

debian-9-mipsel

3

Analysis

  • max time kernel
    1s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    22/08/2026, 05:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f5aa9f49922152c5f232ba76b9b2dc550ba7aa734141a52d9c4429fbb51df3ff.bin
  • Size 8KB
  • Sample260822-fyms6sec26
  • SHA256 f5aa9f49922152c5f232ba76b9b2dc550ba7aa734141a52d9c4429fbb51df3ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 10 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/f5aa9f49922152c5f232ba76b9b2dc550ba7aa734141a52d9c4429fbb51df3ff.bin
    /tmp/f5aa9f49922152c5f232ba76b9b2dc550ba7aa734141a52d9c4429fbb51df3ff.bin
    1⤵
      PID:644
      • /bin/rm
        rm -rf /root/release
        2⤵
          PID:654
        • /bin/rm
          rm -rf /var/www/html
          2⤵
            PID:657
          • /bin/rm
            rm -rf /var/lib/tftpboot
            2⤵
              PID:659
            • /bin/rm
              rm -rf /var/ftp
              2⤵
                PID:662
              • /bin/mkdir
                mkdir /root/release
                2⤵
                • Reads runtime system information
                PID:665
              • /bin/mkdir
                mkdir /var/ftp
                2⤵
                • Reads runtime system information
                PID:667
              • /bin/mkdir
                mkdir /var/lib/tftpboot
                2⤵
                • Reads runtime system information
                PID:670
              • /bin/mkdir
                mkdir /var/www/html
                2⤵
                • Reads runtime system information
                PID:675
              • /bin/rm
                rm -rf /root/cnc
                2⤵
                  PID:678
                • /bin/mv
                  mv /root/loader/cnc /root/
                  2⤵
                  • Reads runtime system information
                  PID:681
                • /bin/cp
                  cp index.html /var/www/html
                  2⤵
                  • Reads runtime system information
                  PID:710
                • /bin/cp
                  cp "release/*" /var/www/html
                  2⤵
                  • Reads runtime system information
                  PID:711
                • /bin/cp
                  cp "release/*" /var/ftp
                  2⤵
                  • Reads runtime system information
                  PID:712
                • /bin/mv
                  mv "release/*" /var/lib/tftpboot
                  2⤵
                  • Reads runtime system information
                  PID:713
                • /usr/bin/gcc
                  gcc -static -O3 -lpthread -pthread "/root/loader/src/*.c" -o /root/loader/loader
                  2⤵
                    PID:714
                  • /bin/mv
                    mv "/root/dlr/release/dlr*" /root/loader/bins
                    2⤵
                    • Reads runtime system information
                    PID:739
                  • /bin/rm
                    rm -rf /root/dlr /root/loader/src /root/bot /root/scanListen.go /root/Projects /root/build.sh
                    2⤵
                      PID:740

                  Network

                        MITRE ATT&CK Matrix

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads