2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30/08/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
Size 1KB
Sample260830-3msllssbnc
SHA256 2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
MD5 4efcacfda648de2aa4b9ed1f22c423d3
SHA1 499deac22fbafcd5890a688627d0673a92429435
SHA512 14e7d6a871bcaf77518dbcc9165e90ee15da396df30375070d1a9539a0f147b680865d24c59ee7f9faf71c047bb7fa171bfdb60b20317258c64d2bbcdf542eb6
TLSH
T1E9410DF1F930D4347F0C88BAFE9E5468A983D06F4E5ABDA5A04BC8F0419E509B17C6B4
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
657	chmod
688	chmod

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.YfbfvI	crontab
File opened for modification	/etc/crontab	2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/27/cmdline	pgrep
File opened for reading	/proc/107/status	pgrep
File opened for reading	/proc/343/cmdline	pgrep
File opened for reading	/proc/105/cmdline	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/595/cmdline	pgrep
File opened for reading	/proc/139/cmdline	pkill
File opened for reading	/proc/169/status	pkill
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/75/status	pkill
File opened for reading	/proc/136/status	pkill
File opened for reading	/proc/636/status	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/21/status	pgrep
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/648/cmdline	pgrep
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/108/cmdline	pkill
File opened for reading	/proc/169/cmdline	pkill
File opened for reading	/proc/648/cmdline	pkill
File opened for reading	/proc/134/status	pkill
File opened for reading	/proc/105/cmdline	pgrep
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/169/status	pkill
File opened for reading	/proc/288/cmdline	pkill
File opened for reading	/proc/675/cmdline	pkill
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/295/status	pgrep
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/642/status	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/136/cmdline	pkill
File opened for reading	/proc/42/status	pkill
File opened for reading	/proc/330/cmdline	pkill
File opened for reading	/proc/642/cmdline	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/135/status	pkill
File opened for reading	/proc/594/status	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/317/status	pkill
File opened for reading	/proc/595/status	pkill
File opened for reading	/proc/645/status	pkill
File opened for reading	/proc/653/cmdline	pgrep
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/330/cmdline	pkill
File opened for reading	/proc/43/status	pgrep
File opened for reading	/proc/139/cmdline	pgrep
File opened for reading	/proc/640/status	pgrep
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/134/cmdline	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/28/status	pkill

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.x/loop.sh	2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
File opened for modification	/tmp/.x/run.sh	2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540

/tmp/2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
/tmp/2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
1⤵
- Creates/modifies Cron job
- Modifies rc script
- Writes file to tmp directory
PID:648
- /bin/uname
  uname -m
  2⤵
  PID:649
- /bin/mkdir
  mkdir -p /tmp/.x
  2⤵
  PID:651
- /bin/cat
  cat
  2⤵
  PID:654
- /bin/chmod
  chmod +x /tmp/.x/loop.sh
  2⤵
  - File and Directory Permissions Modification
  PID:657
- /usr/bin/pgrep
  pgrep -f tmp/.x/loop.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:660
- /usr/bin/pkill
  pkill -9 -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:676
- /usr/bin/pkill
  pkill -9 -f minerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:681
- /usr/bin/pkill
  pkill -9 -f kthreaddk
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:685
- /bin/cat
  cat
  2⤵
  PID:687
- /bin/chmod
  chmod +x /tmp/.x/run.sh
  2⤵
  - File and Directory Permissions Modification
  PID:688
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:690
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:691
- /bin/grep
  grep -q /tmp/.x/run.sh /etc/crontab
  2⤵
  PID:692
- /bin/grep
  grep -q /tmp/.x/run.sh /etc/rc.local
  2⤵
  PID:694

/usr/bin/nohup
nohup sh /tmp/.x/loop.sh
1⤵
PID:675

/usr/local/sbin/sh
sh /tmp/.x/loop.sh
1⤵
PID:675

/usr/local/bin/sh
sh /tmp/.x/loop.sh
1⤵
PID:675

/usr/sbin/sh
sh /tmp/.x/loop.sh
1⤵
PID:675

/usr/bin/sh
sh /tmp/.x/loop.sh
1⤵
PID:675

/sbin/sh
sh /tmp/.x/loop.sh
1⤵
PID:675

/bin/sh
sh /tmp/.x/loop.sh
1⤵
PID:675
- /bin/sleep
  sleep 300
  2⤵
  PID:679

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rc.local

Path /etc/rc.local
Size 20B
SHA256 e9f70d2cb6f092e2788046897742a7fbedf81f9cad5445cebe4fe3776de82fa0
MD5 f52d031ac24e638c7b39a76a003685ed
SHA1 cd3f155a9c51fcdf904d816dcd7362dcf57fe6c1
SHA512 290b0df1b49c0c0af5967fc381d4430046bff36036b3d30b1ca6a114c6baa5c4fd7c24644be485ccb245092baa840f41d7012c830a143ba59346f87d745307e9
MD5 SHA1 SHA512

Submit Download

loop.sh

Path /tmp/.x/loop.sh
Size 195B
SHA256 252d86327b4ef1a0f86f0981401cd38be6506e2e37e4525b851d8c400d80c344
MD5 ef365fa689f008fb9313e2c4f924bdc1
SHA1 c79f077f7551a5061c3448253113b551c53ab90f
SHA512 9cdf014b708610c676ecba6ccc1848c591a0b2d63da48f284f8740f88a4d79b916c99f86bc7b6f190df78f7317bbd4d08bbd194319989a72a9ecc89da60ed55d
TLSH
T115D012F4F471A0303F1444BEA74598642A93199F996C5670844789D3544E31F344D1B3
MD5 SHA1 SHA512 TLSH

Submit Download

run.sh

Path /tmp/.x/run.sh
Size 313B
SHA256 af1eaba0885212e2e4e9db41b0e20191680dac70dd027562647fcb630f7bd873
MD5 b13e5dedb8e7aaf2281b3905db88e7c8
SHA1 4ac83b62aa8b38c467a7a5eb3c0d8b26056ddf61
SHA512 f3a3fc4ef37c94d0db0e88b76166eefaa98a94eb055cd10ff324d96791f383785c51981db5bc77007fdd49061de6548ce83991e66c3e8194b1c46f7100c86de2
TLSH
T175E07DE2FA30AE3D3B0C8445BC4A00029896C42B1FABF8C192D3D074062F00CF1B8638
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.YfbfvI

Path /var/spool/cron/crontabs/tmp.YfbfvI
Size 202B
SHA256 89b679ef3e823a22a7041f41015b5aa6b6fc967ac826b91776bded8ef384b1db
MD5 fb41f788733ffd4011e7eebeee433428
SHA1 0031de8edb9f0916d707eb3d2f69648c79d3a011
SHA512 50cd4036eca782e124a69e23a7a2e9ef35e2a8328381e522afbf41925150844c2476d8ab337ab047e84f50f866e9ef63cfb47f52174ee702865c28521209c3d6
TLSH
T1B4D022293F2024302A000B65A05F022AA851E0AAC00AFE11E1BC0028028FB8E7A60C21
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads