2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540

Analysis

max time kernel
1s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
30/08/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
Size 1KB
Sample260830-3msllssbnc
SHA256 2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
MD5 4efcacfda648de2aa4b9ed1f22c423d3
SHA1 499deac22fbafcd5890a688627d0673a92429435
SHA512 14e7d6a871bcaf77518dbcc9165e90ee15da396df30375070d1a9539a0f147b680865d24c59ee7f9faf71c047bb7fa171bfdb60b20317258c64d2bbcdf542eb6
TLSH
T1E9410DF1F930D4347F0C88BAFE9E5468A983D06F4E5ABDA5A04BC8F0419E509B17C6B4
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
721	chmod
741	chmod

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.lUUp6q	crontab
File opened for modification	/etc/crontab	2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/672/cmdline	pgrep
File opened for reading	/proc/710/cmdline	pgrep
File opened for reading	/proc/723/cmdline	pgrep
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/37/cmdline	pkill
File opened for reading	/proc/169/cmdline	pkill
File opened for reading	/proc/706/status	pkill
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/327/cmdline	pkill
File opened for reading	/proc/715/cmdline	pkill
File opened for reading	/proc/14/cmdline	pgrep
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/333/cmdline	pkill
File opened for reading	/proc/697/status	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/667/cmdline	pgrep
File opened for reading	/proc/710/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/73/status	pkill
File opened for reading	/proc/704/cmdline	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/75/cmdline	pgrep
File opened for reading	/proc/725/status	pgrep
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/70/cmdline	pkill
File opened for reading	/proc/324/cmdline	pgrep
File opened for reading	/proc/715/cmdline	pgrep
File opened for reading	/proc/118/status	pkill
File opened for reading	/proc/430/status	pkill
File opened for reading	/proc/170/status	pkill
File opened for reading	/proc/697/cmdline	pgrep
File opened for reading	/proc/720/status	pkill
File opened for reading	/proc/37/cmdline	pkill
File opened for reading	/proc/733/status	pkill
File opened for reading	/proc/237/cmdline	pkill
File opened for reading	/proc/670/status	pgrep
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/729/status	pkill
File opened for reading	/proc/82/cmdline	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/18/cmdline	pgrep
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/710/cmdline	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/670/cmdline	pkill
File opened for reading	/proc/670/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/697/status	pkill
File opened for reading	/proc/710/status	pkill
File opened for reading	/proc/705/status	pgrep
File opened for reading	/proc/17/cmdline	pkill

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.x/loop.sh	2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
File opened for modification	/tmp/.x/run.sh	2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540

/tmp/2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
/tmp/2bf7e1452cb131673199ec231526b92d8c5bdfa3f14e69aab7d075ab59346540
1⤵
- Creates/modifies Cron job
- Modifies rc script
- Writes file to tmp directory
PID:709
- /bin/uname
  uname -m
  2⤵
  PID:711
- /bin/mkdir
  mkdir -p /tmp/.x
  2⤵
  PID:713
- /bin/cat
  cat
  2⤵
  PID:717
- /bin/chmod
  chmod +x /tmp/.x/loop.sh
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /usr/bin/pgrep
  pgrep -f tmp/.x/loop.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:723
- /usr/bin/pkill
  pkill -9 -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:729
- /usr/bin/pkill
  pkill -9 -f minerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:735
- /usr/bin/pkill
  pkill -9 -f kthreaddk
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:738
- /bin/cat
  cat
  2⤵
  PID:740
- /bin/chmod
  chmod +x /tmp/.x/run.sh
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:744
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:745
- /bin/grep
  grep -q /tmp/.x/run.sh /etc/crontab
  2⤵
  PID:747
- /bin/grep
  grep -q /tmp/.x/run.sh /etc/rc.local
  2⤵
  PID:749

/usr/bin/nohup
nohup sh /tmp/.x/loop.sh
1⤵
PID:727

/usr/local/sbin/sh
sh /tmp/.x/loop.sh
1⤵
PID:727

/usr/local/bin/sh
sh /tmp/.x/loop.sh
1⤵
PID:727

/usr/sbin/sh
sh /tmp/.x/loop.sh
1⤵
PID:727

/usr/bin/sh
sh /tmp/.x/loop.sh
1⤵
PID:727

/sbin/sh
sh /tmp/.x/loop.sh
1⤵
PID:727

/bin/sh
sh /tmp/.x/loop.sh
1⤵
PID:727
- /bin/sleep
  sleep 300
  2⤵
  PID:733

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rc.local

Path /etc/rc.local
Size 20B
SHA256 e9f70d2cb6f092e2788046897742a7fbedf81f9cad5445cebe4fe3776de82fa0
MD5 f52d031ac24e638c7b39a76a003685ed
SHA1 cd3f155a9c51fcdf904d816dcd7362dcf57fe6c1
SHA512 290b0df1b49c0c0af5967fc381d4430046bff36036b3d30b1ca6a114c6baa5c4fd7c24644be485ccb245092baa840f41d7012c830a143ba59346f87d745307e9
MD5 SHA1 SHA512

Submit Download

loop.sh

Path /tmp/.x/loop.sh
Size 195B
SHA256 252d86327b4ef1a0f86f0981401cd38be6506e2e37e4525b851d8c400d80c344
MD5 ef365fa689f008fb9313e2c4f924bdc1
SHA1 c79f077f7551a5061c3448253113b551c53ab90f
SHA512 9cdf014b708610c676ecba6ccc1848c591a0b2d63da48f284f8740f88a4d79b916c99f86bc7b6f190df78f7317bbd4d08bbd194319989a72a9ecc89da60ed55d
TLSH
T115D012F4F471A0303F1444BEA74598642A93199F996C5670844789D3544E31F344D1B3
MD5 SHA1 SHA512 TLSH

Submit Download

run.sh

Path /tmp/.x/run.sh
Size 313B
SHA256 af1eaba0885212e2e4e9db41b0e20191680dac70dd027562647fcb630f7bd873
MD5 b13e5dedb8e7aaf2281b3905db88e7c8
SHA1 4ac83b62aa8b38c467a7a5eb3c0d8b26056ddf61
SHA512 f3a3fc4ef37c94d0db0e88b76166eefaa98a94eb055cd10ff324d96791f383785c51981db5bc77007fdd49061de6548ce83991e66c3e8194b1c46f7100c86de2
TLSH
T175E07DE2FA30AE3D3B0C8445BC4A00029896C42B1FABF8C192D3D074062F00CF1B8638
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.lUUp6q

Path /var/spool/cron/crontabs/tmp.lUUp6q
Size 202B
SHA256 3a1383db2935e102b807111e3031e7ebe86f018cfd17c8c1f11d259460b5a443
MD5 a06a464dc2999cfe996eb9b6a12f0aab
SHA1 09938e5bd09d23db9da2c26c44754476e4653d45
SHA512 514b5c86244eb71993819cdf9a6192c146e2987f972a9d042130726e91c0017457392875ea5e1d9e6af2540b0f115de1cd8df279688027710b23e8e9e31273f6
TLSH
T139D022293F2064302A000B66A45F022AA841E1AAC00AFE11E1AC0028028EB8E7A60C21
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads