a6a8ced5f7336ac5e94b1fa49520a4048c001796fa7365489ce54c65fab67b34

Analysis

max time kernel
1s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
05/09/2026, 06:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
netstat
Size 422B
Sample260905-gyrmssvxdy
SHA256 a6a8ced5f7336ac5e94b1fa49520a4048c001796fa7365489ce54c65fab67b34
MD5 3f0806a18be75adf80f085ca956eda31
SHA1 3dd17285ec78cc6b603612fea4fb51ed7dbcf7dc
SHA512 a288f3ac650ceef5bf55455881e26bbb04d80426f8eb2e1b2533eaab6c3e29419e4450dbf2b4ea37c5b9d937ff6e5fb8bebdd735025ebdb4d89b0213ee180f15
TLSH
T165E0E523A120CD609D680C0A9902DB9177C3A7D35387337C91519D7162CA26EF65DF9E
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
728	sh
730	chmod

Removes the immutable protection flag from a file 1 TTPs 6 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
736	grep
738	grep
740	grep
727	chattr
737	grep
739	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/root.net	netstat

/tmp/netstat
/tmp/netstat
1⤵
- Writes file to tmp directory
PID:717
- /usr/bin/whoami
  whoami
  2⤵
  PID:719
- /bin/sh
  sh -c "chattr -ia /tmp > /dev/null 2>&1 &"
  2⤵
  PID:724
- /bin/sh
  sh -c "chmod 777 /tmp > /dev/null 2>&1 &"
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /usr/bin/whoami
  whoami
  2⤵
  PID:731
- /usr/bin/netstatz
  /usr/bin/netstatz
  2⤵
  PID:733
- /bin/grep
  grep --invert-match :43
  2⤵
  - Removes the immutable protection flag from a file
  PID:737
- /bin/grep
  grep --invert-match dhcl
  2⤵
  - Removes the immutable protection flag from a file
  PID:739
- /bin/grep
  grep --invert-match :20
  2⤵
  - Removes the immutable protection flag from a file
  PID:736
- /bin/grep
  grep --invert-match :3389
  2⤵
  - Removes the immutable protection flag from a file
  PID:738
- /bin/grep
  grep --invert-match send
  2⤵
  - Removes the immutable protection flag from a file
  PID:740
- /usr/bin/whoami
  whoami
  2⤵
  PID:741
- /bin/cat
  cat /tmp/root.net
  2⤵
  PID:735
- /usr/bin/whoami
  whoami
  2⤵
  PID:745
- /bin/rm
  rm -f /tmp/root.net
  2⤵
  PID:747

/usr/bin/chattr
chattr -ia /tmp
1⤵
- Removes the immutable protection flag from a file
PID:727

/bin/chmod
chmod 777 /tmp
1⤵
- File and Directory Permissions Modification
PID:730

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads