716dfc991af82e8d2563dc4b6f121c7a3ed7d6fcfe58d20b4c826ec456942b65

Analysis

max time kernel
6s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/09/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffrelay-debian-4.30.ggi
Size 222KB
Sample260910-ajv84ssenh
SHA256 716dfc991af82e8d2563dc4b6f121c7a3ed7d6fcfe58d20b4c826ec456942b65
MD5 febb1aeec754b65665289aa1447fdf86
SHA1 5a447b28a6440cd3e8af25d35c036edc6dca8476
SHA512 0a7af11dab65799cc040128a124f19bc73c17552c807cd2ee0c166ff3e155030200d5e0860f570157da1354ed8963008b1d0ba3b0d076b6b90c34aa1137d63ea
SSDEEP 6144:8PYEIY+DCExEK+JYLQ2qe36hL/bppRnIm:8QE9+DCEx0eqbHp3n9
TLSH
T17624127E3C1EAB6F02482EE38BDB456E8194C1F2077A4DCDA0893609871C5A57C5BCED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/selfextract.0KdewQ/installer	680	ffrelay-debian-4.30.ggi

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.daily/ffrelay_crond	tar

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/ffrelay	tar

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/96/stat	killall
File opened for reading	/proc/107/stat	killall
File opened for reading	/proc/135/cmdline	killall
File opened for reading	/proc/140/stat	killall
File opened for reading	/proc/144/stat	killall
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/572/stat	killall
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/141/stat	killall
File opened for reading	/proc/281/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/633/stat	killall
File opened for reading	/proc/651/cmdline	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/592/stat	killall
File opened for reading	/proc/653/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/108/cmdline	killall
File opened for reading	/proc/649/stat	killall
File opened for reading	/proc/649/cmdline	killall
File opened for reading	/proc/677/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/135/stat	killall
File opened for reading	/proc/290/stat	killall
File opened for reading	/proc/584/stat	killall
File opened for reading	/proc/648/stat	killall
File opened for reading	/proc/680/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/159/stat	killall
File opened for reading	/proc/330/stat	killall
File opened for reading	/proc/651/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/712/stat	killall
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/588/stat	killall
File opened for reading	/proc/638/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/105/stat	killall
File opened for reading	/proc/108/stat	killall
File opened for reading	/proc/277/stat	killall
File opened for reading	/proc/326/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/591/stat	killall

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/selfextract.0KdewQ/ffrelay.ggi.tar	tar
File opened for modification	/tmp/selfextract.0KdewQ/installer	tar

/tmp/ffrelay-debian-4.30.ggi
/tmp/ffrelay-debian-4.30.ggi
1⤵
- Executes dropped EXE
PID:649
- /bin/mktemp
  mktemp -d /tmp/selfextract.XXXXXX
  2⤵
  PID:657
- /usr/bin/awk
  awk "/^__ARCHIVE_BELOW__/ {print NR + 1; exit 0; }" /tmp/ffrelay-debian-4.30.ggi
  2⤵
  - Reads runtime system information
  PID:662
- /bin/tar
  tar xzv -C /tmp/selfextract.0KdewQ
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:669
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:674
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:674
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:674
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:674
- - /sbin/gzip
    gzip -d
    3⤵
    PID:674
- - /bin/gzip
    gzip -d
    3⤵
    PID:674
- /usr/bin/tail
  tail -n+34 /tmp/ffrelay-debian-4.30.ggi
  2⤵
  PID:668
- /tmp/selfextract.0KdewQ/installer
  ./installer
  2⤵
  PID:680
- - /bin/sleep
    sleep 3
    3⤵
    PID:684
- - /usr/bin/killall
    killall -9 -q ffrelay
    3⤵
    - Reads runtime system information
    PID:713
- - /bin/tar
    tar --directory / -xvf ./ffrelay.ggi.tar
    3⤵
    - Creates/modifies Cron job
    - Modifies init.d
    - Reads runtime system information
    PID:716
- /bin/rm
  rm -rf /tmp/selfextract.0KdewQ
  2⤵
  PID:723

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ffrelay_crond

Path /etc/cron.daily/ffrelay_crond
Size 91B
SHA256 077c0484ecd219a97930367bfb3e597a448bec7582d8b5508e6493e2c376cf4e
MD5 f04a9b34925b5f9c721d00985469d2d9
SHA1 764d534007450370d558fa0ce438e317de9e08bd
SHA512 be81ff421896d45947a0278fcb34d3a625b3a50fac816f1948eb632c0de3451bdbfe0f398be7966774c7943050a3d52ce541b047a610b8a7a75d3fcc571ced55
TLSH
T10AB01108E82200338E383B30C080EBB323800002BCB20CE008023A22E20823B2322203
MD5 SHA1 SHA512 TLSH

Submit Download

ffrelay

Path /etc/init.d/ffrelay
Size 1KB
SHA256 af361eba0407d8ebefee79f5ab338bbbf9450ae3693478357636d37558e9e064
MD5 08e32357e94c9e5171bcbc145719722f
SHA1 567da77f0255690887d53d8f2e5690858bfb4419
SHA512 971443d04c00b1c40023f3cf22d6dc04e34da341ad1105cc57d392f305051205898222425823fee640278fe8a878010ff7087fb52ec166f5dd48b5fb5ec3b91d
TLSH
T1AF311027B0D57670B607C2702231AC473182A61C2CCDBBC1313A4FAA75346E6F5E6589
MD5 SHA1 SHA512 TLSH

Submit Download

ffrelay

Path /etc/monit.d/ffrelay
Size 197B
SHA256 3992295df6c90e080a30aee75e1b2b65eb8a0a16b2a4a47ca4701cfacd4c1251
MD5 8ddc04311a0a066a5fcdf0944171f52c
SHA1 0f1014cdb0df38088e68031c65e3babe40a94905
SHA512 abaab3864e0198d545e581ab22f311136873d3d07ae42f642e88265f146fbb1fa0f1f9b9b7e9a952c787f9b6cce50c23f009b1dce29ea6b7ca25ee2222d2718f
TLSH
T163D02201BBE22CC388F9404A03A26704318880403DA62BC20E89B2C3FA0263243E32C3
MD5 SHA1 SHA512 TLSH

Submit Download

ffrelay.ggi.tar

Path /tmp/selfextract.0KdewQ/ffrelay.ggi.tar
Size 720KB
SHA256 2b1acb431493c583b17c33d5c024ae150706bb040bbd4454cd7ebfee5527065d
MD5 b10575d169e94b33dad14d8fb33c98dc
SHA1 fc4bd11a6f3a3eaf72687d5d0247acdc74be1b2f
SHA512 3c4e50ec284f3d78872b6eb2c9de9f6589f1579b99434de2d14147d2207775c3ecc559d24c0e27d5a0d522731c2504808feeb5b0a84e95c67f677fe88c4c8223
SSDEEP 12288:YAsEvoPVXUCTRawrnkLvEIZQOFxfPrvU6:YAsEvoP+jLvEIZg6
TLSH
T150F43A939B224E73CBC7FFF1FAB75A2C93401816C71A1B4E765A2424815A21CBE43F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer

Path /tmp/selfextract.0KdewQ/installer
Size 539B
SHA256 c7ac330af9e4638bf2d170785b98a2aa6f979b8a9103d60604786bae8d83a207
MD5 c204c86a388440305972b3fc21974dae
SHA1 35170787183bc531f9af23653d45cbd09f417da9
SHA512 3a63acdc7461db4db09aae76b070b742f1215955fd45bbb7f322e20021848d61f275c27ea4bd859f9dc94b1a7f4976cf5e1a9b9eaef62c570b320902e28f4f65
TLSH
T161F0248CB4D856335EA606A4AE224D4A352130472F571C213E1F31A2BB180E163BE1E3
MD5 SHA1 SHA512 TLSH

Submit Download

ffrelay

Path /usr/local/ffrelay/bin/ffrelay
Size 702KB
SHA256 f5ce3e27141c1977f11f6c45da4acc1d77ce744c8e3bb09e10c4b99cf955650a
MD5 a630059a6a0a3ef4fe00f550c1dd10a7
SHA1 39aa7fcb2db24bb8647accb9223ecb1c0800e217
SHA512 74d16750d61fb17cea3540c3e266504fffbb8e3bc20d0f535be1ff0ca33bb3ef2b19f1fb8794b76b9fc3f5b09937ea3afbc8f84f7d5498f2169f2af84a3fa2ab
SSDEEP 12288:XAsEvoPVXUCTRawrnkLvEIZQOFxfPrvU6N:XAsEvoP+jLvEIZg6N
TLSH
T19EE43A939B224E73CBC7FFF1FAB75A2C93401816C71A1B4E765A2424815A21CBE43F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

relay.cfg_template

Path /usr/local/ffrelay/data/relay.cfg_template
Size 355B
SHA256 23ef88b7b8fedcefc971a6fc56841e9ad21c908066b7e5340ce20201ce4ec453
MD5 d5e9bf014e64d0ddb4da976322fca489
SHA1 d148b82390877271331e0ecd5cb93a0d16a3f60c
SHA512 d12d58ffb22930f472c9915f457aa17810fb82fe9c08eaa61f082c18a53d29e23d3581c30f8d94eac0490b8cb5f0ffdfcc658514b0c83768fb7cc5e0a0250820
TLSH
T1EAE0C000E0240353D3B2044946D315603E2D9099021B3314E54E99C0DB2856FB6D23A6
MD5 SHA1 SHA512 TLSH

Submit Download

version

Path /usr/local/ffrelay/data/version
Size 14B
SHA256 ab968455662ff312d345e6f9153d7e8aee8dd34d59b15825003eb1d0ed89bf00
MD5 505e683bd2687380be681b01f87914cd
SHA1 0c463d1a2f17ef19980fbad18b81842b30e8b9dd
SHA512 0cba4684483adeb92341be0f8f5de82e45c42fc5efc5827479105b6a7b77a836b5881cd9211c54c8491e4fd4aeee9fb74b429fa3f3e8e79f197721033269719a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads