716dfc991af82e8d2563dc4b6f121c7a3ed7d6fcfe58d20b4c826ec456942b65

Analysis

max time kernel
34s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
10/09/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffrelay-debian-4.30.ggi
Size 222KB
Sample260910-ajv84ssenh
SHA256 716dfc991af82e8d2563dc4b6f121c7a3ed7d6fcfe58d20b4c826ec456942b65
MD5 febb1aeec754b65665289aa1447fdf86
SHA1 5a447b28a6440cd3e8af25d35c036edc6dca8476
SHA512 0a7af11dab65799cc040128a124f19bc73c17552c807cd2ee0c166ff3e155030200d5e0860f570157da1354ed8963008b1d0ba3b0d076b6b90c34aa1137d63ea
SSDEEP 6144:8PYEIY+DCExEK+JYLQ2qe36hL/bppRnIm:8QE9+DCEx0eqbHp3n9
TLSH
T17624127E3C1EAB6F02482EE38BDB456E8194C1F2077A4DCDA0893609871C5A57C5BCED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/selfextract.clCP6i/installer	741	ffrelay-debian-4.30.ggi

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/125/stat	killall
File opened for reading	/proc/711/stat	killall
File opened for reading	/proc/720/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/110/stat	killall
File opened for reading	/proc/340/stat	killall
File opened for reading	/proc/381/stat	killall
File opened for reading	/proc/660/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/125/cmdline	killall
File opened for reading	/proc/434/stat	killall
File opened for reading	/proc/682/stat	killall
File opened for reading	/proc/714/stat	killall
File opened for reading	/proc/741/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/713/cmdline	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/678/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/337/stat	killall
File opened for reading	/proc/714/cmdline	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/78/stat	killall
File opened for reading	/proc/338/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/708/stat	killall
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/124/stat	killall
File opened for reading	/proc/334/stat	killall
File opened for reading	/proc/703/cmdline	killall
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/681/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/236/stat	killall
File opened for reading	/proc/703/stat	killall
File opened for reading	/proc/713/stat	killall
File opened for reading	/proc/752/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/382/stat	killall
File opened for reading	/proc/filesystems	tar

/tmp/ffrelay-debian-4.30.ggi
/tmp/ffrelay-debian-4.30.ggi
1⤵
- Executes dropped EXE
PID:714
- /bin/mktemp
  mktemp -d /tmp/selfextract.XXXXXX
  2⤵
  PID:719
- /usr/bin/awk
  awk "/^__ARCHIVE_BELOW__/ {print NR + 1; exit 0; }" /tmp/ffrelay-debian-4.30.ggi
  2⤵
  - Reads runtime system information
  PID:725
- /usr/bin/tail
  tail -n+34 /tmp/ffrelay-debian-4.30.ggi
  2⤵
  PID:728
- /bin/tar
  tar xzv -C /tmp/selfextract.clCP6i
  2⤵
  - Reads runtime system information
  PID:729
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:737
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:737
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:737
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:737
- - /sbin/gzip
    gzip -d
    3⤵
    PID:737
- - /bin/gzip
    gzip -d
    3⤵
    PID:737
- /tmp/selfextract.clCP6i/installer
  ./installer
  2⤵
  PID:741
- - /bin/sleep
    sleep 3
    3⤵
    PID:747
- - /usr/bin/killall
    killall -9 -q ffrelay
    3⤵
    - Reads runtime system information
    PID:755
- - /bin/tar
    tar --directory / -xvf ./ffrelay.ggi.tar
    3⤵
    - Reads runtime system information
    PID:756
- /bin/rm
  rm -rf /tmp/selfextract.clCP6i
  2⤵
  PID:758

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ffrelay_crond

Path /etc/cron.daily/ffrelay_crond
Size 91B
SHA256 077c0484ecd219a97930367bfb3e597a448bec7582d8b5508e6493e2c376cf4e
MD5 f04a9b34925b5f9c721d00985469d2d9
SHA1 764d534007450370d558fa0ce438e317de9e08bd
SHA512 be81ff421896d45947a0278fcb34d3a625b3a50fac816f1948eb632c0de3451bdbfe0f398be7966774c7943050a3d52ce541b047a610b8a7a75d3fcc571ced55
TLSH
T10AB01108E82200338E383B30C080EBB323800002BCB20CE008023A22E20823B2322203
MD5 SHA1 SHA512 TLSH

Submit Download

ffrelay

Path /etc/init.d/ffrelay
Size 1KB
SHA256 af361eba0407d8ebefee79f5ab338bbbf9450ae3693478357636d37558e9e064
MD5 08e32357e94c9e5171bcbc145719722f
SHA1 567da77f0255690887d53d8f2e5690858bfb4419
SHA512 971443d04c00b1c40023f3cf22d6dc04e34da341ad1105cc57d392f305051205898222425823fee640278fe8a878010ff7087fb52ec166f5dd48b5fb5ec3b91d
TLSH
T1AF311027B0D57670B607C2702231AC473182A61C2CCDBBC1313A4FAA75346E6F5E6589
MD5 SHA1 SHA512 TLSH

Submit Download

ffrelay

Path /etc/monit.d/ffrelay
Size 197B
SHA256 3992295df6c90e080a30aee75e1b2b65eb8a0a16b2a4a47ca4701cfacd4c1251
MD5 8ddc04311a0a066a5fcdf0944171f52c
SHA1 0f1014cdb0df38088e68031c65e3babe40a94905
SHA512 abaab3864e0198d545e581ab22f311136873d3d07ae42f642e88265f146fbb1fa0f1f9b9b7e9a952c787f9b6cce50c23f009b1dce29ea6b7ca25ee2222d2718f
TLSH
T163D02201BBE22CC388F9404A03A26704318880403DA62BC20E89B2C3FA0263243E32C3
MD5 SHA1 SHA512 TLSH

Submit Download

ffrelay.ggi.tar

Path /tmp/selfextract.clCP6i/ffrelay.ggi.tar
Size 720KB
SHA256 2b1acb431493c583b17c33d5c024ae150706bb040bbd4454cd7ebfee5527065d
MD5 b10575d169e94b33dad14d8fb33c98dc
SHA1 fc4bd11a6f3a3eaf72687d5d0247acdc74be1b2f
SHA512 3c4e50ec284f3d78872b6eb2c9de9f6589f1579b99434de2d14147d2207775c3ecc559d24c0e27d5a0d522731c2504808feeb5b0a84e95c67f677fe88c4c8223
SSDEEP 12288:YAsEvoPVXUCTRawrnkLvEIZQOFxfPrvU6:YAsEvoP+jLvEIZg6
TLSH
T150F43A939B224E73CBC7FFF1FAB75A2C93401816C71A1B4E765A2424815A21CBE43F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer

Path /tmp/selfextract.clCP6i/installer
Size 539B
SHA256 c7ac330af9e4638bf2d170785b98a2aa6f979b8a9103d60604786bae8d83a207
MD5 c204c86a388440305972b3fc21974dae
SHA1 35170787183bc531f9af23653d45cbd09f417da9
SHA512 3a63acdc7461db4db09aae76b070b742f1215955fd45bbb7f322e20021848d61f275c27ea4bd859f9dc94b1a7f4976cf5e1a9b9eaef62c570b320902e28f4f65
TLSH
T161F0248CB4D856335EA606A4AE224D4A352130472F571C213E1F31A2BB180E163BE1E3
MD5 SHA1 SHA512 TLSH

Submit Download

ffrelay

Path /usr/local/ffrelay/bin/ffrelay
Size 702KB
SHA256 f5ce3e27141c1977f11f6c45da4acc1d77ce744c8e3bb09e10c4b99cf955650a
MD5 a630059a6a0a3ef4fe00f550c1dd10a7
SHA1 39aa7fcb2db24bb8647accb9223ecb1c0800e217
SHA512 74d16750d61fb17cea3540c3e266504fffbb8e3bc20d0f535be1ff0ca33bb3ef2b19f1fb8794b76b9fc3f5b09937ea3afbc8f84f7d5498f2169f2af84a3fa2ab
SSDEEP 12288:XAsEvoPVXUCTRawrnkLvEIZQOFxfPrvU6N:XAsEvoP+jLvEIZg6N
TLSH
T19EE43A939B224E73CBC7FFF1FAB75A2C93401816C71A1B4E765A2424815A21CBE43F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

relay.cfg_template

Path /usr/local/ffrelay/data/relay.cfg_template
Size 355B
SHA256 23ef88b7b8fedcefc971a6fc56841e9ad21c908066b7e5340ce20201ce4ec453
MD5 d5e9bf014e64d0ddb4da976322fca489
SHA1 d148b82390877271331e0ecd5cb93a0d16a3f60c
SHA512 d12d58ffb22930f472c9915f457aa17810fb82fe9c08eaa61f082c18a53d29e23d3581c30f8d94eac0490b8cb5f0ffdfcc658514b0c83768fb7cc5e0a0250820
TLSH
T1EAE0C000E0240353D3B2044946D315603E2D9099021B3314E54E99C0DB2856FB6D23A6
MD5 SHA1 SHA512 TLSH

Submit Download

version

Path /usr/local/ffrelay/data/version
Size 14B
SHA256 ab968455662ff312d345e6f9153d7e8aee8dd34d59b15825003eb1d0ed89bf00
MD5 505e683bd2687380be681b01f87914cd
SHA1 0c463d1a2f17ef19980fbad18b81842b30e8b9dd
SHA512 0cba4684483adeb92341be0f8f5de82e45c42fc5efc5827479105b6a7b77a836b5881cd9211c54c8491e4fd4aeee9fb74b429fa3f3e8e79f197721033269719a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads