f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20

Analysis

max time kernel
147s
max time network
149s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
12/09/2026, 23:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20
Size 60KB
Sample260912-27hfpsy1ct
SHA256 f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20
MD5 4662b41663023b09838245acd154c2ac
SHA1 7d9d83d63f03e717165f55df5e184f75915b91d0
SHA512 4f770e6662341a41fb49fcc10b10bea6990f151de985ed42efdf65c8360125f242774ce2a51800e5683ccf81fdd647336734f144656d5d856737f0358c627ab7
SSDEEP 1536:Ld4MC74O+72PmGwOOwJIRd63RlM5nHaEk8TpH0j+YITIr:L2MdX7o5JIL2Ren2+A+YIE
TLSH
T1E453E8AAF880DA22C7D4167BFB4D528C33530B74D2E93105DE14BE3567FB95A0E3A942
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
812	chmod
809	sh
810	chmod
811	sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20
File opened for modification	/dev/misc/watchdog	f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/.cling	cp

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself		789	f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20
Changes the process name, possibly in an attempt to hide itself		833	f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/stat	cp
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/1/stat	cp
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mount

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/cmdline	cp

/tmp/f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20
/tmp/f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:787
- /bin/sh
  sh -c "rm -rf /root/.cling;cp /tmp/f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20 /root/.cling"
  2⤵
  PID:790
- - /usr/bin/rm
    rm -rf /root/.cling
    3⤵
    PID:792
- - /usr/bin/cp
    cp /tmp/f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20 /root/.cling
    3⤵
    - Reads runtime system information
    PID:797
- /bin/sh
  sh -c "rm -rf /usr/local/bin/.cling;cp /tmp/f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20 /usr/local/bin/.cling"
  2⤵
  PID:801
- - /usr/bin/rm
    rm -rf /usr/local/bin/.cling
    3⤵
    PID:803
- - /usr/bin/cp
    cp /tmp/f81198ebce0e6d97cae5c2099a41acd3d259c1ba325eb43c8f4f9494d49d3b20 /usr/local/bin/.cling
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:805
- /bin/sh
  sh -c "chmod +x /root/.cling"
  2⤵
  - File and Directory Permissions Modification
  PID:809
- - /usr/bin/chmod
    chmod +x /root/.cling
    3⤵
    - File and Directory Permissions Modification
    PID:810
- /bin/sh
  sh -c "chmod +x /usr/local/bin/.cling"
  2⤵
  - File and Directory Permissions Modification
  PID:811
- - /usr/bin/chmod
    chmod +x /usr/local/bin/.cling
    3⤵
    - File and Directory Permissions Modification
    PID:812
- /bin/sh
  sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
  2⤵
  PID:813
- - /usr/bin/rm
    rm -rf /tmp/stat
    3⤵
    PID:814
- - /usr/bin/cp
    cp /proc/1/stat /tmp/stat
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:815
- /bin/sh
  sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
  2⤵
  PID:816
- - /usr/bin/rm
    rm -rf /tmp/status
    3⤵
    PID:817
- - /usr/bin/cp
    cp /proc/1/status /tmp/status
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:818
- /bin/sh
  sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
  2⤵
  PID:819
- - /usr/bin/rm
    rm -rf /tmp/cmdline
    3⤵
    PID:820
- - /usr/bin/cp
    cp /proc/1/cmdline /tmp/cmdline
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:821
- /bin/sh
  sh -c "rm -rf 2��H};cp /proc/1/statm 2��H}"
  2⤵
  PID:822
- - /usr/bin/rm
    rm -rf "2��H}"
    3⤵
    PID:823
- - /usr/bin/cp
    cp /proc/1/statm "2��H}"
    3⤵
    - Reads runtime system information
    PID:824
- /bin/sh
  sh -c "mount --bind /tmp /proc/789"
  2⤵
  PID:825
- - /usr/bin/mount
    mount --bind /tmp /proc/789
    3⤵
    - Reads runtime system information
    PID:826
- /bin/sh
  sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
  2⤵
  PID:834
- - /usr/bin/rm
    rm -rf /tmp/stat
    3⤵
    PID:835
- - /usr/bin/cp
    cp /proc/1/stat /tmp/stat
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:836
- /bin/sh
  sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
  2⤵
  PID:837
- - /usr/bin/rm
    rm -rf /tmp/status
    3⤵
    PID:838
- - /usr/bin/cp
    cp /proc/1/status /tmp/status
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:839
- /bin/sh
  sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
  2⤵
  PID:840
- - /usr/bin/rm
    rm -rf /tmp/cmdline
    3⤵
    PID:841
- - /usr/bin/cp
    cp /proc/1/cmdline /tmp/cmdline
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:842
- /bin/sh
  sh -c "rm -rf 2��H};cp /proc/1/statm 2��H}"
  2⤵
  PID:843
- - /usr/bin/rm
    rm -rf "2��H}"
    3⤵
    PID:844
- - /usr/bin/cp
    cp /proc/1/statm "2��H}"
    3⤵
    - Reads runtime system information
    PID:845
- /bin/sh
  sh -c "mount --bind /tmp /proc/833"
  2⤵
  PID:846
- - /usr/bin/mount
    mount --bind /tmp /proc/833
    3⤵
    - Reads runtime system information
    PID:847

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2��H}

Path /2��H}
Size 27B
SHA256 4b8c2259a235d6f390e4dcccb3556629005fbeacf2d6a3cdd79e04850f01f5ac
MD5 c75e9e964173d2923c680622df6bf9cf
SHA1 80fa01442077c3127ea72ef34d94b433b9019925
SHA512 145a0d30a3dddb533b5e895576c960d5a262d6e6502e04d362f9621a8251aa1388923dc72305c5d1fad2726ee9712a295e2b5422a128b005cbc54f3376d8c70a
MD5 SHA1 SHA512

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

stat

Path /tmp/stat
Size 249B
SHA256 aa6c94a8ca96a9fcbbadf685f0a20fe998ba69abbd5fd6686ae493fe4ffea118
MD5 f90e7cc1ec43015b63704f6404dc332f
SHA1 0f11683a4339d1652c8df886937acc036bbd1596
SHA512 a0ad58a04239a29df57e220406493866ef30bf74ed7bb581101e6cc5fb8f7ded242360a5c3ffb040b3a60ccecab52e3ada814198474c172f1ec96a2802655d12
TLSH
T175D05E91639CC4ECB88FC6862811058347CEA1723D25449D2CDDC560A5B6876CA47425
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 249B
SHA256 1c8f7c4d4b7831f0d9af6624a180c104ea46148a6e7a3e1be7756ed29104d465
MD5 b25fb7afd7248c85e6b167b63e2987f8
SHA1 ecbbbdd56d1150dd43b6c5f280c6f3ca1cbcd22e
SHA512 edc669a8bf6955b621e41414be9ded6120051ec134578e730bdae5f71d21816bffe181c85cc4c6bfb7906ddce463ab9e6ea2e0fd9db1bce68ff45677e0b000d8
TLSH
T1C4D0A796739CD4ECF88EC8C26C0145C387CEE0313D34445D2CDCD520AAA787AC947425
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 068b141ea06c0e3140473f853a04b6e10b0f82a3e99cc93c3101a19fb4a7f60e
MD5 7eaf5c039257d1068e98465426c3dd07
SHA1 4c64d92840cf3e289f85496f69824fc1c4f8e99f
SHA512 41551753366762ff2bd8753ed6511dae4d622c882b99ad87419e9118aeb8c74176f8b3984abd5a5437f08a88204359a77eab8b344079cd5885cd35e115ac2a17
TLSH
T1B01178608FDA6C98CEAEC34412A9F8556074F51A24D06135350EC978BB3355B8789CD4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 9150c3ccf0553ffa2ae084ffd842c8ec572a5582e40e752f416b2775554aa75d
MD5 01ce698544724d576382fa462af5c62c
SHA1 482e4a5727c4c4d3485635e32945c2e27830032e
SHA512 c25100c57d3c6780bc3b7f2ff8a7724555e4748672c516aa57f87eb07ac7ef57d3bd443e84c77f05cff924a4e6b406729460306b522af46a6ac3033f5855cb38
TLSH
T1D7119B608FDA6C98CEAEC34412A9F8556074F51A34D07135350EC97CBB3355F8789CD4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads