Overview

overview

7

Static

static

1

03cd6e3d3e...8e7c30

debian-12-armhf

7

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    12/09/2026, 23:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    03cd6e3d3ea50bc6db4de2367a2b61f76db98d3af51705e67cebc8972c8e7c30
  • Size 136KB
  • Sample260912-27rdlsxbnf
  • SHA256 03cd6e3d3ea50bc6db4de2367a2b61f76db98d3af51705e67cebc8972c8e7c30
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 4 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Write file to user bin folder 1 IoCs
    persistence
  • Changes its process name 2 IoCs
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 12 IoCs

    Execute scripts via Unix Shell.

    execution
  • Reads runtime system information 20 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/03cd6e3d3ea50bc6db4de2367a2b61f76db98d3af51705e67cebc8972c8e7c30
    /tmp/03cd6e3d3ea50bc6db4de2367a2b61f76db98d3af51705e67cebc8972c8e7c30
    1⤵
    • Modifies Watchdog functionality
    • Changes its process name
    PID:788
    • /bin/sh
      /bin/sh -c "rm -rf /root/.cling;cp /tmp/03cd6e3d3ea50bc6db4de2367a2b61f76db98d3af51705e67cebc8972c8e7c30 /root/.cling"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:793
      • /usr/bin/rm
        rm -rf /root/.cling
        3⤵
          PID:794
        • /usr/bin/cp
          cp /tmp/03cd6e3d3ea50bc6db4de2367a2b61f76db98d3af51705e67cebc8972c8e7c30 /root/.cling
          3⤵
          • Reads runtime system information
          PID:796
      • /bin/sh
        /bin/sh -c "rm -rf /usr/local/bin/.cling;cp /tmp/03cd6e3d3ea50bc6db4de2367a2b61f76db98d3af51705e67cebc8972c8e7c30 /usr/local/bin/.cling"
        2⤵
        • Command and Scripting Interpreter: Unix Shell
        PID:803
        • /usr/bin/rm
          rm -rf /usr/local/bin/.cling
          3⤵
            PID:805
          • /usr/bin/cp
            cp /tmp/03cd6e3d3ea50bc6db4de2367a2b61f76db98d3af51705e67cebc8972c8e7c30 /usr/local/bin/.cling
            3⤵
            • Write file to user bin folder
            • Reads runtime system information
            PID:810
        • /bin/sh
          /bin/sh -c "chmod +x /root/.cling"
          2⤵
          • File and Directory Permissions Modification
          PID:812
          • /usr/bin/chmod
            chmod +x /root/.cling
            3⤵
            • File and Directory Permissions Modification
            PID:813
        • /bin/sh
          /bin/sh -c "chmod +x /usr/local/bin/.cling"
          2⤵
          • File and Directory Permissions Modification
          PID:814
          • /usr/bin/chmod
            chmod +x /usr/local/bin/.cling
            3⤵
            • File and Directory Permissions Modification
            PID:815
        • /bin/sh
          /bin/sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
          2⤵
          • Command and Scripting Interpreter: Unix Shell
          PID:816
          • /usr/bin/rm
            rm -rf /tmp/stat
            3⤵
              PID:817
            • /usr/bin/cp
              cp /proc/1/stat /tmp/stat
              3⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:818
          • /bin/sh
            /bin/sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
            2⤵
            • Command and Scripting Interpreter: Unix Shell
            PID:819
            • /usr/bin/rm
              rm -rf /tmp/status
              3⤵
                PID:820
              • /usr/bin/cp
                cp /proc/1/status /tmp/status
                3⤵
                • Reads runtime system information
                • Writes file to tmp directory
                PID:821
            • /bin/sh
              /bin/sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
              2⤵
              • Command and Scripting Interpreter: Unix Shell
              PID:822
              • /usr/bin/rm
                rm -rf /tmp/cmdline
                3⤵
                  PID:823
                • /usr/bin/cp
                  cp /proc/1/cmdline /tmp/cmdline
                  3⤵
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:824
              • /bin/sh
                /bin/sh -c "rm -rf 2����H};cp /proc/1/statm 2����H}"
                2⤵
                • Command and Scripting Interpreter: Unix Shell
                PID:825
                • /usr/bin/rm
                  rm -rf "2����H}"
                  3⤵
                    PID:826
                  • /usr/bin/cp
                    cp /proc/1/statm "2����H}"
                    3⤵
                    • Reads runtime system information
                    PID:827
                • /bin/sh
                  /bin/sh -c "mount --bind /tmp /proc/792"
                  2⤵
                  • Command and Scripting Interpreter: Unix Shell
                  PID:828
                  • /usr/bin/mount
                    mount --bind /tmp /proc/792
                    3⤵
                    • Reads runtime system information
                    PID:829
                • /bin/sh
                  /bin/sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
                  2⤵
                  • Command and Scripting Interpreter: Unix Shell
                  PID:837
                  • /usr/bin/rm
                    rm -rf /tmp/stat
                    3⤵
                      PID:838
                    • /usr/bin/cp
                      cp /proc/1/stat /tmp/stat
                      3⤵
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:839
                  • /bin/sh
                    /bin/sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
                    2⤵
                    • Command and Scripting Interpreter: Unix Shell
                    PID:840
                    • /usr/bin/rm
                      rm -rf /tmp/status
                      3⤵
                        PID:841
                      • /usr/bin/cp
                        cp /proc/1/status /tmp/status
                        3⤵
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:842
                    • /bin/sh
                      /bin/sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
                      2⤵
                      • Command and Scripting Interpreter: Unix Shell
                      PID:843
                      • /usr/bin/rm
                        rm -rf /tmp/cmdline
                        3⤵
                          PID:844
                        • /usr/bin/cp
                          cp /proc/1/cmdline /tmp/cmdline
                          3⤵
                          • Reads runtime system information
                          • Writes file to tmp directory
                          PID:845
                      • /bin/sh
                        /bin/sh -c "rm -rf 2����H};cp /proc/1/statm 2����H}"
                        2⤵
                        • Command and Scripting Interpreter: Unix Shell
                        PID:846
                        • /usr/bin/rm
                          rm -rf "2����H}"
                          3⤵
                            PID:847
                          • /usr/bin/cp
                            cp /proc/1/statm "2����H}"
                            3⤵
                            • Reads runtime system information
                            PID:848
                        • /bin/sh
                          /bin/sh -c "mount --bind /tmp /proc/836"
                          2⤵
                          • Command and Scripting Interpreter: Unix Shell
                          PID:849
                          • /usr/bin/mount
                            mount --bind /tmp /proc/836
                            3⤵
                            • Reads runtime system information
                            PID:850

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            2����H}
                            • Path /2����H}
                            • Size 27B
                            • SHA256 712544531bd8ba31dec53f813576ff6167334214d224714c92883c01606847dd
                            • MD5 SHA1 SHA512
                            Submit Download

                            2����H}
                            • Path /2����H}
                            • Size 27B
                            • SHA256 ec0de67dcffc56eb3ceba07fed3974c6f25764df488d653f5f450cb191cca8ee
                            • MD5 SHA1 SHA512
                            Submit Download

                            cmdline
                            • Path /tmp/cmdline
                            • Size 11B
                            • SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
                            • MD5 SHA1 SHA512
                            Submit Download

                            stat
                            • Path /tmp/stat
                            • Size 249B
                            • SHA256 4783018d688a6e08ebadc4c17e1cbab2884512a08407d096901de6572ac880c2
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            stat
                            • Path /tmp/stat
                            • Size 249B
                            • SHA256 78c56a3c99af6c126f47bb0b58e78994fcb7b769fc620e96462a67d9d6fce5dc
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            status
                            • Path /tmp/status
                            • Size 1KB
                            • SHA256 239b24752a6b2cfe17147de97a6aa43137cf5b6f7ebc1a3e84fda061d8f907a4
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            status
                            • Path /tmp/status
                            • Size 1KB
                            • SHA256 671ffdc3a54e03a17623e644cb6fa052c98bbc692dbeb039ec12d87a8217a15a
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download