3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892

Analysis

max time kernel
6s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
16/09/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clean
Size 1KB
Sample260916-w2w41scc42
SHA256 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892
MD5 2ca1a863f6a115127d623d3d181ab9b4
SHA1 58c15d76520685b6c151cd48b09375bb94b825be
SHA512 a0ae4c381d90f162558cbfd1b79a85716937d6899399a5a13b2846611e545388c69e02ad819701f60cafb1ae2cb8d026a5fb2ea790a6aa050478036d696c31ee
TLSH
T1AB21BE8EABA1ED3120D9D528B7F2493E5E62F29A2C107411358631FCE4DC62032EDC7A
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.oWdfNp	crontab

Removes the immutable protection flag from a file 1 TTPs 29 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
751	chattr
758	chattr
764	chattr
771	grep
784	grep
754	chattr
783	chattr
768	grep
786	chattr
732	chattr
735	grep
742	grep
752	grep
766	chattr
767	chattr
740	chattr
759	grep
787	grep
762	grep
765	chattr
734	chattr
789	chattr
747	chattr
748	grep
738	chattr
741	chattr
755	grep
761	chattr
790	grep

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 31 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/1/environ	systemctl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/clean_file	clean

/tmp/clean
/tmp/clean
1⤵
- Writes file to tmp directory
PID:710
- /bin/systemctl
  systemctl disable c3pool_miner
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:717
- /bin/systemctl
  systemctl stop c3pool_miner
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:721
- /bin/systemctl
  systemctl disable bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:724
- /bin/systemctl
  systemctl stop bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:728
- /usr/bin/chattr
  chattr -ia /var/spool/cron/crontabs
  2⤵
  - Removes the immutable protection flag from a file
  PID:732
- /usr/bin/chattr
  chattr -ia /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:734
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:735
- /bin/mv
  mv -f /tmp/clean_file /etc/crontab
  2⤵
  - Reads runtime system information
  PID:736
- /usr/bin/chattr
  chattr -ia /etc/cron.hourly
  2⤵
  - Removes the immutable protection flag from a file
  PID:738
- /usr/bin/chattr
  chattr -ia /etc/cron.daily
  2⤵
  - Removes the immutable protection flag from a file
  PID:740
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/apt-compat
  2⤵
  - Removes the immutable protection flag from a file
  PID:741
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/apt-compat
  2⤵
  - Removes the immutable protection flag from a file
  PID:742
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/apt-compat
  2⤵
  - Reads runtime system information
  PID:745
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/bsdmainutils
  2⤵
  - Removes the immutable protection flag from a file
  PID:747
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/bsdmainutils
  2⤵
  - Removes the immutable protection flag from a file
  PID:748
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/bsdmainutils
  2⤵
  - Reads runtime system information
  PID:749
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/dpkg
  2⤵
  - Removes the immutable protection flag from a file
  PID:751
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/dpkg
  2⤵
  - Removes the immutable protection flag from a file
  PID:752
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/dpkg
  2⤵
  - Reads runtime system information
  PID:753
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/exim4-base
  2⤵
  - Removes the immutable protection flag from a file
  PID:754
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/exim4-base
  2⤵
  - Removes the immutable protection flag from a file
  PID:755
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/exim4-base
  2⤵
  - Reads runtime system information
  PID:757
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/logrotate
  2⤵
  - Removes the immutable protection flag from a file
  PID:758
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/logrotate
  2⤵
  - Removes the immutable protection flag from a file
  PID:759
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/logrotate
  2⤵
  - Reads runtime system information
  PID:760
- /usr/bin/chattr
  chattr -ia /etc/cron.daily/passwd
  2⤵
  - Removes the immutable protection flag from a file
  PID:761
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/passwd
  2⤵
  - Removes the immutable protection flag from a file
  PID:762
- /bin/mv
  mv -f /tmp/clean_file /etc/cron.daily/passwd
  2⤵
  - Reads runtime system information
  PID:763
- /usr/bin/chattr
  chattr -ia /etc/cron.weekly
  2⤵
  - Removes the immutable protection flag from a file
  PID:764
- /usr/bin/chattr
  chattr -ia /etc/cron.monthly
  2⤵
  - Removes the immutable protection flag from a file
  PID:765
- /usr/bin/chattr
  chattr -ia /etc/cron.d
  2⤵
  - Removes the immutable protection flag from a file
  PID:766
- /usr/bin/chattr
  chattr -ia /etc/anacrontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:767
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/anacrontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:768
- /bin/mv
  mv -f /tmp/clean_file /etc/anacrontab
  2⤵
  - Reads runtime system information
  PID:769
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d"
  2⤵
  - Removes the immutable protection flag from a file
  PID:771
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:772
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:770
- /bin/grep
  grep -q /tmp
  2⤵
  PID:775
- /bin/grep
  grep -q /var/tmp
  2⤵
  PID:777
- /usr/bin/find
  find /var/tmp -mindepth 1 -maxdepth 1 -exec rm -rf -- "{}" +
  2⤵
  - Reads runtime system information
  PID:778
- - /usr/local/sbin/rm
    rm -rf -- /var/tmp/systemd-private-3d017d0cabd845e5b8a996d84692834d-systemd-timedated.service-yAOEr6
    3⤵
    PID:779
- - /usr/local/bin/rm
    rm -rf -- /var/tmp/systemd-private-3d017d0cabd845e5b8a996d84692834d-systemd-timedated.service-yAOEr6
    3⤵
    PID:779
- - /usr/sbin/rm
    rm -rf -- /var/tmp/systemd-private-3d017d0cabd845e5b8a996d84692834d-systemd-timedated.service-yAOEr6
    3⤵
    PID:779
- - /usr/bin/rm
    rm -rf -- /var/tmp/systemd-private-3d017d0cabd845e5b8a996d84692834d-systemd-timedated.service-yAOEr6
    3⤵
    PID:779
- - /sbin/rm
    rm -rf -- /var/tmp/systemd-private-3d017d0cabd845e5b8a996d84692834d-systemd-timedated.service-yAOEr6
    3⤵
    PID:779
- - /bin/rm
    rm -rf -- /var/tmp/systemd-private-3d017d0cabd845e5b8a996d84692834d-systemd-timedated.service-yAOEr6
    3⤵
    PID:779
- /bin/grep
  grep -q /dev/shm
  2⤵
  PID:781
- /usr/bin/find
  find /dev/shm -mindepth 1 -maxdepth 1 -exec rm -rf -- "{}" +
  2⤵
  - Reads runtime system information
  PID:782
- /usr/bin/chattr
  chattr -ia /root/.bashrc
  2⤵
  - Removes the immutable protection flag from a file
  PID:783
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /root/.bashrc
  2⤵
  - Removes the immutable protection flag from a file
  PID:784
- /bin/mv
  mv -f /tmp/clean_file /root/.bashrc
  2⤵
  - Reads runtime system information
  PID:785
- /usr/bin/chattr
  chattr -ia /root/.bash_profile
  2⤵
  - Removes the immutable protection flag from a file
  PID:786
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /root/.bash_profile
  2⤵
  - Removes the immutable protection flag from a file
  PID:787
- /bin/mv
  mv -f /tmp/clean_file /root/.bash_profile
  2⤵
  - Reads runtime system information
  PID:788
- /usr/bin/chattr
  chattr -ia /root/.profile
  2⤵
  - Removes the immutable protection flag from a file
  PID:789
- /bin/grep
  grep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /root/.profile
  2⤵
  - Removes the immutable protection flag from a file
  PID:790
- /bin/mv
  mv -f /tmp/clean_file /root/.profile
  2⤵
  - Reads runtime system information
  PID:791

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clean_file

Path /tmp/clean_file
Size 3KB
SHA256 70633db2fbb6f06c7eb01bdf1d094f602d3a86af456aa5e9cbf38732c84b2a81
MD5 c68ec131874aa008336272933b70de85
SHA1 23e71f7d1d77f35acda2422d6a3e172500e7f3e1
SHA512 49eddd530ab548984801c5de01c0486d985f0091af9956f89682f00ee9f6a8d4ae66c44d469ed752d236861c3ebcfe6aad4923a6f1a431b7ed8125f9db166d19
TLSH
T108819285E37CA730144C09AC29BC15266AB5042F5D11BF60B4DCF24C6B8AE9972FEF8C
MD5 SHA1 SHA512 TLSH

Submit Download

clean_file

Path /tmp/clean_file
Size 722B
SHA256 0e5c204385b21e15b031c83f37212bf5a4ee77b51762b7b54bd6ad973ebdf354
MD5 8f111d100ea459f68d333d63a8ef2205
SHA1 077ca9c46a964de67c0f7765745d5c6f9e2065c3
SHA512 d81767b47fb84aaf435f930356ded574ee9825ec710a2e7c26074860d8a385741d65572740137b6f9686c285a32e2951ca933393b266746988f1737aad059adb
TLSH
T14B019C6A9366B3BF464CDDE166D7BDAC226230641C007D0B94BD2580B24FB625050C6E
MD5 SHA1 SHA512 TLSH

Submit Download

clean_file

Path /tmp/clean_file
Size 1KB
SHA256 8eeae3a9df22621d51062e4dadfc5c63b49732b38a37b5d4e52c99c2237e5767
MD5 bc4a71cbcaeed4179f25d798257fa980
SHA1 61445721d0b5d86ac0a8386a4ceef450118f4fbb
SHA512 709badb4dd1a15a10b34f82d31ed4bbab81698190d2ec94e2ad3dcdc90d97b893eb61cde72f08e517a8beea08ec1d675385fd42a9e77530981b7d83c6bd3548c
TLSH
T1FE31320172CA19BD16B7189C169BA21CAF6A349B45193610F8CD7460AF70931F571EBF
MD5 SHA1 SHA512 TLSH

Submit Download

clean_file

Path /tmp/clean_file
Size 279B
SHA256 340dfc483eb79b83b0630b1c0b339e30ebd724ef2f58bb87ba92946472e8e63d
MD5 911a774fe040993b929504f3d9415ab3
SHA1 55ccc8e95097f005abf9f4d91a14394e6d0f5da5
SHA512 1eb8fd8dc6fd444ba2fa3ca7e863894cfb19383e5b20c700ed24aa615402340424d093a761632cf27a3e789ecd548ca972806e154161635da4f97b415d6fc64f
TLSH
T1E1D02BC6EC444330BC1D45A7645B1FA6E0C6167F1A15BCB480F93F10B1E56B830D290E
MD5 SHA1 SHA512 TLSH

Submit Download

clean_file

Path /tmp/clean_file
Size 1KB
SHA256 eff406c0943e1399e3e15fdb6ca2893a187d6b273f5bd9d17eec4e4b4c52b8cd
MD5 30e858769aacd9cc309502f8d5c6aa0f
SHA1 927c06dd4d6cbb5ca02e9505011c8667c47f2d6e
SHA512 f7f6e70925afe54fc2fdaae13a750b3c49fde9fa59d80af321885d270112ebb2291f034037708f1ba8515f3e3e1ca0a493cd1e002895aa699c469e0365ccde3c
TLSH
T17F31745F43004E7D558308E89DA68EC0DA0460B757B4314436AEF6F52F8B332F6A756C
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.oWdfNp

Path /var/spool/cron/crontabs/tmp.oWdfNp
Size 175B
SHA256 dedf65da8a071070c0282978190c92dbecb8e299457f270757c018a4f26f27c8
MD5 7df09ffb80ee72b0d37760912c2e2404
SHA1 50c4a8c128154505a3456da021fecae6afaf7010
SHA512 4b60a557b44a5b99354344c7cadbf62817758c182501cd6857a6e9eb21759d5886d709e38901d994c9803bab76d908872bd9665c3147b529d43fbd5e6e6d1e93
TLSH
T1B0C0CC0C3F00A8302A000B0C222F022EB8A2E03CC00EAE80E0CC20080223B8C2F82A32
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads