Overview

overview

7

Static

static

1

3

debian-12-armhf

7

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    30/09/2026, 06:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3
  • Size 489KB
  • Sample260930-g2mg9atdpc
  • SHA256 5502969dbfa95043fea97dbd10009ee3be6a9691414298afa8f8e27868074da5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Deletes itself 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Modifies Watchdog functionality 1 TTPs 8 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 2 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 4 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 4 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads hardware information 1 TTPs 4 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Removes the immutable protection flag from a file 1 TTPs 14 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Write file to user bin folder 4 IoCs
    persistence
  • Changes its process name 2 IoCs
  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Reads system network configuration 1 TTPs 4 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/3
    /tmp/3
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Modifies systemd
    • Reads MAC address of network interface
    • Reads hardware information
    • Write file to user bin folder
    • Enumerates kernel/hardware configuration
    PID:783
    • /usr/bin/chattr
      chattr -i /etc/.rcu_sched252
      2⤵
      • Removes the immutable protection flag from a file
      PID:787
    • /usr/bin/chattr
      chattr -i /var/cache/.rcu_sched252
      2⤵
      • Removes the immutable protection flag from a file
      PID:810
    • /usr/bin/chattr
      chattr -i /var/lib/.rcu_sched252
      2⤵
      • Removes the immutable protection flag from a file
      PID:811
    • /usr/bin/chattr
      chattr -i /usr/bin/.rcu_sched252
      2⤵
      • Removes the immutable protection flag from a file
      PID:812
    • /bin/systemctl
      systemctl daemon-reload
      2⤵
      • Reads runtime system information
      PID:813
    • /bin/systemctl
      systemctl enable --now /etc/systemd/system/rcu_sched252.service
      2⤵
        PID:829
    • /etc/.rcu_sched252
      /etc/.rcu_sched252
      1⤵
      • Executes dropped EXE
      • Modifies Watchdog functionality
      • Enumerates active TCP sockets
      • Modifies systemd
      • Reads MAC address of network interface
      • Reads hardware information
      • Write file to user bin folder
      • Changes its process name
      • Reads CPU attributes
      • Reads system network configuration
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:783
      • /usr/bin/chattr
        chattr -i /var/cache/.rcu_sched252
        2⤵
        • Removes the immutable protection flag from a file
        PID:846
      • /usr/bin/chattr
        chattr -i /var/lib/.rcu_sched252
        2⤵
        • Removes the immutable protection flag from a file
        PID:847
      • /usr/bin/chattr
        chattr -i /usr/bin/.rcu_sched252
        2⤵
        • Removes the immutable protection flag from a file
        PID:848
      • /bin/systemctl
        systemctl daemon-reload
        2⤵
          PID:851
        • /bin/systemctl
          systemctl enable --now /etc/systemd/system/rcu_sched252.service
          2⤵
            PID:867
          • /var/cache/.upd_boat
            /var/cache/.upd_boat --self-check
            2⤵
              PID:887
          • /var/cache/.upd_boat
            /var/cache/.upd_boat
            1⤵
            • Deletes itself
            • Executes dropped EXE
            • Modifies Watchdog functionality
            • Modifies systemd
            • Reads MAC address of network interface
            • Reads hardware information
            • Write file to user bin folder
            • Enumerates kernel/hardware configuration
            PID:783
            • /usr/bin/chattr
              chattr -i /etc/.rcu_sched252
              2⤵
              • Removes the immutable protection flag from a file
              PID:888
            • /usr/bin/chattr
              chattr -i /var/cache/.rcu_sched252
              2⤵
              • Removes the immutable protection flag from a file
              PID:889
            • /usr/bin/chattr
              chattr -i /var/lib/.rcu_sched252
              2⤵
              • Removes the immutable protection flag from a file
              PID:890
            • /usr/bin/chattr
              chattr -i /usr/bin/.rcu_sched252
              2⤵
              • Removes the immutable protection flag from a file
              PID:891
            • /bin/systemctl
              systemctl daemon-reload
              2⤵
              • Reads runtime system information
              PID:892
            • /bin/systemctl
              systemctl enable --now /etc/systemd/system/rcu_sched252.service
              2⤵
                PID:908
            • /etc/.rcu_sched252
              /etc/.rcu_sched252
              1⤵
              • Modifies Watchdog functionality
              • Enumerates active TCP sockets
              • Modifies systemd
              • Reads MAC address of network interface
              • Reads hardware information
              • Write file to user bin folder
              • Changes its process name
              • Reads CPU attributes
              • Reads system network configuration
              • Enumerates kernel/hardware configuration
              • Reads runtime system information
              PID:783
              • /usr/bin/chattr
                chattr -i /var/cache/.rcu_sched252
                2⤵
                • Removes the immutable protection flag from a file
                PID:925
              • /usr/bin/chattr
                chattr -i /var/lib/.rcu_sched252
                2⤵
                • Removes the immutable protection flag from a file
                PID:926
              • /usr/bin/chattr
                chattr -i /usr/bin/.rcu_sched252
                2⤵
                • Removes the immutable protection flag from a file
                PID:927
              • /bin/systemctl
                systemctl daemon-reload
                2⤵
                  PID:928
                • /bin/systemctl
                  systemctl enable --now /etc/systemd/system/rcu_sched252.service
                  2⤵
                    PID:944

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Persistence

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      XDG Autostart Entries

                      1
                      T1547.013

                      Create or Modify System Process

                      1
                      T1543

                      Systemd Service

                      1
                      T1543.002

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      1
                      T1547

                      XDG Autostart Entries

                      1
                      T1547.013

                      Create or Modify System Process

                      1
                      T1543

                      Systemd Service

                      1
                      T1543.002

                      Defense Evasion

                      File and Directory Permissions Modification

                      1
                      T1222

                      Linux and Mac File and Directory Permissions Modification

                      1
                      T1222.002

                      Impair Defenses

                      1
                      T1562

                      Credential Access

                      Discovery

                      System Information Discovery

                      3
                      T1082

                      System Network Configuration Discovery

                      2
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      Wi-Fi Discovery

                      1
                      T1016.002

                      System Network Connections Discovery

                      2
                      T1049

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      .rcu_sched252
                      • Path /etc/.rcu_sched252
                      • Size 489KB
                      • SHA256 5502969dbfa95043fea97dbd10009ee3be6a9691414298afa8f8e27868074da5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      rcu_sched252.service
                      • Path /etc/systemd/system/rcu_sched252.service
                      • Size 246B
                      • SHA256 1ed739178efd30c9042c1a116be59e9c8ef9ccb99b30154d130b55fc8644a4b2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download