e019bf8327e0f049033606f0ff2c6e3c98b482cff979039943f8fd28969992b8

Analysis

max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/10/2026, 06:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
datadog-operator-9c71245c6822/build/bin/entrypoint
Size 381B
Sample261002-g267naaf76
SHA256 e019bf8327e0f049033606f0ff2c6e3c98b482cff979039943f8fd28969992b8
MD5 590543f89017e56d88c86956a6f5ec4b
SHA1 233ad2194a54f140cfb8d1b6c4f32d26f1321c8c
SHA512 ad4c081ec0db079ef1077a867404203017a6837556496ad9120d4d50d436e1acab8cf3823521caf0fe66705dfe94f53a8671127d05f49a6ea78f9884e1438383
TLSH
T17DE0F106DF440970E633D198C14C3A403252B89D8725FB982236DA80B85F1138359471
MD5 SHA1 SHA512 TLSH

Score

8^/10

credential_access defense_evasion discovery persistence

Malware Config

Signatures

Modifies password files for system users/ groups 1 TTPs 1 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/passwd	entrypoint

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id

/tmp/datadog-operator-9c71245c6822/build/bin/entrypoint
/tmp/datadog-operator-9c71245c6822/build/bin/entrypoint
1⤵
- Modifies password files for system users/ groups
PID:747
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:749
- /usr/bin/whoami
  whoami
  2⤵
  PID:750
- /usr/bin/id
  id -g
  2⤵
  - Reads runtime system information
  PID:751

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads