90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2

Analysis

max time kernel
145s
max time network
152s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
02/10/2026, 13:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf
Size 84KB
Sample261002-qtkhcsvhmb
SHA256 90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2
MD5 89b40021747b730fd2ea38a7312f985f
SHA1 3b0ac6aaabb3bf8058ca14f9c8ccc613cfa3ea71
SHA512 698c461be6992d55a5616d631182766ec8e13ac54ff98e4fe3742ece39faf81aeaa4319d799b029eee2959e15bf18180bb77d0f699b0e3c5a7d29877356f958a
SSDEEP 1536:aVw5fDI9dJ+uQgpw6DI//N8jm+rKS2IWrLsP87NvPcfVA7KW54r:W4fwdIr6DI/jeK5IYLR7xay2
TLSH
T1FB833A89BEA10E9BC43FCE70465F021725EC4D9E92F2636A593CDC4D32AE64586D3D88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
820	sh
823	chmod
825	sh
828	chmod

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf
File opened for modification	/dev/misc/watchdog	90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/.cling	cp

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself		798	90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf
Changes the process name, possibly in an attempt to hide itself		865	90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/1/stat	cp
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/cmdline	cp
File opened for reading	/proc/1/stat	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/1/status	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/statm	cp
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/status	cp

/tmp/90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf
/tmp/90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:797
- /bin/sh
  sh -c "rm -rf /root/.cling;cp /tmp/90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf /root/.cling"
  2⤵
  PID:800
- - /usr/bin/rm
    rm -rf /root/.cling
    3⤵
    PID:802
- - /usr/bin/cp
    cp /tmp/90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf /root/.cling
    3⤵
    - Reads runtime system information
    PID:807
- /bin/sh
  sh -c "rm -rf /usr/local/bin/.cling;cp /tmp/90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf /usr/local/bin/.cling"
  2⤵
  PID:811
- - /usr/bin/rm
    rm -rf /usr/local/bin/.cling
    3⤵
    PID:815
- - /usr/bin/cp
    cp /tmp/90d738a8d650e3fefda9d7efa4baa11bd89ab05fcf0eb173e04aa01a52b465e2.elf /usr/local/bin/.cling
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:818
- /bin/sh
  sh -c "chmod +x /root/.cling"
  2⤵
  - File and Directory Permissions Modification
  PID:820
- - /usr/bin/chmod
    chmod +x /root/.cling
    3⤵
    - File and Directory Permissions Modification
    PID:823
- /bin/sh
  sh -c "chmod +x /usr/local/bin/.cling"
  2⤵
  - File and Directory Permissions Modification
  PID:825
- - /usr/bin/chmod
    chmod +x /usr/local/bin/.cling
    3⤵
    - File and Directory Permissions Modification
    PID:828
- /bin/sh
  sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
  2⤵
  PID:830
- - /usr/bin/rm
    rm -rf /tmp/stat
    3⤵
    PID:833
- - /usr/bin/cp
    cp /proc/1/stat /tmp/stat
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:834
- /bin/sh
  sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
  2⤵
  PID:836
- - /usr/bin/rm
    rm -rf /tmp/status
    3⤵
    PID:837
- - /usr/bin/cp
    cp /proc/1/status /tmp/status
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:838
- /bin/sh
  sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
  2⤵
  PID:840
- - /usr/bin/rm
    rm -rf /tmp/cmdline
    3⤵
    PID:842
- - /usr/bin/cp
    cp /proc/1/cmdline /tmp/cmdline
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:844
- /bin/sh
  sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
  2⤵
  PID:848
- - /usr/bin/rm
    rm -rf /tmp/statm
    3⤵
    PID:851
- - /usr/bin/cp
    cp /proc/1/statm /tmp/statm
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:852
- /bin/sh
  sh -c "mount --bind /tmp /proc/798"
  2⤵
  PID:854
- - /usr/bin/mount
    mount --bind /tmp /proc/798
    3⤵
    - Reads runtime system information
    PID:855
- /bin/sh
  sh -c "rm -rf /tmp/stat;cp /proc/1/stat /tmp/stat"
  2⤵
  PID:866
- - /usr/bin/rm
    rm -rf /tmp/stat
    3⤵
    PID:867
- - /usr/bin/cp
    cp /proc/1/stat /tmp/stat
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:868
- /bin/sh
  sh -c "rm -rf /tmp/status;cp /proc/1/status /tmp/status"
  2⤵
  PID:869
- - /usr/bin/rm
    rm -rf /tmp/status
    3⤵
    PID:870
- - /usr/bin/cp
    cp /proc/1/status /tmp/status
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:871
- /bin/sh
  sh -c "rm -rf /tmp/cmdline;cp /proc/1/cmdline /tmp/cmdline"
  2⤵
  PID:872
- - /usr/bin/rm
    rm -rf /tmp/cmdline
    3⤵
    PID:873
- - /usr/bin/cp
    cp /proc/1/cmdline /tmp/cmdline
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:874
- /bin/sh
  sh -c "rm -rf /tmp/statm;cp /proc/1/statm /tmp/statm"
  2⤵
  PID:875
- - /usr/bin/rm
    rm -rf /tmp/statm
    3⤵
    PID:876
- - /usr/bin/cp
    cp /proc/1/statm /tmp/statm
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:877
- /bin/sh
  sh -c "mount --bind /tmp /proc/865"
  2⤵
  PID:878
- - /usr/bin/mount
    mount --bind /tmp /proc/865
    3⤵
    - Reads runtime system information
    PID:879

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

stat

Path /tmp/stat
Size 263B
SHA256 34723113c2e20b3e6c9da7839eaf5f7f5bceecb9f23fe7aee1321b20cbb25ea7
MD5 b9b0094c007304bda9ddaa9f09291261
SHA1 634797fa5f19c2409d98b12a6031529dc744c7c9
SHA512 687106ea8275c306f6d327e5f96bf7a85098d573cfd83a7e0830b5a9f556456eaf5517ff5ee551c1ec1be0b2795aa813388e7d1d24bd52e0ad8188ca856377ce
TLSH
T1C4D0C27080D8608C4201FA854602AA93473CA676387C349A1E0E49219103A56C86F400
MD5 SHA1 SHA512 TLSH

Submit Download

stat

Path /tmp/stat
Size 262B
SHA256 e0df15cc3533150f21d72c5797b1da2ad74bbd7dcb33720111825f7aedf6c56b
MD5 528504ceed3a3f9c1f8978457abe7ae1
SHA1 fdd4d62b1886da141758cf1d0eb5b273a6ee194e
SHA512 e05a6e5e66191b4119f070d8af45b045a7f2b24d71e8c2a431a30fdcbe0a1d2e7355a0c93a579d1a4c097113f91ed25b8b0b7cc050a0090eec951acbe3e7e528
TLSH
T1B9D05B78819CA09D4146FE451A43BB97C73DF23678BC35AA4E4F1D61A543A65C43B410
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 26B
SHA256 eb65d7ec19ebd16a9f753941ce8cb53585ca25e56f9be603ac790e360a05ded6
MD5 9459165b4713b8deaddc174c1bd0e162
SHA1 741a12981aea3936b804f4dce5f3f073f98fa8c7
SHA512 a751ff2f500d847be89c774dc663f509f801450e4236292b8b8d0faff2ab12cd9466da69c7b755228859fdecfd37bebcf76371e8aaea2f9afdf6744043287a9a
MD5 SHA1 SHA512

Submit Download

statm

Path /tmp/statm
Size 27B
SHA256 8caa1163b6d9ea259601963345667d8ce173cbe205253f1c29f7bd6cfaad24c0
MD5 e90fcac1f8b387a96477fd8270b09779
SHA1 4a06451b5bb98ef19a40cfc9b1627804af92cc0e
SHA512 08a7af32d565d5f108458f07b2ed1da11de2412a229c5077433d030a56e23596afa5dc8777853b5cf6b9dfbdd662f15ceff4d8e75d26f4868c12259d11231e7d
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 78d78cd190f09e03c1c1ad3410a252c9656e4a78231402fb77427ba9573a7e0b
MD5 34468d130b4bafd38cace9b4176d9e80
SHA1 c76dce8aa531b92cc278d1f15b858273e1c3731e
SHA512 70613232c35fc784ca1f30049c30dc3efce81772e2cc6e51f39eecbd791a31e9de6349beeaf5caeaca33a04443f46b632a025d15bf2c5f4cd3d420dbb3391a5e
TLSH
T1D71178608FDA6C84CEAEC349056AF80160B0B15A24E47135300DC979FB3759F8798CD4
MD5 SHA1 SHA512 TLSH

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 9d8bc020f66ebd53529eaffe65b9400d74e9c8499b59564affc03997dd777912
MD5 35ea1ce7d50e839ab2d43c90e76d5699
SHA1 9bb090c0caf3cdd43e3bc01753db981bfb7ff593
SHA512 c52fd7e39328bea6c9c7073741c45579fb1c40f45d4dbe4f990b3cc5ed88f5ea25cc3dbdf0917cd45b406166fa204b5dbc8ba4f63a67ebee53bf5d6739675bcf
TLSH
T15D119B608FDBAC88DEAEC348155AF8016070F51A34E47535304DC979BB3758F8799CD8
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads