Overview

overview

10

Static

static

10

7766739193...e1.elf

debian-12-armhf

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260127-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    07/10/2026, 11:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7766739193c449206ea63751d23551e2057e4de80f6befaeb7a24eaeb63a5ee1.elf
  • Size 210KB
  • Sample261007-ns3ansaf45
  • SHA256 7766739193c449206ea63751d23551e2057e4de80f6befaeb7a24eaeb63a5ee1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 5 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 4 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 2 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 2 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  • Schedules an At job 1 TTPs 1 IoCs

    Schedules a job to be run using the at command.

    executionpersistenceprivilege_escalation
  • Modifies Bash startup script 2 TTPs 4 IoCs
    persistence
  • Changes its process name 2 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Command and Scripting Interpreter: Unix Shell 1 TTPs 3 IoCs

    Execute scripts via Unix Shell.

    execution
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/7766739193c449206ea63751d23551e2057e4de80f6befaeb7a24eaeb63a5ee1.elf
    /tmp/7766739193c449206ea63751d23551e2057e4de80f6befaeb7a24eaeb63a5ee1.elf
    1⤵
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Reads system routing table
    • Modifies Bash startup script
    • Changes its process name
    • Reads system network configuration
    • Reads runtime system information
    PID:780
    • /bin/sh
      /bin/sh -c "/usr/sbin/update-rc.d bot defaults 2>/dev/null"
      2⤵
      • Command and Scripting Interpreter: Unix Shell
      PID:788
      • /usr/sbin/update-rc.d
        /usr/sbin/update-rc.d bot defaults
        3⤵
          PID:790
          • /usr/local/sbin/systemctl
            systemctl daemon-reload
            4⤵
              PID:807
            • /usr/local/bin/systemctl
              systemctl daemon-reload
              4⤵
                PID:807
              • /usr/sbin/systemctl
                systemctl daemon-reload
                4⤵
                  PID:807
                • /usr/bin/systemctl
                  systemctl daemon-reload
                  4⤵
                    PID:807
              • /bin/sh
                /bin/sh -c "/sbin/chkconfig --add bot 2>/dev/null"
                2⤵
                  PID:827
                  • /sbin/chkconfig
                    /sbin/chkconfig --add bot
                    3⤵
                      PID:828
                  • /bin/sh
                    /bin/sh -c "systemctl enable bot.service 2>/dev/null"
                    2⤵
                    • Command and Scripting Interpreter: Unix Shell
                    PID:829
                    • /usr/bin/systemctl
                      systemctl enable bot.service
                      3⤵
                      • Changes its process name
                      • Reads runtime system information
                      PID:830
                      • /lib/systemd/systemd-sysv-install
                        /lib/systemd/systemd-sysv-install enable bot
                        4⤵
                          PID:831
                          • /usr/bin/getopt
                            getopt -o r: --long root: -- enable bot
                            5⤵
                              PID:832
                            • /usr/sbin/update-rc.d
                              /usr/sbin/update-rc.d bot defaults
                              5⤵
                                PID:833
                                • /usr/local/sbin/systemctl
                                  systemctl daemon-reload
                                  6⤵
                                    PID:834
                                  • /usr/local/bin/systemctl
                                    systemctl daemon-reload
                                    6⤵
                                      PID:834
                                    • /usr/sbin/systemctl
                                      systemctl daemon-reload
                                      6⤵
                                        PID:834
                                      • /usr/bin/systemctl
                                        systemctl daemon-reload
                                        6⤵
                                        • Reads runtime system information
                                        PID:834
                                    • /usr/sbin/update-rc.d
                                      /usr/sbin/update-rc.d bot enable
                                      5⤵
                                        PID:852
                                        • /usr/local/sbin/systemctl
                                          systemctl daemon-reload
                                          6⤵
                                            PID:853
                                          • /usr/local/bin/systemctl
                                            systemctl daemon-reload
                                            6⤵
                                              PID:853
                                            • /usr/sbin/systemctl
                                              systemctl daemon-reload
                                              6⤵
                                                PID:853
                                              • /usr/bin/systemctl
                                                systemctl daemon-reload
                                                6⤵
                                                  PID:853
                                        • /bin/sh
                                          /bin/sh -c "echo \"/tmp/7766739193c449206ea63751d23551e2057e4de80f6befaeb7a24eaeb63a5ee1.elf\" | at now + 1 minute 2>/dev/null"
                                          2⤵
                                          • Command and Scripting Interpreter: Unix Shell
                                          PID:884
                                          • /usr/bin/at
                                            at now + 1 minute
                                            3⤵
                                            • Creates/modifies Cron job
                                            • Schedules an At job
                                            • Reads runtime system information
                                            PID:886
                                        • /bin/sh
                                          /bin/sh -c "cp /tmp/7766739193c449206ea63751d23551e2057e4de80f6befaeb7a24eaeb63a5ee1.elf /tmp/.kworker 2>/dev/null; chmod 755 /tmp/.kworker 2>/dev/null"
                                          2⤵
                                          • File and Directory Permissions Modification
                                          PID:887
                                          • /usr/bin/cp
                                            cp /tmp/7766739193c449206ea63751d23551e2057e4de80f6befaeb7a24eaeb63a5ee1.elf /tmp/.kworker
                                            3⤵
                                            • Reads runtime system information
                                            • Writes file to tmp directory
                                            PID:888
                                          • /usr/bin/chmod
                                            chmod 755 /tmp/.kworker
                                            3⤵
                                            • File and Directory Permissions Modification
                                            PID:889

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Command and Scripting Interpreter

                                            1
                                            T1059

                                            Unix Shell

                                            1
                                            T1059.004

                                            Scheduled Task/Job

                                            2
                                            T1053

                                            At

                                            1
                                            T1053.002

                                            Cron

                                            1
                                            T1053.003

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            4
                                            T1547

                                            XDG Autostart Entries

                                            1
                                            T1547.013

                                            Boot or Logon Initialization Scripts

                                            2
                                            T1037

                                            RC Scripts

                                            2
                                            T1037.004

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Systemd Service

                                            1
                                            T1543.002

                                            Event Triggered Execution

                                            1
                                            T1546

                                            Unix Shell Configuration Modification

                                            1
                                            T1546.004

                                            Hijack Execution Flow

                                            1
                                            T1574

                                            Path Interception by PATH Environment Variable

                                            1
                                            T1574.007

                                            Scheduled Task/Job

                                            2
                                            T1053

                                            At

                                            1
                                            T1053.002

                                            Cron

                                            1
                                            T1053.003

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            4
                                            T1547

                                            XDG Autostart Entries

                                            1
                                            T1547.013

                                            Boot or Logon Initialization Scripts

                                            2
                                            T1037

                                            RC Scripts

                                            2
                                            T1037.004

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Systemd Service

                                            1
                                            T1543.002

                                            Event Triggered Execution

                                            1
                                            T1546

                                            Unix Shell Configuration Modification

                                            1
                                            T1546.004

                                            Hijack Execution Flow

                                            1
                                            T1574

                                            Path Interception by PATH Environment Variable

                                            1
                                            T1574.007

                                            Scheduled Task/Job

                                            2
                                            T1053

                                            At

                                            1
                                            T1053.002

                                            Cron

                                            1
                                            T1053.003

                                            Defense Evasion

                                            File and Directory Permissions Modification

                                            1
                                            T1222

                                            Linux and Mac File and Directory Permissions Modification

                                            1
                                            T1222.002

                                            Hijack Execution Flow

                                            1
                                            T1574

                                            Path Interception by PATH Environment Variable

                                            1
                                            T1574.007

                                            Credential Access

                                            Discovery

                                            System Network Configuration Discovery

                                            2
                                            T1016

                                            Internet Connection Discovery

                                            2
                                            T1016.001

                                            Lateral Movement

                                            Collection

                                            Command and Control

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            root
                                            • Path /etc/cron.d/root
                                            • Size 107B
                                            • SHA256 130638bc8c9d856da9ac554890687512f5fe6849806068ca5fe4ca686f772a8c
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            S99bot
                                            • Path /etc/init.d/S99bot
                                            • Size 142B
                                            • SHA256 a9ff9581f9b1053b6a19721d9820a27f73a5b713c518e64d04ca379086dda8fd
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            bot
                                            • Path /etc/init.d/bot
                                            • Size 272B
                                            • SHA256 b53c82ef5e031524148ee7c1e9e2c9f3ae7f85d2a2a16b819d49cc3a5311d61a
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            bot.sh
                                            • Path /etc/profile.d/bot.sh
                                            • Size 104B
                                            • SHA256 e80244d537db011a6bcd45e017827716e153c6dce869f6346fefa578308069f8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            rc.local
                                            • Path /etc/rc.local
                                            • Size 76B
                                            • SHA256 3baa3be071c946c8ab39b786a1a09334be0bead4e535025983d9c89824110910
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            bot.service
                                            • Path /etc/systemd/system/bot.service
                                            • Size 232B
                                            • SHA256 8c4a049d3a769f9f1d585106c50c2f0ca1f42544d25297e9f5eb89425bb86280
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            .bash_profile
                                            • Path /root/.bash_profile
                                            • Size 95B
                                            • SHA256 3dfe82c887fd1ff1013dec9ab7c1c90bed824b359e51e54bfe45d604452952c8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            a0000101c791dd
                                            • Path /var/spool/cron/atjobs/a0000101c791dd
                                            • Size 477B
                                            • SHA256 4c7e736a143f450031a469b60b41b04261ad129ae9dd4d9b568d09e5705a1c0d
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            root
                                            • Path /var/spool/cron/crontabs/root
                                            • Size 102B
                                            • SHA256 0f14bab74a0dfd20b9c9951b60e05e76a75984bac6aa40bf0ac716c9c2fa7645
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download