5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf

Analysis

max time kernel
149s
max time network
136s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
11/10/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
Size 551KB
Sample261011-pk6hssh12x
SHA256 5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf
MD5 b9c78760722ec39ac5013b4dbafa65b6
SHA1 67d609b0c2a4f1d4d9f97840b0dd58c9a80e9f7c
SHA512 cc1816c7d56c8bf9b3ce835fb3b48583c0ef2eaeb07f0cc8493992c7adcb8d9d37a7b7be33dc4e12441d483518d0d5d22a7069a2c2b2ff6a22dc55b957f1c230
SSDEEP 12288:Y+NJMPvr/41wxoDyFX++TtgkkkkkkkkkkkPkkkk3WqXFC:TYvj41K9++TQ+0
TLSH
T1EEC428476E328F5CF674CA718AF70974DB6823D313E19645D1ACE1206E6068F981FBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

credential_access discovery persistence privilege_escalation

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
7	5.tcp.eu.ngrok.io
9	5.tcp.eu.ngrok.io
11	5.tcp.eu.ngrok.io
13	5.tcp.eu.ngrok.io
1	5.tcp.eu.ngrok.io
3	5.tcp.eu.ngrok.io
5	5.tcp.eu.ngrok.io

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/systemd-network-helper	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/systemd-network-helper.service	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf

Reads process memory 1 TTPs 13 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/126/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/244/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/662/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/711/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/724/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/753/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/821/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/162/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/678/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/712/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/713/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/798/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/843/maps	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	kworker/0:1	777	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
Changes the process name, possibly in an attempt to hide itself	kworker/1:2	778	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/net/tcp6	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/662/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/675/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/333/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/662/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/712/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/177/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/675/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/680/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/229/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/329/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/813/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/809/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/821/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/841/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/110/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/681/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/712/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/162/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/362/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/437/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/753/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/127/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/384/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/704/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/154/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/724/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/126/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/333/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/821/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/841/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/383/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/842/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/229/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/706/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/717/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/162/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/177/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/332/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/391/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/437/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/680/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/706/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/711/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/713/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/798/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/678/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/713/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/717/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/724/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/798/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/244/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/678/cmdline	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/329/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/110/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/681/comm	5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf

/tmp/5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
/tmp/5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
1⤵
- Modifies init.d
- Modifies systemd
PID:715
- /bin/sh
  sh -c "nvram get rc_startup >/dev/null 2>&1"
  2⤵
  PID:718
- /bin/sh
  sh -c "systemctl daemon-reload >/dev/null 2>&1"
  2⤵
  PID:719
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:721
- /bin/sh
  sh -c "systemctl enable systemd-network-helper.service >/dev/null 2>&1"
  2⤵
  PID:755
- - /bin/systemctl
    systemctl enable systemd-network-helper.service
    3⤵
    - Reads runtime system information
    PID:756
  - - /lib/systemd/systemd-sysv-install
      /lib/systemd/systemd-sysv-install enable systemd-network-helper
      4⤵
      PID:758
    - - /usr/bin/getopt
        
        getopt -o r: --long root: -- enable systemd-network-helper
        5⤵
        
        PID:759
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d systemd-network-helper defaults
        5⤵
        
        PID:760
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:761
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:761
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:761
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:761
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:761
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:761
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d systemd-network-helper enable
        5⤵
        
        PID:774
- /tmp/5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
  bot --bot
  2⤵
  PID:776
- /tmp/5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
  bot --killer
  2⤵
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:777
- /tmp/5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf.elf
  bot --locker
  2⤵
  - Changes its process name
  PID:778

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

systemd-network-helper

Path /etc/init.d/systemd-network-helper
Size 551KB
SHA256 5ff0986bb41a3213a79c112c6a7e80310edfb48d3282d6dd2c24cb4964947fdf
MD5 b9c78760722ec39ac5013b4dbafa65b6
SHA1 67d609b0c2a4f1d4d9f97840b0dd58c9a80e9f7c
SHA512 cc1816c7d56c8bf9b3ce835fb3b48583c0ef2eaeb07f0cc8493992c7adcb8d9d37a7b7be33dc4e12441d483518d0d5d22a7069a2c2b2ff6a22dc55b957f1c230
SSDEEP 12288:Y+NJMPvr/41wxoDyFX++TtgkkkkkkkkkkkPkkkk3WqXFC:TYvj41K9++TQ+0
TLSH
T1EEC428476E328F5CF674CA718AF70974DB6823D313E19645D1ACE1206E6068F981FBAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemd-network-helper.service

Path /etc/systemd/system/systemd-network-helper.service
Size 179B
SHA256 ed08f049d80f104e40cf557edff663fbd20bf854ffb605373a80575797083bdd
MD5 259d63812b96eb472c72cf57021e1e5a
SHA1 7e52f19cd771c82153e29df20c9ec304498fb62b
SHA512 bee13f70a1ac8aa0d553bff0484b82403d67c88eafcafda556babbc81ddcecb209c64a25e6b1c424edeff1234352e9cd87466d4ff899e6f65417d52b1f8535eb
TLSH
T1DEC02212A21150E100092C608FA76B009920004027CBA2B90BD0198684D128204348AC
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads