d6d1df115bb0db2525b86ca09a157de77af91d2717de0aa634e088b90e7c7778

Analysis

max time kernel
149s
max time network
151s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
12/10/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
109.123.243.121_sample.bin
Size 5.7MB
Sample261012-vd57cagy6p
SHA256 d6d1df115bb0db2525b86ca09a157de77af91d2717de0aa634e088b90e7c7778
MD5 9963f20f79c8e9fd1d301ae083073712
SHA1 d40e1daaeadf615f176ad9e264e33ba80923f618
SHA512 856833a77d7e54c0aff2ad711eea3bd244ec80acd74990b299f6d15618cc55d58b49d7650dc2ed8f2e612287e0e605c2d4152946dab8adf7ee0bac83507eadf8
SSDEEP 24576:CH0HtY7g+QIYXIv8Qeg1k481UX2YY//OMtj2oMeZyh9ba1ACwvHzEjdF5OtjwZvp:C8IAhb+oI0L2VaKjiGyToyJMx8p5E2
TLSH
T156561897B9925942C4E43A77BCBD81C833630EBA9BC652566D04FE3C3ABE1D90E35314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 4 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/system-update	109.123.243.121_sample.bin
File opened for modification	/etc/crontab	109.123.243.121_sample.bin
File opened for modification	/etc/cron.d/systemd-update	109.123.243.121_sample.bin
File opened for modification	/var/spool/cron/crontabs/tmp.Z6g1zM	crontab

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/system-update	109.123.243.121_sample.bin
File opened for modification	/etc/init.d/systemd-update	109.123.243.121_sample.bin

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/bot-update.service	109.123.243.121_sample.bin
File opened for modification	/etc/systemd/system/systemd-update.service	109.123.243.121_sample.bin

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
817	sh
878	sh

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	109.123.243.121_sample.bin
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	109.123.243.121_sample.bin

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/meminfo	109.123.243.121_sample.bin
File opened for reading	/proc/self/status	109.123.243.121_sample.bin
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/mountinfo	109.123.243.121_sample.bin
File opened for reading	/proc/self/cgroup	109.123.243.121_sample.bin
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.cron	109.123.243.121_sample.bin

/tmp/109.123.243.121_sample.bin
/tmp/109.123.243.121_sample.bin
1⤵
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:787
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:814
- /usr/bin/crontab
  crontab /tmp/.cron
  2⤵
  - Creates/modifies Cron job
  PID:815
- /usr/bin/systemctl
  systemctl enable bot-update.service
  2⤵
  - Reads runtime system information
  PID:816
- /bin/sh
  /bin/sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable systemd-update.service 2>/dev/null; systemctl restart systemd-update.service 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:817
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:818
- - /usr/bin/systemctl
    systemctl enable systemd-update.service
    3⤵
    - Reads runtime system information
    PID:838
- - /usr/bin/systemctl
    systemctl restart systemd-update.service
    3⤵
    - Reads runtime system information
    PID:872
- /usr/bin/systemctl
  systemctl start bot-update.service
  2⤵
  - Reads runtime system information
  PID:856
- /usr/sbin/update-rc.d
  update-rc.d system-update defaults
  2⤵
  PID:874
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:898
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:898
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:898
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:898
- /bin/sh
  /bin/sh -c "update-rc.d systemd-update defaults 2>/dev/null; rc-update add systemd-update 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:878
- - /usr/sbin/update-rc.d
    update-rc.d systemd-update defaults
    3⤵
    PID:879
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:899
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:899
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:899
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:899
- /usr/sbin/service
  service system-update start
  2⤵
  PID:955
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:956
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:957
- - /usr/bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    - Reads runtime system information
    PID:960
- - /usr/bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Reads runtime system information
    PID:959
- /usr/local/sbin/systemctl
  systemctl start system-update.service
  2⤵
  PID:955
- /usr/local/bin/systemctl
  systemctl start system-update.service
  2⤵
  PID:955
- /usr/sbin/systemctl
  systemctl start system-update.service
  2⤵
  PID:955
- /usr/bin/systemctl
  systemctl start system-update.service
  2⤵
  - Reads runtime system information
  PID:955
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1215

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

system-update

Path /etc/cron.d/system-update
Size 95B
SHA256 c8e6c462f706ad0dc586447c3994987716f47dd1de7034f49114af9cbd124824
MD5 52009b396fb89c4e762927c40f64c200
SHA1 4cbdc08d4953b436e469145fdf630efdf84af0c7
SHA512 497493376364c0acf94e2f6352ecbd7d7b7d4e195ad9c60bd76d7aeb51d4fd11b40f483d8cc583f264d9880cce2b4ee60494108d2885af80e4feb867320b6dad
TLSH
T129B00234E78AA7319155FCE40004295484A534542381781018CD90D1D115A92062AC69
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-update

Path /etc/cron.d/systemd-update
Size 132B
SHA256 50c9c1fa373745481fe28cb62b4cff32e4cdc117ffc2e7f90a309e12e8c15095
MD5 0b0e82168d52c53ea73e930fbae2f66c
SHA1 afc94c82abb099ff8db4fac388bb2335d9b73875
SHA512 c20d97412651420c1fe74fe19716f65365fa7a19fb8fb09db06f56ecc07c357bc0aebee99e413e3b4b3956bce537bd2cba042fef9e86b75babfdc283bc9bafcc
TLSH
T106C09238D3CEBA79D2513CFA1200292981E834102F46BB0018ED70E2DA04FA71778C7D
MD5 SHA1 SHA512 TLSH

Submit Download

system-update

Path /etc/init.d/system-update
Size 219B
SHA256 477bf61f9e1fd395fed549ba499defb931b4d2ac08fd1995cae82aafe24ef466
MD5 aac68dc76250db4d89678f1bff8eb4ef
SHA1 f459b173e0a906028edb0bf41b869da5da08c94d
SHA512 d3ade0e7a62f3542688f256dba0b5c89867edda43234c23b33a5e5ae6c1e13655170f3a7c98bb01b3bcb9aa5320ea517562940b532286516529c9beab34496aa
TLSH
T18AD01251E255D6306F1B85FC970A326BC86025171621BC107FCE5BC7EF129635279A74
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-update

Path /etc/init.d/systemd-update
Size 492B
SHA256 7e4a07ca9db1b15988864c0b230256d616701124f911e0b92f13c2df5436d1a7
MD5 5049a6c0d28ff0e362eafb67766998d3
SHA1 34c0dde115c7ccbecb655c7bb94739f262dfa1db
SHA512 30fcc259d6aeeb3105ecdd5b55a33683c95661d76c945ffde87eb2c0259517eca62d846e3bad91bf049c7b4e3ee6559896c9495a7fe5fcebc93fe15d358f7db7
TLSH
T139F05901A3C6FA38DF0B48D44711BB43A465510B2212A815F5DE27D28F56B8356B8C78
MD5 SHA1 SHA512 TLSH

Submit Download

bot-update.service

Path /etc/systemd/system/bot-update.service
Size 194B
SHA256 e2e271543855504eefcce8105ef01fb452f09f9949ab7fc13b51ff4596ffc63b
MD5 91a421186741476b94cd9ee8b0c978a9
SHA1 4efd57787991ea94a56f70d614ef3d5187f34125
SHA512 533252e22e1ab159a1a2068f981b1737434fef9a4cf5754e0efc376d91a5f83a9041b8d9f45d9988c0d9c0ab63da45158b95a3a68c49f50099cc592fe268876b
TLSH
T137C0222297A1A0B1C90A3CB68EA26B108E2011442B8EF0200FC11085C0D09470234DBD
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-update.service

Path /etc/systemd/system/systemd-update.service
Size 269B
SHA256 798e7460076a7c18bd9596532c27ea94ff2f8bc174a2bb9b947534d5341e9157
MD5 fb3bed58865b807fb9de578577a59f73
SHA1 cb9e075415d7a283c281ea1a3d750a1b81500c15
SHA512 cdce84ef4fc006cbed82624a79c68080b45b56bb530aaf0b6c890ecdb36de8a0a3cec281eec5426c5ee423850178b0710b4695206192ae141ef318be96412bca
TLSH
T1E7D02B12ABA664F5861A3DA49E936B408D543001274BB13C1FD529C5A9E194751349BE
MD5 SHA1 SHA512 TLSH

Submit Download

.cron

Path /tmp/.cron
Size 86B
SHA256 b8d421c20e7f52ffde0c79f50ac013cfede505db85f78ea4b0a3ab25262087c5
MD5 03c5fcb50a1afa1a83619d11b61b2e1d
SHA1 36bc7d90a6ff717036560d75f062a248322b1f35
SHA512 999b08968fce88bedec537cf7127409841d09799bc3e2c4103c44bc15d2a012baa0ddb2c969a4fb26ffad77ad7662eb9c71adecc76e5deeba3853dbb1cbc53d5
TLSH
T144A00234D7CEE671D1157CF410043D1484B43450338165001CCD50D1D115FA20739C75
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-update

Path /usr/lib/systemd/systemd-update
Size 5.7MB
SHA256 d6d1df115bb0db2525b86ca09a157de77af91d2717de0aa634e088b90e7c7778
MD5 9963f20f79c8e9fd1d301ae083073712
SHA1 d40e1daaeadf615f176ad9e264e33ba80923f618
SHA512 856833a77d7e54c0aff2ad711eea3bd244ec80acd74990b299f6d15618cc55d58b49d7650dc2ed8f2e612287e0e605c2d4152946dab8adf7ee0bac83507eadf8
SSDEEP 24576:CH0HtY7g+QIYXIv8Qeg1k481UX2YY//OMtj2oMeZyh9ba1ACwvHzEjdF5OtjwZvp:C8IAhb+oI0L2VaKjiGyToyJMx8p5E2
TLSH
T156561897B9925942C4E43A77BCBD81C833630EBA9BC652566D04FE3C3ABE1D90E35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.Z6g1zM

Path /var/spool/cron/crontabs/tmp.Z6g1zM
Size 270B
SHA256 ebf3d2f7f93c107512432c5bf7f0bf3c8f092cb4a70beaaae214993f6e2a5402
MD5 b0563381789325cedf10815e97609563
SHA1 f4542f15e20da511c9cb22b8077be3ef8a4f757c
SHA512 5e7efc993d6da72839120680d07d03ee74a0b4e87f3cf8735a43b0ed41cb5eda90d2253db3d6c00d7499f0fc987ea1699dd2203e93b966a0ce87ad4e1cecd5a5
TLSH
T164D09539FF80B93155052BC5100D3D1CC8D0B075E6495D01D4CD10E0C217F652F30C71
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads