fbbaf70adb554b54af4ac4297affab842455a7a911eee631801e3094029816c8

Analysis

max time kernel
151s
max time network
154s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
12/10/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
109.123.243.121_sample.bin
Size 6.3MB
Sample261012-vdv2dat18p
SHA256 fbbaf70adb554b54af4ac4297affab842455a7a911eee631801e3094029816c8
MD5 3f02a5eeb4ccfa539c2b7059d2bc6c40
SHA1 818ff47c422172ec8ffb6854c099bfa4ed84c5c2
SHA512 cec57091dac196d3b6bb15a6265281e80dba8884037fa7a6a444367945b74eb0ddc501f4129a6a1e8b50c37273f5e78bba41a469fadd7759598d9cbcb8a3b0e7
SSDEEP 49152:k+CyaFAfKkrZQNhuEWQS3U18yGMWWtydxaM16yz82D5EL:0IEzPzmWeNQyz821EL
TLSH
T15966F915AD842BEAC46C4B7544FAC95A23705D140AF14B3A26A4FFEDBC762787F0788C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 4 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.oEnKyc	crontab
File opened for modification	/etc/cron.d/system-update	109.123.243.121_sample.bin
File opened for modification	/etc/crontab	109.123.243.121_sample.bin
File opened for modification	/etc/cron.d/systemd-update	109.123.243.121_sample.bin

Modifies init.d 2 TTPs 2 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/system-update	109.123.243.121_sample.bin
File opened for modification	/etc/init.d/systemd-update	109.123.243.121_sample.bin

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/systemd-update.service	109.123.243.121_sample.bin
File opened for modification	/etc/systemd/system/bot-update.service	109.123.243.121_sample.bin

Command and Scripting Interpreter: Unix Shell 1 TTPs 2 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
831	sh
920	sh

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	109.123.243.121_sample.bin
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	109.123.243.121_sample.bin

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/meminfo	109.123.243.121_sample.bin
File opened for reading	/proc/self/mountinfo	109.123.243.121_sample.bin
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/cgroup	109.123.243.121_sample.bin
File opened for reading	/proc/self/status	109.123.243.121_sample.bin
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.cron	109.123.243.121_sample.bin

/tmp/109.123.243.121_sample.bin
/tmp/109.123.243.121_sample.bin
1⤵
- Creates/modifies Cron job
- Modifies init.d
- Modifies systemd
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:799
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:829
- /bin/sh
  /bin/sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable systemd-update.service 2>/dev/null; systemctl restart systemd-update.service 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:831
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:835
- - /usr/bin/systemctl
    systemctl enable systemd-update.service
    3⤵
    - Reads runtime system information
    PID:866
- - /usr/bin/systemctl
    systemctl restart systemd-update.service
    3⤵
    - Reads runtime system information
    PID:906
- /usr/bin/crontab
  crontab /tmp/.cron
  2⤵
  - Creates/modifies Cron job
  PID:832
- /usr/bin/systemctl
  systemctl enable bot-update.service
  2⤵
  - Reads runtime system information
  PID:838
- /usr/bin/systemctl
  systemctl start bot-update.service
  2⤵
  - Reads runtime system information
  PID:885
- /usr/sbin/update-rc.d
  update-rc.d system-update defaults
  2⤵
  PID:907
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:946
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:946
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:946
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads runtime system information
    PID:946
- /bin/sh
  /bin/sh -c "update-rc.d systemd-update defaults 2>/dev/null; rc-update add systemd-update 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:920
- - /usr/sbin/update-rc.d
    update-rc.d systemd-update defaults
    3⤵
    PID:924
  - - /usr/local/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:947
  - - /usr/local/bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:947
  - - /usr/sbin/systemctl
      systemctl daemon-reload
      4⤵
      PID:947
  - - /usr/bin/systemctl
      systemctl daemon-reload
      4⤵
      Reads runtime system information
      PID:947
- /usr/sbin/service
  service system-update start
  2⤵
  PID:988
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:989
- - /usr/bin/basename
    basename /usr/sbin/service
    3⤵
    PID:990
- - /usr/bin/sed
    sed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"
    3⤵
    - Reads runtime system information
    PID:993
- - /usr/bin/systemctl
    systemctl list-unit-files --full "--type=socket"
    3⤵
    - Reads runtime system information
    PID:992
- /usr/local/sbin/systemctl
  systemctl start system-update.service
  2⤵
  PID:988
- /usr/local/bin/systemctl
  systemctl start system-update.service
  2⤵
  PID:988
- /usr/sbin/systemctl
  systemctl start system-update.service
  2⤵
  PID:988
- /usr/bin/systemctl
  systemctl start system-update.service
  2⤵
  - Reads runtime system information
  PID:988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

system-update

Path /etc/cron.d/system-update
Size 95B
SHA256 c8e6c462f706ad0dc586447c3994987716f47dd1de7034f49114af9cbd124824
MD5 52009b396fb89c4e762927c40f64c200
SHA1 4cbdc08d4953b436e469145fdf630efdf84af0c7
SHA512 497493376364c0acf94e2f6352ecbd7d7b7d4e195ad9c60bd76d7aeb51d4fd11b40f483d8cc583f264d9880cce2b4ee60494108d2885af80e4feb867320b6dad
TLSH
T129B00234E78AA7319155FCE40004295484A534542381781018CD90D1D115A92062AC69
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-update

Path /etc/cron.d/systemd-update
Size 132B
SHA256 50c9c1fa373745481fe28cb62b4cff32e4cdc117ffc2e7f90a309e12e8c15095
MD5 0b0e82168d52c53ea73e930fbae2f66c
SHA1 afc94c82abb099ff8db4fac388bb2335d9b73875
SHA512 c20d97412651420c1fe74fe19716f65365fa7a19fb8fb09db06f56ecc07c357bc0aebee99e413e3b4b3956bce537bd2cba042fef9e86b75babfdc283bc9bafcc
TLSH
T106C09238D3CEBA79D2513CFA1200292981E834102F46BB0018ED70E2DA04FA71778C7D
MD5 SHA1 SHA512 TLSH

Submit Download

system-update

Path /etc/init.d/system-update
Size 219B
SHA256 477bf61f9e1fd395fed549ba499defb931b4d2ac08fd1995cae82aafe24ef466
MD5 aac68dc76250db4d89678f1bff8eb4ef
SHA1 f459b173e0a906028edb0bf41b869da5da08c94d
SHA512 d3ade0e7a62f3542688f256dba0b5c89867edda43234c23b33a5e5ae6c1e13655170f3a7c98bb01b3bcb9aa5320ea517562940b532286516529c9beab34496aa
TLSH
T18AD01251E255D6306F1B85FC970A326BC86025171621BC107FCE5BC7EF129635279A74
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-update

Path /etc/init.d/systemd-update
Size 492B
SHA256 7e4a07ca9db1b15988864c0b230256d616701124f911e0b92f13c2df5436d1a7
MD5 5049a6c0d28ff0e362eafb67766998d3
SHA1 34c0dde115c7ccbecb655c7bb94739f262dfa1db
SHA512 30fcc259d6aeeb3105ecdd5b55a33683c95661d76c945ffde87eb2c0259517eca62d846e3bad91bf049c7b4e3ee6559896c9495a7fe5fcebc93fe15d358f7db7
TLSH
T139F05901A3C6FA38DF0B48D44711BB43A465510B2212A815F5DE27D28F56B8356B8C78
MD5 SHA1 SHA512 TLSH

Submit Download

bot-update.service

Path /etc/systemd/system/bot-update.service
Size 194B
SHA256 e2e271543855504eefcce8105ef01fb452f09f9949ab7fc13b51ff4596ffc63b
MD5 91a421186741476b94cd9ee8b0c978a9
SHA1 4efd57787991ea94a56f70d614ef3d5187f34125
SHA512 533252e22e1ab159a1a2068f981b1737434fef9a4cf5754e0efc376d91a5f83a9041b8d9f45d9988c0d9c0ab63da45158b95a3a68c49f50099cc592fe268876b
TLSH
T137C0222297A1A0B1C90A3CB68EA26B108E2011442B8EF0200FC11085C0D09470234DBD
MD5 SHA1 SHA512 TLSH

Submit Download

systemd-update.service

Path /etc/systemd/system/systemd-update.service
Size 269B
SHA256 798e7460076a7c18bd9596532c27ea94ff2f8bc174a2bb9b947534d5341e9157
MD5 fb3bed58865b807fb9de578577a59f73
SHA1 cb9e075415d7a283c281ea1a3d750a1b81500c15
SHA512 cdce84ef4fc006cbed82624a79c68080b45b56bb530aaf0b6c890ecdb36de8a0a3cec281eec5426c5ee423850178b0710b4695206192ae141ef318be96412bca
TLSH
T1E7D02B12ABA664F5861A3DA49E936B408D543001274BB13C1FD529C5A9E194751349BE
MD5 SHA1 SHA512 TLSH

Submit Download

.cron

Path /tmp/.cron
Size 86B
SHA256 b8d421c20e7f52ffde0c79f50ac013cfede505db85f78ea4b0a3ab25262087c5
MD5 03c5fcb50a1afa1a83619d11b61b2e1d
SHA1 36bc7d90a6ff717036560d75f062a248322b1f35
SHA512 999b08968fce88bedec537cf7127409841d09799bc3e2c4103c44bc15d2a012baa0ddb2c969a4fb26ffad77ad7662eb9c71adecc76e5deeba3853dbb1cbc53d5
TLSH
T144A00234D7CEE671D1157CF410043D1484B43450338165001CCD50D1D115FA20739C75
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.oEnKyc

Path /var/spool/cron/crontabs/tmp.oEnKyc
Size 270B
SHA256 0cc3dd1f2b65ac5c25902da43d137b4890d3704c0460b7ce21ae34bd6e32c432
MD5 c7ff312e4705e4a322189c770e944477
SHA1 f0d353891d435656d045c80d7ef015b2158f0024
SHA512 7ade100185e5777df1e5bf481cb455116ac45c74a11516abee614e1837d2cb8f47e3d9ba8dc062c8b5a80401c2e7a96a1f8c6fadf06af03851a9a167a01010d3
TLSH
T18AD02B29EB90A93155052AC510092D18C890B075A6495D0194CD10A0C217B562B20C75
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads