eee4ac11b0d5d301b3e42cfd8ae1eeb91e13eb4283d2e1cba1dbbdcaf263c480

Analysis

max time kernel
152s
max time network
133s
platform
debian-12_mipsel
resource
debian12-mipsel-20260513-en
resource tags

arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
18/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mipsel
Size 3.3MB
Sample261018-ppsshacw2r
SHA256 eee4ac11b0d5d301b3e42cfd8ae1eeb91e13eb4283d2e1cba1dbbdcaf263c480
MD5 98eac7a7c6c69dd1e519b696632f7598
SHA1 f9e5ee236e7c6718ec6fcd5e84562c0655053e6b
SHA512 a5f86288e8be56f71dfc23486e50723638f982296a2608d686fa595b0c4fba3c43c3a9df48ec8710e1a959b6935fc2788bc71133b0354e92ae50df0f3c0c6508
SSDEEP 49152:sd+gDlvZUeFxbFJ3T3+/I2pN6u1nejRS:s/DlvZUeXFJMI2xny
TLSH
T12FF52A167F049FFBC41CCF704EBDC706C06CAD92D5F555267668878DB9AA3022B13AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Bcljji	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 5 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	antidbg	812	mipsel
Changes the process name, possibly in an attempt to hide itself	locker	813	mipsel
Changes the process name, possibly in an attempt to hide itself	killer	814	mipsel
Changes the process name, possibly in an attempt to hide itself	scan-telnet	815	mipsel
Changes the process name, possibly in an attempt to hide itself	scan-banner	816	mipsel

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/system.slice/agent.service/cpu.max	mipsel
File opened for reading	/sys/fs/cgroup/system.slice/cpu.max	mipsel
File opened for reading	/sys/fs/cgroup/cpu.max	mipsel

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/830/cmdline	mipsel
File opened for reading	/proc/2/cmdline	mipsel
File opened for reading	/proc/387/status	mipsel
File opened for reading	/proc/800/fd	mipsel
File opened for reading	/proc/835/cmdline	mipsel
File opened for reading	/proc/37/cmdline	mipsel
File opened for reading	/proc/768/fd	mipsel
File opened for reading	/proc/824/status	mipsel
File opened for reading	/proc/838/fd	mipsel
File opened for reading	/proc/848/fd	mipsel
File opened for reading	/proc/387/fd	mipsel
File opened for reading	/proc/27/cmdline	mipsel
File opened for reading	/proc/374/fd	mipsel
File opened for reading	/proc/819/cmdline	mipsel
File opened for reading	/proc/822/cmdline	mipsel
File opened for reading	/proc/meminfo	mipsel
File opened for reading	/proc/864/status	mipsel
File opened for reading	/proc/755/cmdline	mipsel
File opened for reading	/proc/351/cmdline	mipsel
File opened for reading	/proc/355/status	mipsel
File opened for reading	/proc/671/status	mipsel
File opened for reading	/proc/mounts	mipsel
File opened for reading	/proc/10/cmdline	mipsel
File opened for reading	/proc/822/fd	mipsel
File opened for reading	/proc/824/fd	mipsel
File opened for reading	/proc/374/cmdline	mipsel
File opened for reading	/proc/180/status	mipsel
File opened for reading	/proc/388/fd	mipsel
File opened for reading	/proc/768/status	mipsel
File opened for reading	/proc/843/cmdline	mipsel
File opened for reading	/proc/863/status	mipsel
File opened for reading	/proc/865/cmdline	mipsel
File opened for reading	/proc/22/cmdline	mipsel
File opened for reading	/proc/793/cmdline	mipsel
File opened for reading	/proc/28/cmdline	mipsel
File opened for reading	/proc/831/status	mipsel
File opened for reading	/proc/34/cmdline	mipsel
File opened for reading	/proc/694/status	mipsel
File opened for reading	/proc/845/status	mipsel
File opened for reading	/proc/847/fd	mipsel
File opened for reading	/proc/858/cmdline	mipsel
File opened for reading	/proc/858/status	mipsel
File opened for reading	/proc/138/cmdline	mipsel
File opened for reading	/proc/820/cmdline	mipsel
File opened for reading	/proc/840/cmdline	mipsel
File opened for reading	/proc/844/cmdline	mipsel
File opened for reading	/proc/867/cmdline	mipsel
File opened for reading	/proc/44/cmdline	mipsel
File opened for reading	/proc/53/cmdline	mipsel
File opened for reading	/proc/761/cmdline	mipsel
File opened for reading	/proc/774/cmdline	mipsel
File opened for reading	/proc/382/fd	mipsel
File opened for reading	/proc/827/cmdline	mipsel
File opened for reading	/proc/840/fd	mipsel
File opened for reading	/proc/851/cmdline	mipsel
File opened for reading	/proc/180/cmdline	mipsel
File opened for reading	/proc/387/cmdline	mipsel
File opened for reading	/proc/826/cmdline	mipsel
File opened for reading	/proc/832/cmdline	mipsel
File opened for reading	/proc/852/fd	mipsel
File opened for reading	/proc/851/status	mipsel
File opened for reading	/proc/26/cmdline	mipsel
File opened for reading	/proc/29/cmdline	mipsel
File opened for reading	/proc/797/cmdline	mipsel

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
807	mipsel

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.sys-cron-807	mipsel

/tmp/mipsel
/tmp/mipsel
1⤵
- Changes its process name
- Enumerates kernel/hardware configuration
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:807
- /usr/local/sbin/crontab
  crontab -l
  2⤵
  PID:821
- /usr/local/bin/crontab
  crontab -l
  2⤵
  PID:821
- /usr/sbin/crontab
  crontab -l
  2⤵
  PID:821
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:821
- /usr/local/sbin/crontab
  crontab -l
  2⤵
  PID:827
- /usr/local/bin/crontab
  crontab -l
  2⤵
  PID:827
- /usr/sbin/crontab
  crontab -l
  2⤵
  PID:827
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:827
- /usr/local/sbin/crontab
  crontab /tmp/.sys-cron-807
  2⤵
  PID:832
- /usr/local/bin/crontab
  crontab /tmp/.sys-cron-807
  2⤵
  PID:832
- /usr/sbin/crontab
  crontab /tmp/.sys-cron-807
  2⤵
  PID:832
- /usr/bin/crontab
  crontab /tmp/.sys-cron-807
  2⤵
  - Creates/modifies Cron job
  PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.sys-cron-807

Path /tmp/.sys-cron-807
Size 31B
SHA256 43d14f6105d6453a1942ed6e3e05b86688a70f1aa30748ae282186d577da419b
MD5 82694d67553d45cc28e08bfec4468ec4
SHA1 8efab8934461fc3404bafbfa7137b05379ad8fb4
SHA512 4da5c53ad14bc57c7ce162d56aecfd1372a900da74bc232126800ad2af776580caeef0c8f20b7e1d0f8dbab6bc370ef0bcb8ae59da2a3c78c827277abf1188dc
MD5 SHA1 SHA512

Submit Download

tmp.Bcljji

Path /var/spool/cron/crontabs/tmp.Bcljji
Size 223B
SHA256 e62dda26d994de83a9850b31a844cd3d1f501413b9a6cc1ef5f3d6727ae7fb78
MD5 26e8d19fa4e0f4118ac27a1957ee45de
SHA1 51663a02d024766bb25f7578d02e686414803fba
SHA512 f912e707ffe471f5b53ad307ee8a319fe04b592ce0b73d13a4c4a9fbff55e106184cdfc6998ce6fc62314e158272594c7333cb023c20a7542a34d09be6e8b114
TLSH
T1FDD0230E7FB0353515851BCD513E052D68C1E439946DDD00E18D7474811638F7F51D71
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads