Analysis
- max time kernel
147s - max time network
141s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
22/10/2026, 17:15
Static task
static1
Behavioral task
behavioral1
Sample
kushnet.arm7.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
5 signatures
150 seconds
General
- Target kushnet.arm7.elf
- Size 201KB
- Sample261022-vs3prsgv6q
- SHA256 393d58259a307bf92d0ff3e48e132e0446cef2cfdacc161c41e80074a3e09c1a
- MD5 eb3bd25d8ff2405d10976352aca04411
- SHA1 3a25f745c3b55b2c57185b624ce56f84f0b61bc2
- SHA512 125c9e881c22c063698bbe6897df292878016388a8e0144ccf29c91a05829267bb7c158ca3935804192fed24ccc6a1f0277d8c870d6475d0e93741caefb3cb1e
- SSDEEP 3072:ny27USVO4S0b+0ml2CJtphk17ktZ+Uppjl7Oho4RVkmbW8iapUq3D:ygUS4v0b+0mlR/nR7OhdRTq8iapUq3D
- TLSH T1F8141946F942CE52F58015F9FB5D83C83B1313F7C2FA75129D0A4BB82B9795A0E3A942
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.d/ksync kushnet.arm7.elf - Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/S99ksync kushnet.arm7.elf - Changes its process name 38 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ksoftirqd/0 788 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself migration/0 791 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/0:0 793 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself rcu_sched 794 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/u8:0 795 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kdevtmpfs 796 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/0:1 799 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/0:0 798 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/0:2 800 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/0:3 801 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/0:4 802 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/0:5 803 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/0:6 804 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/0:7 805 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/1:0 806 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/1:1 807 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/1:2 808 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/1:3 809 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/1:4 810 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/1:5 811 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/1:6 812 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/1:7 813 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/2:0 814 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/2:1 815 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/2:2 816 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/2:3 817 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/2:4 818 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/2:5 819 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/2:6 820 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/2:7 821 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/3:0 822 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/3:1 823 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/3:2 825 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/3:3 826 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/3:4 827 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/3:5 828 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/3:6 829 kushnet.arm7.elf Changes the process name, possibly in an attempt to hide itself kworker/3:7 830 kushnet.arm7.elf -
description ioc Process File opened for reading /proc/25/mounts kushnet.arm7.elf File opened for reading /proc/29/mounts kushnet.arm7.elf File opened for reading /proc/31/mounts kushnet.arm7.elf File opened for reading /proc/35/mounts kushnet.arm7.elf File opened for reading /proc/56/mounts kushnet.arm7.elf File opened for reading /proc/filesystems systemctl File opened for reading /proc/27/mounts kushnet.arm7.elf File opened for reading /proc/2/mounts kushnet.arm7.elf File opened for reading /proc/6/mounts kushnet.arm7.elf File opened for reading /proc/10/mounts kushnet.arm7.elf File opened for reading /proc/20/mounts kushnet.arm7.elf File opened for reading /proc/28/mounts kushnet.arm7.elf File opened for reading /proc/36/mounts kushnet.arm7.elf File opened for reading /proc/44/mounts kushnet.arm7.elf File opened for reading /proc/self/exe kushnet.arm7.elf File opened for reading /proc/8/mounts kushnet.arm7.elf File opened for reading /proc/12/mounts kushnet.arm7.elf File opened for reading /proc/23/mounts kushnet.arm7.elf File opened for reading /proc/57/mounts kushnet.arm7.elf File opened for reading /proc/73/mounts kushnet.arm7.elf File opened for reading /proc/193/mounts kushnet.arm7.elf File opened for reading /proc/1/mounts kushnet.arm7.elf File opened for reading /proc/16/mounts kushnet.arm7.elf File opened for reading /proc/18/mounts kushnet.arm7.elf File opened for reading /proc/46/mounts kushnet.arm7.elf File opened for reading /proc/4/mounts kushnet.arm7.elf File opened for reading /proc/15/mounts kushnet.arm7.elf File opened for reading /proc/26/mounts kushnet.arm7.elf File opened for reading /proc/30/mounts kushnet.arm7.elf File opened for reading /proc/45/mounts kushnet.arm7.elf File opened for reading /proc/24/mounts kushnet.arm7.elf File opened for reading /proc/5/mounts kushnet.arm7.elf File opened for reading /proc/9/mounts kushnet.arm7.elf File opened for reading /proc/13/mounts kushnet.arm7.elf File opened for reading /proc/14/mounts kushnet.arm7.elf File opened for reading /proc/33/mounts kushnet.arm7.elf File opened for reading /proc/34/mounts kushnet.arm7.elf File opened for reading /proc/7/mounts kushnet.arm7.elf File opened for reading /proc/11/mounts kushnet.arm7.elf File opened for reading /proc/19/mounts kushnet.arm7.elf File opened for reading /proc/21/mounts kushnet.arm7.elf File opened for reading /proc/42/mounts kushnet.arm7.elf File opened for reading /proc/51/mounts kushnet.arm7.elf File opened for reading /proc/142/mounts kushnet.arm7.elf File opened for reading /proc/17/mounts kushnet.arm7.elf File opened for reading /proc/22/mounts kushnet.arm7.elf File opened for reading /proc/32/mounts kushnet.arm7.elf File opened for reading /proc/143/mounts kushnet.arm7.elf File opened for reading /proc/3/mounts kushnet.arm7.elf
Processes
-
/tmp/kushnet.arm7.elf/tmp/kushnet.arm7.elf1⤵
- Creates/modifies Cron job
- Modifies init.d
- Changes its process name
- Reads runtime system information
PID:788 -
/bin/sh/bin/sh -c "update-rc.d S99ksync defaults 2>/dev/null || chkconfig --add S99ksync 2>/dev/null || insserv S99ksync 2>/dev/null"2⤵PID:797
-
/usr/sbin/update-rc.dupdate-rc.d S99ksync defaults3⤵PID:824
-
/bin/systemctlsystemctl daemon-reload4⤵
- Reads runtime system information
PID:845
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/cron.d/ksync
- Size 148B
- SHA256 6c80fcf8df75331fe4c04efe5e1f4558bfb22159d74cfae21838c861ed17b19b
- MD5 eb007f6ce8d09e3738d8b0e7a5e1898d
- SHA1 a136033e7fbc59fdc21524d5939b88f87a732724
- SHA512 5c2b517509c80267b0fe61dbebfb1656ac515c542381aaf54c37556dca886aa4341da823b898fa5ba937c4815af2c5bfac4a17d809e57d3a07272f0cb14ce0ad
- TLSH T1EDC08C389B5A263CB581FC9722041A1044803820AE66BE10C0D41491C91C3901228C68
- MD5 SHA1 SHA512 TLSH
- Path /etc/init.d/S99ksync
- Size 438B
- SHA256 7eaa783f3f47db771efd15bb7471d1f90ba86e1eba37df872aa5c938f094af40
- MD5 81ec1c516d7b3c2fe4ac7d40f7768094
- SHA1 e8bb7bd21e07b2d6c05910e0204ef39f33703d6f
- SHA512 f4b9fe758607a40bdda245c781cf3b8e1098f090d8e75ad84858a5da1a2c358d5e99cdad8d4119e5362ebd21249983d792934f08478b8df9bdf00b0c796c8091
- TLSH T1CBF0A381579EBE6EEA0808413440A782FCD7DB192518F419E0995991D1EF34EF0FAD74
- MD5 SHA1 SHA512 TLSH
- Path /root/KUSHNET.claimed
- Size 22B
- SHA256 76797708e7ecc4089fc3aef2dc1525680cd452b3b6843821a3de8fbd26eeb6de
- MD5 e422ab5c0618c4a58a9d9b26f7283c53
- SHA1 baff08a151720214cd130f99b9967acbd2088070
- SHA512 245e6c1df3c18b0db105d1d3c73509b8b8656ad688485ce26cf03953ff344eddae6b138139c3371f7e619f38de13fa80cb2f28cf4569209b2270aaacf6f826fb
- MD5 SHA1 SHA512