Analysis
- max time kernel
147s - max time network
141s - platform
debian-12_armhf - resource
debian12-armhf-20260513-en - resource tags
arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem - submitted
22/10/2026, 17:16
Static task
static1
Behavioral task
behavioral1
Sample
kushnet.arm6.elf
Resource
debian12-armhf-20260513-en
debian-12-armhf
5 signatures
150 seconds
General
- Target kushnet.arm6.elf
- Size 201KB
- Sample261022-vs4xtsdz4t
- SHA256 ff21f897c1e352f23d53a7c12932644ac59bca64688f101498f8a6838dfdf460
- MD5 af8b6b04facd5e4dbea4ff4bb2f3ec0a
- SHA1 f2cf20ca6bb073f5f95d731f74b346c89f07b369
- SHA512 c91a63db16fbde810583aa8597969aff72caad01a03b58ff08f8afd5d9fac5306094ffafa5914618fcb16a35fb3b01f4e06f3015214cf6bcc834818d674c18bb
- SSDEEP 6144:yQi+09ie++MVs1luRw2PJUQ7kb8JO5Uq4:w5iB+MVsew6UD8U5U
- TLSH T1DB141A4AF9418E51F58012FAFB5D82D83F1313FBC2FA7502DD195BB4279B85A0E3A942
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /etc/cron.d/ksync kushnet.arm6.elf - Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/S99ksync kushnet.arm6.elf - Changes its process name 38 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself ksoftirqd/0 780 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself migration/0 782 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/0:0 783 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself rcu_sched 784 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/u8:0 785 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kdevtmpfs 786 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/0:0 787 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/0:1 788 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/0:2 789 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/0:3 790 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/0:4 792 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/0:5 793 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/0:6 794 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/0:7 795 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/1:0 796 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/1:1 797 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/1:2 798 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/1:3 799 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/1:4 800 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/1:5 801 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/1:6 802 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/1:7 803 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/2:0 804 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/2:1 805 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/2:2 806 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/2:3 808 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/2:4 809 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/2:5 810 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/2:6 811 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/2:7 812 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/3:0 813 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/3:1 814 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/3:2 815 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/3:3 816 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/3:4 817 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/3:5 818 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/3:6 820 kushnet.arm6.elf Changes the process name, possibly in an attempt to hide itself kworker/3:7 821 kushnet.arm6.elf -
description ioc Process File opened for reading /proc/self/exe kushnet.arm6.elf File opened for reading /proc/10/mounts kushnet.arm6.elf File opened for reading /proc/12/mounts kushnet.arm6.elf File opened for reading /proc/18/mounts kushnet.arm6.elf File opened for reading /proc/21/mounts kushnet.arm6.elf File opened for reading /proc/24/mounts kushnet.arm6.elf File opened for reading /proc/25/mounts kushnet.arm6.elf File opened for reading /proc/31/mounts kushnet.arm6.elf File opened for reading /proc/8/mounts kushnet.arm6.elf File opened for reading /proc/5/mounts kushnet.arm6.elf File opened for reading /proc/17/mounts kushnet.arm6.elf File opened for reading /proc/26/mounts kushnet.arm6.elf File opened for reading /proc/34/mounts kushnet.arm6.elf File opened for reading /proc/15/mounts kushnet.arm6.elf File opened for reading /proc/27/mounts kushnet.arm6.elf File opened for reading /proc/1/mounts kushnet.arm6.elf File opened for reading /proc/9/mounts kushnet.arm6.elf File opened for reading /proc/20/mounts kushnet.arm6.elf File opened for reading /proc/33/mounts kushnet.arm6.elf File opened for reading /proc/filesystems systemctl File opened for reading /proc/3/mounts kushnet.arm6.elf File opened for reading /proc/4/mounts kushnet.arm6.elf File opened for reading /proc/7/mounts kushnet.arm6.elf File opened for reading /proc/16/mounts kushnet.arm6.elf File opened for reading /proc/22/mounts kushnet.arm6.elf File opened for reading /proc/32/mounts kushnet.arm6.elf File opened for reading /proc/6/mounts kushnet.arm6.elf File opened for reading /proc/11/mounts kushnet.arm6.elf File opened for reading /proc/13/mounts kushnet.arm6.elf File opened for reading /proc/14/mounts kushnet.arm6.elf File opened for reading /proc/19/mounts kushnet.arm6.elf File opened for reading /proc/29/mounts kushnet.arm6.elf File opened for reading /proc/2/mounts kushnet.arm6.elf File opened for reading /proc/23/mounts kushnet.arm6.elf File opened for reading /proc/28/mounts kushnet.arm6.elf File opened for reading /proc/30/mounts kushnet.arm6.elf
Processes
-
/tmp/kushnet.arm6.elf/tmp/kushnet.arm6.elf1⤵
- Creates/modifies Cron job
- Modifies init.d
- Changes its process name
- Reads runtime system information
PID:780 -
/bin/sh/bin/sh -c "update-rc.d S99ksync defaults 2>/dev/null || chkconfig --add S99ksync 2>/dev/null || insserv S99ksync 2>/dev/null"2⤵PID:791
-
/usr/sbin/update-rc.dupdate-rc.d S99ksync defaults3⤵PID:822
-
/bin/systemctlsystemctl daemon-reload4⤵
- Reads runtime system information
PID:836
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Boot or Logon Initialization Scripts
1RC Scripts
1Scheduled Task/Job
1Cron
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/cron.d/ksync
- Size 148B
- SHA256 6c80fcf8df75331fe4c04efe5e1f4558bfb22159d74cfae21838c861ed17b19b
- MD5 eb007f6ce8d09e3738d8b0e7a5e1898d
- SHA1 a136033e7fbc59fdc21524d5939b88f87a732724
- SHA512 5c2b517509c80267b0fe61dbebfb1656ac515c542381aaf54c37556dca886aa4341da823b898fa5ba937c4815af2c5bfac4a17d809e57d3a07272f0cb14ce0ad
- TLSH T1EDC08C389B5A263CB581FC9722041A1044803820AE66BE10C0D41491C91C3901228C68
- MD5 SHA1 SHA512 TLSH
- Path /etc/init.d/S99ksync
- Size 438B
- SHA256 7eaa783f3f47db771efd15bb7471d1f90ba86e1eba37df872aa5c938f094af40
- MD5 81ec1c516d7b3c2fe4ac7d40f7768094
- SHA1 e8bb7bd21e07b2d6c05910e0204ef39f33703d6f
- SHA512 f4b9fe758607a40bdda245c781cf3b8e1098f090d8e75ad84858a5da1a2c358d5e99cdad8d4119e5362ebd21249983d792934f08478b8df9bdf00b0c796c8091
- TLSH T1CBF0A381579EBE6EEA0808413440A782FCD7DB192518F419E0995991D1EF34EF0FAD74
- MD5 SHA1 SHA512 TLSH
- Path /root/KUSHNET.claimed
- Size 22B
- SHA256 76797708e7ecc4089fc3aef2dc1525680cd452b3b6843821a3de8fbd26eeb6de
- MD5 e422ab5c0618c4a58a9d9b26f7283c53
- SHA1 baff08a151720214cd130f99b9967acbd2088070
- SHA512 245e6c1df3c18b0db105d1d3c73509b8b8656ad688485ce26cf03953ff344eddae6b138139c3371f7e619f38de13fa80cb2f28cf4569209b2270aaacf6f826fb
- MD5 SHA1 SHA512