clingstun | 10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da

Analysis

max time kernel
148s
max time network
150s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
Size 69KB
Sample261027-g3rtcsby8r
SHA256 10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
MD5 5f8cf9aebdcffdc024465a8fcc6e1458
SHA1 228ee086f6f390b02f72ecdb69bae54cecf666ae
SHA512 778812dd8326724b8abb8bf837dbf34a155ef9e129fd19ba2d36f92c336c705436fdd6e945c845a733490d3fc4f13a2aeb92189fddf35fdcf9d20cd4ec1428cf
SSDEEP 1536:RTqIagNRSs5Y9TG+0S51+jGg9NIPBkh5SQUvrl:RTqE5Y97UjpIPBkh5+jl
TLSH
T1AB63184773108F51D67A823009F38766ABBA26D616E29146F36CDD007A7275CAC2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet defense_evasion discovery clingstun persistence

Malware Config

Signatures

Family: ClingSTUN
ClingSTUN is a Linux IoT botnet.
botnet clingstun

Detects CLingSTUN 1 IoCs

resource	yara_rule
behavioral1/files/fstream-2.dat	family_clingstun

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
726	sh
728	chmod
729	sh
731	chmod

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for modification	/dev/misc/watchdog	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da

Enumerates running processes
Discovers information about currently running processes on the system

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/.cling	cp

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself		711	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
Changes the process name, possibly in an attempt to hide itself		830	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/79/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/329/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/677/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/16/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/18/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/333/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/11/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/37/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/73/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/656/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/19/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/70/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/82/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/430/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/22/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/2/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/12/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/15/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/84/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/151/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/4/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/5/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/17/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/36/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/76/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/78/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/708/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/698/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/707/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1/statm	cp
File opened for reading	/proc/6/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/24/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/75/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/121/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/155/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/378/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/9/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/20/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/172/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/332/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/23/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/72/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/382/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/74/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/671/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/709/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/1/stat	cp
File opened for reading	/proc/122/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/filesystems	mount
File opened for reading	/proc/14/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/13/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/21/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/700/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/705/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/1/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/3/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
File opened for reading	/proc/678/cmdline	10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/stat	cp
File opened for modification	/tmp/status	cp
File opened for modification	/tmp/cmdline	cp
File opened for modification	/tmp/statm	cp

/tmp/10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
/tmp/10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
1⤵
- Modifies Watchdog functionality
- Changes its process name
- Reads runtime system information
PID:710
- /bin/sh
  sh -c "cp /tmp/10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da /root/.cling"
  2⤵
  PID:713
- - /bin/cp
    cp /tmp/10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da /root/.cling
    3⤵
    - Reads runtime system information
    PID:715
- /bin/sh
  sh -c "cp /tmp/10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da /usr/local/bin/.cling"
  2⤵
  PID:717
- - /bin/cp
    cp /tmp/10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da /usr/local/bin/.cling
    3⤵
    - Write file to user bin folder
    - Reads runtime system information
    PID:720
- /bin/sh
  sh -c "chmod +x /root/.cling"
  2⤵
  - File and Directory Permissions Modification
  PID:726
- - /bin/chmod
    chmod +x /root/.cling
    3⤵
    - File and Directory Permissions Modification
    PID:728
- /bin/sh
  sh -c "chmod +x /usr/local/bin/.cling"
  2⤵
  - File and Directory Permissions Modification
  PID:729
- - /bin/chmod
    chmod +x /usr/local/bin/.cling
    3⤵
    - File and Directory Permissions Modification
    PID:731
- /bin/sh
  sh -c "cp /proc/1/stat /tmp/stat"
  2⤵
  PID:733
- - /bin/cp
    cp /proc/1/stat /tmp/stat
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:735
- /bin/sh
  sh -c "cp /proc/1/status /tmp/status"
  2⤵
  PID:737
- - /bin/cp
    cp /proc/1/status /tmp/status
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:739
- /bin/sh
  sh -c "cp /proc/1/cmdline /tmp/cmdline"
  2⤵
  PID:741
- - /bin/cp
    cp /proc/1/cmdline /tmp/cmdline
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:743
- /bin/sh
  sh -c "cp /proc/1/statm /tmp/statm"
  2⤵
  PID:744
- - /bin/cp
    cp /proc/1/statm /tmp/statm
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:745
- /bin/sh
  sh -c "mount --bind /tmp /proc/711"
  2⤵
  PID:747
- - /bin/mount
    mount --bind /tmp /proc/711
    3⤵
    - Reads runtime system information
    PID:748
- /bin/sh
  sh -c "mount --bind /tmp /proc/830"
  2⤵
  PID:831
- - /bin/mount
    mount --bind /tmp /proc/830
    3⤵
    - Reads runtime system information
    PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.cling

Path /root/.cling
Size 69KB
SHA256 10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
MD5 5f8cf9aebdcffdc024465a8fcc6e1458
SHA1 228ee086f6f390b02f72ecdb69bae54cecf666ae
SHA512 778812dd8326724b8abb8bf837dbf34a155ef9e129fd19ba2d36f92c336c705436fdd6e945c845a733490d3fc4f13a2aeb92189fddf35fdcf9d20cd4ec1428cf
SSDEEP 1536:RTqIagNRSs5Y9TG+0S51+jGg9NIPBkh5SQUvrl:RTqE5Y97UjpIPBkh5+jl
TLSH
T1AB63184773108F51D67A823009F38766ABBA26D616E29146F36CDD007A7275CAC2FFE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmdline

Path /tmp/cmdline
Size 11B
SHA256 6628c1ade33319fc12730a87856ccdb1e4eaed9a0aa2b0bce0535a97a232f272
MD5 88af90d1f18b944c6d2365f389b9bfe5
SHA1 9cb724a1fb906a66b81d24a84257e3cf69b69214
SHA512 254c37d06ebbff6b4e7c1ee2e354e142e7c8fc26c8b396712b875979de4234bc121225e765eb65d3008fa159488b245c0e30d613a9f99c90519f1b1b184178d4
MD5 SHA1 SHA512

Submit Download

stat

Path /tmp/stat
Size 259B
SHA256 990370bffa61d958697c0f5033dc86f94434aa9bc71132b01411068a50a0bad1
MD5 574a968a8d801c078fef949c82fb0562
SHA1 80d5f8ab402bd97bb11bc99444b29a464ce42aa5
SHA512 9176ba794149173156f01edd146f281fdfbbc7503e3676bee91cf2d7e13858c600b353d7968e5587c0b3d650d0c77e16670e78388fdce2088c75b4e148cc0226
TLSH
T198D02E2CC019065CFA2EDFCA810362C84B5CBFBF313608E7484CCB212387B08E263800
MD5 SHA1 SHA512 TLSH

Submit Download

statm

Path /tmp/statm
Size 27B
SHA256 5718799b8f2e1bb9b2f6ce382e64d53b24573e32a57bde966f05e29e59c8772c
MD5 fabc9d01a0bb4fa0e73eb352b3caeb9d
SHA1 2e11c109f61edbd2e61b2622ea8eb6b33adb689d
SHA512 07a73efb09070c4c1c6ded48b6056d078f05ba059424d8500217e946a4887ed53ddb40bc7812944e61be178bc2edba888936918340a8ec8531b15a472321c7b5
MD5 SHA1 SHA512

Submit Download

status

Path /tmp/status
Size 1KB
SHA256 01099f8a5d411f297fcdcc669664323898a6449ee4c00182adc5959db9162c50
MD5 0d50eb0e2a437e141f946d7fc506b4e1
SHA1 4dbd1d79ff78d2e70f2cebc6bab7386666b9ba7c
SHA512 11186a403cfcdf35d0ab4504773ad5483842879be4fc0203a57eb3e773e4c29f65948301996cc98d2892d93602ebfc2f8b2172575451ae533c1d4963b127e511
TLSH
T1BD1159118FD7AC94DABE8349047AF4006074F22968D06131318DC87CBB3729F9798CD4
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads