9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Analysis

max time kernel
149s
max time network
152s
platform
debian-12_armhf
resource
debian12-armhf-20260513-en
resource tags

arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
27/10/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
Size 78KB
Sample261027-w91r6sf14p
SHA256 9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
MD5 b7f6f9a61bae453c92a998565a7394f5
SHA1 84bbe60bc88e7f206c73593b0d42480d7a519196
SHA512 00b1dbd9e9d51ed136e5a6e3524448c5145d1406d17a0f7cce1efa0a8bd558f0818c306c78958babc066ced3c8eee6d3e9b2f4bec69eeec5303dd3c646367859
SSDEEP 1536:tJZSoqQOJLV7+tcw67TtbDtyJAyK84Qqdiy1Y481+Qu7Ys+iLI:gJLV7+iw8gAZkkn1197YSLI
TLSH
T113831285E791AC7387E10422DD8EDD6D7E2DBCF098B424BFC3297B99E0B28835638515
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

antivm defense_evasion discovery exection execution persistence privilege_escalation upx

Malware Config

Signatures

Modifies the dynamic linker configuration file 2 TTPs 1 IoCs

Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.

exection persistence privilege_escalation defense_evasion

Shared Modules

T1129

Dynamic Linker Hijacking

T1574.006

description	ioc	Process
File opened for modification	/etc/ld.so.preload	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Deletes itself 1 IoCs

pid	Process
798	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Deletes journal logs 1 TTPs 3 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3/[email protected]~	journalctl
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3/system@f0c195da93044614a2f315fc6fbb78a7-0000000000000380-000651b53be5b4e7.journal	journalctl
File deleted	/var/log/journal/65779e181e584f059cb9deb1099989c3/system@f0c195da93044614a2f315fc6fbb78a7-0000000000000649-00065ed6bf13ab2e.journal	journalctl

Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/killer-helper	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for modification	/etc/cron.d/sys-network-helper	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Deletes log files 1 TTPs 4 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/btmp	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File truncated	/var/log/lastlog	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File truncated	/var/log/faillog	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File truncated	/var/log/wtmp	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/killer-helper.service	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for modification	/etc/systemd/system/sys-network-helper.service	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-6.dat	upx

Changes its process name 10 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	orimhhh	798	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
Changes the process name, possibly in an attempt to hide itself	orimhhh	798	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
Changes the process name, possibly in an attempt to hide itself	[kworker/0:5]	801	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	806	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	807	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	807	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
Changes the process name, possibly in an attempt to hide itself	[kworker/0:2]	808	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	806	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
Changes the process name, possibly in an attempt to hide itself	[kworker/0:3]	913	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
Changes the process name, possibly in an attempt to hide itself	[kworker/0:4]	914	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/net/tcp6	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Command and Scripting Interpreter: Unix Shell 1 TTPs 3 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
827	sh
907	sh
916	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/836/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/894/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/914/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/4/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/32/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/56/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/833/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/840/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/922/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/923/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/932/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/19/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/26/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/623/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/27/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/862/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/947/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/960/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/880/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/self/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/31/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/913/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/9/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/780/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/768/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/906/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/142/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/808/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/143/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/193/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/900/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/917/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/923/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/934/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/34/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/12/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/3/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/789/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/841/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/932/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/947/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/949/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/354/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/672/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/672/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/893/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/970/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/971/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/14/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/317/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/16/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/34/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/878/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/929/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/57/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/813/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/920/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/934/cmdline	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/837/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/860/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/986/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/6/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/73/comm	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for reading	/proc/623/exe	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.sh7f3a.tmp.808	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/ccY0Xfic.o	gcc
File opened for modification	/tmp/ccY0Xfic.o	as
File opened for modification	/tmp/cchcFqU0.res	gcc
File opened for modification	/tmp/ccc8SK6x.cdtor.c	collect2
File opened for modification	/tmp/ccgo8ksf.cdtor.o	collect2
File opened for modification	/tmp/.sh7f3a_ps.c	9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
File opened for modification	/tmp/cc17pNC2.s	gcc
File opened for modification	/tmp/cc17pNC2.s	cc1

/tmp/9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
/tmp/9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
1⤵
- Modifies the dynamic linker configuration file
- Deletes itself
- Modifies the /etc/hosts DNS resolution file
- Creates/modifies Cron job
- Deletes log files
- Enumerates active TCP sockets
- Modifies rc script
- Modifies systemd
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
- Writes file to shm directory
- Writes file to tmp directory
PID:787
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable killer-helper.service 2>/dev/null"
  2⤵
  PID:809
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:810
- - /usr/bin/systemctl
    systemctl enable killer-helper.service
    3⤵
    PID:833
- /bin/sh
  /bin/sh -c "systemctl daemon-reload 2>/dev/null;systemctl enable sys-network-helper 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:827
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:828
- - /usr/bin/systemctl
    systemctl enable sys-network-helper
    3⤵
    PID:849
- /bin/sh
  /bin/sh -c "gcc -shared -fPIC -nostartfiles -o /usr/lib/.sh7f3a.so /tmp/.sh7f3a_ps.c 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:907
- - /usr/bin/gcc
    gcc -shared -fPIC -nostartfiles -o /usr/lib/.sh7f3a.so /tmp/.sh7f3a_ps.c
    3⤵
    - Writes file to tmp directory
    PID:908
  - - /usr/lib/gcc/arm-linux-gnueabihf/12/cc1
      /usr/lib/gcc/arm-linux-gnueabihf/12/cc1 -quiet -imultilib . -imultiarch arm-linux-gnueabihf /tmp/.sh7f3a_ps.c -quiet -dumpdir /usr/lib/.sh7f3a.so- -dumpbase .sh7f3a_ps.c -dumpbase-ext .c "-mfloat-abi=hard" "-mtls-dialect=gnu" -mthumb "-mlibarch=armv7-a+fp" "-march=armv7-a+fp" -fPIC -o /tmp/cc17pNC2.s
      4⤵
      Writes file to tmp directory
      PID:909
  - - /usr/local/sbin/as
      as "-march=armv7-a+fp" "-mfloat-abi=hard" "-meabi=5" -o /tmp/ccY0Xfic.o /tmp/cc17pNC2.s
      4⤵
      PID:910
  - - /usr/local/bin/as
      as "-march=armv7-a+fp" "-mfloat-abi=hard" "-meabi=5" -o /tmp/ccY0Xfic.o /tmp/cc17pNC2.s
      4⤵
      PID:910
  - - /usr/sbin/as
      as "-march=armv7-a+fp" "-mfloat-abi=hard" "-meabi=5" -o /tmp/ccY0Xfic.o /tmp/cc17pNC2.s
      4⤵
      PID:910
  - - /usr/bin/as
      as "-march=armv7-a+fp" "-mfloat-abi=hard" "-meabi=5" -o /tmp/ccY0Xfic.o /tmp/cc17pNC2.s
      4⤵
      Writes file to tmp directory
      PID:910
  - - /usr/lib/gcc/arm-linux-gnueabihf/12/collect2
      /usr/lib/gcc/arm-linux-gnueabihf/12/collect2 -plugin /usr/lib/gcc/arm-linux-gnueabihf/12/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/12/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cchcFqU0.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -shared -X "--hash-style=gnu" --as-needed -m armelf_linux_eabi -o /usr/lib/.sh7f3a.so -L/usr/lib/gcc/arm-linux-gnueabihf/12 -L/usr/lib/gcc/arm-linux-gnueabihf/12/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/12/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccY0Xfic.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state
      4⤵
      Writes file to tmp directory
      PID:911
    - - /usr/bin/ld
        
        /usr/bin/ld -plugin /usr/lib/gcc/arm-linux-gnueabihf/12/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/arm-linux-gnueabihf/12/lto-wrapper" "-plugin-opt=-fresolution=/tmp/cchcFqU0.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -shared -X "--hash-style=gnu" --as-needed -m armelf_linux_eabi -o /usr/lib/.sh7f3a.so -L/usr/lib/gcc/arm-linux-gnueabihf/12 -L/usr/lib/gcc/arm-linux-gnueabihf/12/../../../arm-linux-gnueabihf -L/usr/lib/gcc/arm-linux-gnueabihf/12/../../.. -L/lib/arm-linux-gnueabihf -L/usr/lib/arm-linux-gnueabihf /tmp/ccY0Xfic.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state
        5⤵
        
        PID:912
- /bin/sh
  /bin/sh -c "journalctl --rotate --vacuum-time=1s 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:916
- - /usr/bin/journalctl
    journalctl --rotate "--vacuum-time=1s"
    3⤵
    - Deletes journal logs
    PID:917

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Scheduled Task/Job

T1053

Cron

T1053.003

Shared Modules

T1129

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

T1574.006

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

T1574.006

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

T1574.006

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.hosts.tmp.RrajwF

Path /etc/.hosts.tmp.RrajwF
Size 259B
SHA256 ba047d3f7cb6d3c74e016282ef9f3440b7c8d13d46d91ef65ba4fd4a6256280d
MD5 c93f958f2d78471baa2986ea8e35140d
SHA1 f6d6e03f3407c679d9249d570d38616428d43ce3
SHA512 44a9b08844ba452fd3170c66d966cc960175f5b9457ebcf32ab91082f6e7057c7651880d6918941b99c2cc389bf600b7b4f795da364673d9a197a932481d6bf4
TLSH
T158D05E9B2F03D9BB089392C47D2E50329902C1A201584EB69A29781B63BB6AD2975A30
MD5 SHA1 SHA512 TLSH

Submit Download

killer-helper

Path /etc/cron.d/killer-helper
Size 45B
SHA256 2401bba8cdbe1b2f259b6bac2acf553ddacea9e3f7e70dbc55a0edbec171794b
MD5 f1d1b650dd60a3e2931672c3e0b0f430
SHA1 e47298d538f1e5016259865a358ca9e2c7997e14
SHA512 460e32c1b093027db381305c5ef9d961f5012f0e3764751e2d139f9ec0d63d3e83290c76cf226c93b0632e99456935e806a242f5955e520781e1c29d1724cb1b
MD5 SHA1 SHA512

Submit Download

sys-network-helper

Path /etc/cron.d/sys-network-helper
Size 150B
SHA256 e7bb309ff17d69ef561d96ecc0ad135f9bab5469ba8191f7af6dccc2e6c37195
MD5 7dad917e963afdb347ea4141ade37d16
SHA1 01ccb9d9baefac0bcfadf8c9b83f19867db75b21
SHA512 003cfddb6440d28de84441bab81e10e667e0f70bffde9cb6946a13f3b74e2662b53dca7e32e05c01415c8553a3e773c392651987135a9381a85732785ef5f92e
TLSH
T181C04CE1D8A50C143066CCF55228A100B6C36D1DA8D5A740B0CF8471871D35BA335FB4
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path /etc/hosts
Size 789B
SHA256 c41661170949c85624995c68d22c1b1b052d52bb8d93be9020b703dce668bd80
MD5 aca4bf047b881cdba2409642cef30028
SHA1 a5dd006fffada791d3cedf8467f11b9c6d776bae
SHA512 8d59c35ece07b58f6171792efef17f7b6e3b68c2ad307833f19d943692120f392a40b198b416fe03a26ec5362f0e698b6620b2a443ddc5359572578c66c87d8d
TLSH
T1CE013953178EA6FCD91509BCC99FA658E95E436314DFFDC185217F7D814033E21960B1
MD5 SHA1 SHA512 TLSH

Submit Download

rc.local

Path /etc/rc.local
Size 34B
SHA256 39c3adba30914b4b1f783d4a6e064a69532f236ef273c9eb0dfdef32a9a7cefd
MD5 05cab4c3f2f96c111c0609bb6f26be3b
SHA1 d389462ae010015ea17f7d97cce38eb8c2ff486c
SHA512 c4b85e3ceb82a8b90af40f8c78739f7ce1c274d4c20a61b029019848fca762d38cdef0c44d1561016dba044d1c2cb1757a38c9632c8487c60f5216ae4bf7a59c
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 82B
SHA256 97d017afb74ffd6d4eed7a79ae899a03c546e5d99c85d0ed79fcdce7aebbd7e1
MD5 00b1c20cff59b0d68e0acfb2e40f62c0
SHA1 c0bcf7c2b109801280ba192fafe4c4190c1e92bb
SHA512 af9dd4b68b2e08e6e4533484d166ad1f70b0d626ce7b1537d6c0179250aaaba73407f6a0cfbf2b8606112bfe80b4f8bd617fff8d67a0d28f3dacb67f605f7c65
TLSH
T14DA0025547951D317111D8D50115B104A2D17919E550564136C14161C10DB495330D74
MD5 SHA1 SHA512 TLSH

Submit Download

killer-helper.service

Path /etc/systemd/system/killer-helper.service
Size 186B
SHA256 84c3b3dd46f76cb9fffee80fda7ebcd57bbe0d5088b3eddff46b1beb3b0cf599
MD5 3b1d58311876396360c9492eed5febc6
SHA1 d8eaa69b7e09d3e7eafb2e4e1b89612efe80fe8d
SHA512 8bf774e336d1fd4b89f186eda1b0232052df36163155a2dd4498e815f05d753cb47c36f5fb48f6b301a0a212ff721f7920c03a9d602a1084cb9b0acea2fc626f
TLSH
T16EC02237572112B0880A28B18EAA3F40883022045BCDA1300FC11102C0D1A460330CB9
MD5 SHA1 SHA512 TLSH

Submit Download

sys-network-helper.service

Path /etc/systemd/system/sys-network-helper.service
Size 210B
SHA256 518382f73b30f63e61911f79eb230ed7e3f3f4b2d78c4ab6a872315bac869bec
MD5 9bfedbe4e309d2d96f84713128821756
SHA1 a69c004c93e845fda4054ea9bd8d669ff8d9a707
SHA512 2a10221ebaec4623fbeded7816ffab0c8682aa7a90d46fea404b60eb55e390e70f0a9d9dd40140c359325e0ef2bd75a78c5270fbd29bc3b80dc00fd3b9c6e60d
TLSH
T19AD02313DF3019D3D92A14754E567F60C45411441FCD553507D51F0246D230A4634A9E
MD5 SHA1 SHA512 TLSH

Submit Download

.killer-wd.pid.tmp.807

Path /run/.killer-wd.pid.tmp.807
Size 23B
SHA256 2dc9127e1899c90d1980336a9174a27c594cf4caeb0f428fb46a4f1715f3b7a2
MD5 b6b89e3679c9070c2c15071ee96f8035
SHA1 d7c73503cf8a03d344fb2958b61446cf807d7e5f
SHA512 818d6ceca1dfc68a8534b095d5e68a12bec53099217dd68e8ad0cdccf22307308bf10a8570debcc3f928304a180d5e8dc43120cf70819aaa23a6214da155681c
MD5 SHA1 SHA512

Submit Download

.killer.pid.tmp.806

Path /run/.killer.pid.tmp.806
Size 23B
SHA256 db41b9fb7db6a36b86ddbd247307ea7c04dfe7251cb12e8d7d841531d9cbf7d2
MD5 0f75f9a00460b0f04b640f8b13c8d976
SHA1 326afef6e095ff2f343511e85982b19dfc552c31
SHA512 abcf3ada75f8c234c36ed071809c153bf7a6150c855eb927fc2b9177347de6098f2b69f2d7aa95f5fd0f7a959e7be5cb03e7613c5e318b21d97f092ad34ab394
MD5 SHA1 SHA512

Submit Download

.locker.pid.tmp.808

Path /run/.locker.pid.tmp.808
Size 23B
SHA256 07bd38dc8ddabc1ab21f0459f473f3204c0ede10ed7bf40e1100e287539de3f5
MD5 42c50b1a37f1e27ff242f07b0f156c7f
SHA1 c50adce2d7103c44223611d7a46e4cb5968bffc5
SHA512 12f61090e4b103df27a9c8efa49201b2668fc79ef28e983aa39c98f3fddbfd8bcb08d425bdc77e7bb3cab52f91e7b66c81f154af1514ffd236705fa191bafa4e
MD5 SHA1 SHA512

Submit Download

.locker.ready

Path /run/.locker.ready
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

.main.pid.tmp.798

Path /run/.main.pid.tmp.798
Size 17B
SHA256 052cb27e28af13aed7a512c12b6467004b7289d7dafd4cca6239ec23cef796cc
MD5 3303c76c00590a4dec5ec497a3acbafa
SHA1 4de3941ef644bfb3934acd0c8df688bf4387fb0a
SHA512 05c49094c1d75f3e88f4a97e548dd6c21c970687013ee52dce11d735d36f061c11e2b336a9dbda758d71acc70cd69a750ce17499e3d9fcebad5530eaa453b220
MD5 SHA1 SHA512

Submit Download

.sh7f3a.dis.list

Path /run/.sh7f3a.dis.list
Size 62B
SHA256 5774eed03386d2d304b9c233532de7564030ecb2954556224f1e52ec92956b72
MD5 5a455e6e80af9b2f66d12910e73b2e6e
SHA1 db6c87ff5b8f4fea2ac6cada3e78e4edb64732c0
SHA512 fb3dc853b20bfaa9f3b9c9fde3708cd1bf83a87898be823ac8e3b652ee5fe90529346ebf3582c606aae594687d95f732049761fc799b0a3117ceec210817c73d
TLSH
T11BA00203B8482263CF599C123832A30840C04711CD217C70D1800808C1233813D1028C
MD5 SHA1 SHA512 TLSH

Submit Download

.watchdog.pid.tmp.808

Path /run/.watchdog.pid.tmp.808
Size 23B
SHA256 5d6250a986fc573b8b8eae1b9895547aafcce557b3d8883d700ae595aa2b8276
MD5 dcd40ad27a25239e0e7d2351af485fab
SHA1 d6fe4c6544173c56bb5c0380826029ecc43bba1f
SHA512 9d4fff5503a7438745ca1788065671db4bed260d26173f9de46a50edd3fd776f5559fd062de1cff1a81d259e00a59eeacc262d473027e77002fa795a232b05f8
MD5 SHA1 SHA512

Submit Download

.watchdog.pid.tmp.913

Path /run/.watchdog.pid.tmp.913
Size 23B
SHA256 dadebdba62188565348ebcb73f5906a3d42b0e197ac67c66c59c1b8838a1007a
MD5 3d6f3196817e6fef50499028356083c5
SHA1 5a4d5c6855c72a21904224c03d15dfc73d071497
SHA512 021cd012dcc1688b0333b51ac23a2bc48d9af4b8515f27f47a35a0e7eb7acf8aa4bcd721b3a5f11262f7507e8c547e0d4805e1c206e2d70738afb00d82e77ed0
MD5 SHA1 SHA512

Submit Download

.watchdog2.pid.tmp.808

Path /run/.watchdog2.pid.tmp.808
Size 23B
SHA256 71a4eef5da54abc979ba3acce5e0579d6efb97bae0d8497897b7433a1290a666
MD5 74388e1ebc0a37c9e8350c5c339105e5
SHA1 8a9dd7c2e8202238a19e75475bb272f8bbd2da19
SHA512 b31b9ca7a8f7a15c62627861a1cfb6768d8b059c689946a6dcc52a7f22f17432fffbc922db48af8487e9e06e93d6ecb95045f5e5832c91d226b320c6025f8693
MD5 SHA1 SHA512

Submit Download

.sh7f3a_ps.c

Path /tmp/.sh7f3a_ps.c
Size 666B
SHA256 c758ddb7e83c86b8a02edcaf11c4b96e1876699775e486301d3061393fc14b6e
MD5 15a6b0fd962edd2d2968841994853c04
SHA1 25db9652d6e62a483db55b5017ab7f12cf539a8c
SHA512 eb2ea8f4e111ad94b7196e1645505277ec4ea9d630b37208898587d19e6a176bd5823e5fe247c31ffc491ec5b04970b713fe8cd8b1ac5368ae812c564982c5c0
TLSH
T1C401A270C9FB9853F47394B75B8B402651457D071142C424BF0F5590EF9C0E527B97D9
MD5 SHA1 SHA512 TLSH

Submit Download

cc17pNC2.s

Path /tmp/cc17pNC2.s
Size 1KB
SHA256 b3e4762bb587540640fc88d8dfe5e7cc528d4ac6a3d004d541af871cfd792782
MD5 459559b0e03cca9d82989f03c5afa427
SHA1 3d787dbc2657dcedd2780b0b6d2344ef118778ad
SHA512 188ddca98f24c91075bdae9149e84c86b48b1ac8f6e9994f23b5d851d0fd9bfd483ef71a084dcc4723805fc38661fddd793d47e71d106af90c631681f4f0064f
TLSH
T1733111A0E73DB3B2AE4248E7E981202D15C9385211D980771558D40E3B6CCAE76E95CD
MD5 SHA1 SHA512 TLSH

Submit Download

ccY0Xfic.o

Path /tmp/ccY0Xfic.o
Size 1KB
SHA256 71f6d743d582451562dc00e8ebcc2340a82d3311756b4d677978e423f8d8bac7
MD5 20b16dca1a4d39a06237df486aaccdaf
SHA1 3a72a907b86898658c2472509fe427c47b7d0858
SHA512 1ffd437370f444ded4e1278cc2f7e075675dcfb2aab0fd3b5b777955f0b02a8bde32919d7769fb7436dc29f1a50b3bfd06a86a2b89b5244f9d057800b4b3085f
TLSH
T1E6314049F7E19C22EE70113E658343216302C98840C6F3131286DC701E9B1C87E19E80
MD5 SHA1 SHA512 TLSH

Submit Download

.sh7f3a.so

Path /usr/lib/.sh7f3a.so
Size 5KB
SHA256 08e9567dedbc0690ac111c237c2725e1159ee0c54d2c1d01606572136b803b1a
MD5 fe0d87e4fe464f157d2c99423155fdb0
SHA1 d7609e74a721abe7d370b20d8a64f31150d741f8
SHA512 1d472279064ba08e1213874348270fafbec7c4593ddd8fe49fc2de1edbecc4cd0379da18189a34c075dea5e28cc00ba280a4dec6866cffde16f5f671c6f78dd3
SSDEEP 48:sFOJS2DZlNueTFznPcRlRQSpHBCyG5Qxd5N:sFgD0eZrPuC3mxd5
TLSH
T1CFC133D2A7E56E37DCA7533A2253060433B688609B57F7631608C1F11E9F3DCDA25B85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.system-helper

Path /usr/lib/systemd/.system-helper
Size 78KB
SHA256 9267cc672d8758396927724b627ef59d9d37584cb0a318f6d9f91e41e2ca0297
MD5 b7f6f9a61bae453c92a998565a7394f5
SHA1 84bbe60bc88e7f206c73593b0d42480d7a519196
SHA512 00b1dbd9e9d51ed136e5a6e3524448c5145d1406d17a0f7cce1efa0a8bd558f0818c306c78958babc066ced3c8eee6d3e9b2f4bec69eeec5303dd3c646367859
SSDEEP 1536:tJZSoqQOJLV7+tcw67TtbDtyJAyK84Qqdiy1Y481+Qu7Ys+iLI:gJLV7+iw8gAZkkn1197YSLI
TLSH
T113831285E791AC7387E10422DD8EDD6D7E2DBCF098B424BFC3297B99E0B28835638515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads