Analysis
- max time kernel
2s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
07/11/2026, 23:33
Static task
static1
Behavioral task
behavioral1
Sample
setup.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
setup.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
5 signatures
150 seconds
General
- Target setup.sh
- Size 1KB
- Sample261107-3j9eyswtby
- SHA256 f676615eba6599c10ec4391479299ea3eeb430b5af60251a62756fa8f6a3d9c4
- MD5 3302437f3bfee46f03756c91e02cf1f1
- SHA1 992dbee5914d320757fc52dd39524c6341a9796c
- SHA512 b504ac3a4a9b5fa2af7d34421aeb29e3d84eacb19abe6ce76858230f1c651f36aeda4c73b78c1c0b25d7eae0744817ea480cff2912c26062c5f5bdb6c62e7a2d
- TLSH T1F1211072F034AC72A69F50B1AECF9104F9C7267BE114311175AED0BA3A3C9A2D6B8558
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Modifies password files for system users/ groups 1 TTPs 6 IoCs
Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.
description ioc Process File opened for modification /etc/shadow usermod File opened for modification /etc/group usermod File opened for modification /etc/gshadow usermod File opened for modification /etc/group groupadd File opened for modification /etc/gshadow groupadd File opened for modification /etc/passwd usermod -
ioc pid Process /lib/modules/4.9.0-13-armmp-lpae/kernel/drivers/input/misc/uinput.ko 670 modprobe - OS Credential Dumping 1 TTPs 1 IoCs
Adversaries may attempt to dump credentials to use it in password cracking.
description ioc Process File opened for reading /etc/shadow usermod - Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 8 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 660 sudo 676 sudo 681 sudo 686 sudo 692 sudo 694 sudo 696 sudo 700 sudo - Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/ptp udevadm File opened for reading /sys/class/bsg udevadm File opened for reading /sys/class/input udevadm File opened for reading /sys/bus/xen-backend/devices udevadm File opened for reading /sys/class/tty udevadm File opened for reading /sys/class/bdi udevadm File opened for reading /sys/bus/soc/devices udevadm File opened for reading /sys/bus/mipi-dsi/devices udevadm File opened for reading /sys/class/rc udevadm File opened for reading /sys/class/backlight udevadm File opened for reading /sys/bus/sdio/devices udevadm File opened for reading /sys/class/leds udevadm File opened for reading /sys/class/mmc_host udevadm File opened for reading /sys/class/block udevadm File opened for reading /sys/bus/container/devices udevadm File opened for reading /sys/class/power_supply udevadm File opened for reading /sys/class/dvb udevadm File opened for reading /sys/class udevadm File opened for reading /sys/class/pwm udevadm File opened for reading /sys/class/spidev udevadm File opened for reading /sys/bus/pci/devices udevadm File opened for reading /sys/class/hwmon udevadm File opened for reading /sys/class/video4linux udevadm File opened for reading /sys/class/mem udevadm File opened for reading /sys/class/graphics udevadm File opened for reading /sys/class/gpio udevadm File opened for reading /sys/class/misc udevadm File opened for reading /sys/class/pci_bus udevadm File opened for reading /sys/bus/i2c/devices udevadm File opened for reading /sys/bus/amba/devices udevadm File opened for reading /sys/bus/mdio_bus/devices udevadm File opened for reading /sys/class/iommu udevadm File opened for reading /sys/class/mbox udevadm File opened for reading /sys/bus/pci_express/devices udevadm File opened for reading /sys/bus/workqueue/devices udevadm File opened for reading /sys/class/i2c-adapter udevadm File opened for reading /sys/class/dma udevadm File opened for reading /sys/class/mdio_bus udevadm File opened for reading /sys/bus/xen/devices udevadm File opened for reading /sys/bus/platform/devices udevadm File opened for reading /sys/bus/event_source/devices udevadm File opened for reading /sys/class/mtd udevadm File opened for reading /sys/bus/virtio/devices udevadm File opened for reading /sys/class/pps udevadm File opened for reading /sys/class/spi_master udevadm File opened for reading /sys/bus/serio/devices udevadm File opened for reading /sys/bus/sunxi-rsb/devices udevadm File opened for reading /sys/bus/mmc/devices udevadm File opened for reading /sys/bus/media/devices udevadm File opened for reading /sys/class/tpm udevadm File opened for reading /sys/bus/clockevents/devices udevadm File opened for reading /sys/bus/spi/devices udevadm File opened for reading /sys/class/devfreq udevadm File opened for reading /sys/class/phy udevadm File opened for reading /sys/bus udevadm File opened for reading /sys/bus/cpu/devices udevadm File opened for reading /sys/class/thermal udevadm File opened for reading /sys/class/vc udevadm File opened for reading /sys/module/uinput/initstate modprobe File opened for reading /sys/bus/clocksource/devices udevadm File opened for reading /sys/class/devcoredump udevadm File opened for reading /sys/class/firmware udevadm File opened for reading /sys/class/regulator udevadm File opened for reading /sys/class/rtc udevadm -
description ioc Process File opened for reading /proc/self/stat sudo File opened for reading /proc/self/stat udevadm File opened for reading /proc/1/environ udevadm File opened for reading /proc/self/stat sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/cmdline udevadm File opened for reading /proc/filesystems groupadd File opened for reading /proc/filesystems udevadm File opened for reading /proc/self/stat udevadm File opened for reading /proc/filesystems sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/self/fd sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/self/fd sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/self/fd sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/1/environ udevadm File opened for reading /proc/cmdline udevadm File opened for reading /proc/self/fd sudo File opened for reading /proc/filesystems udevadm File opened for reading /proc/self/fd sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/filesystems usermod File opened for reading /proc/1/environ udevadm File opened for reading /proc/self/fd sudo File opened for reading /proc/filesystems udevadm File opened for reading /proc/self/stat sudo File opened for reading /proc/self/stat udevadm File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/fd sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/cmdline udevadm File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/cmdline modprobe File opened for reading /proc/self/stat sudo File opened for reading /proc/sys/kernel/ngroups_max usermod File opened for reading /proc/self/fd sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/filesystems sudo
Processes
-
/tmp/setup.sh/tmp/setup.sh1⤵PID:646
-
/usr/local/sbin/bashbash /tmp/setup.sh1⤵PID:646
-
/usr/local/bin/bashbash /tmp/setup.sh1⤵PID:646
-
/usr/sbin/bashbash /tmp/setup.sh1⤵PID:646
-
/usr/bin/bashbash /tmp/setup.sh1⤵PID:646
-
/sbin/bashbash /tmp/setup.sh1⤵PID:646
-
/bin/bashbash /tmp/setup.sh1⤵PID:646
-
/usr/bin/whoamiwhoami2⤵PID:653
-
-
/usr/bin/sudosudo modprobe uinput2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:660 -
/sbin/modprobemodprobe uinput3⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:670
-
-
-
/usr/bin/sudosudo tee /etc/udev/rules.d/99-uinput.rules2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:676 -
/usr/bin/teetee /etc/udev/rules.d/99-uinput.rules3⤵PID:678
-
-
-
/usr/bin/getentgetent group uinput2⤵PID:679
-
-
/usr/bin/sudosudo groupadd uinput2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:681 -
/usr/sbin/groupaddgroupadd uinput3⤵
- Modifies password files for system users/ groups
- Reads runtime system information
PID:682 -
/usr/sbin/nscdnscd -i passwd4⤵PID:683
-
-
/usr/sbin/nscdnscd -i group4⤵PID:684
-
-
/usr/sbin/nscdnscd -i group4⤵PID:685
-
-
-
-
/usr/bin/sudosudo usermod -aG uinput root2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:686 -
/usr/sbin/usermodusermod -aG uinput root3⤵
- Modifies password files for system users/ groups
- OS Credential Dumping
- Reads runtime system information
PID:687 -
/usr/sbin/nscdnscd -i passwd4⤵PID:688
-
-
/usr/sbin/nscdnscd -i group4⤵PID:689
-
-
/usr/sbin/nscdnscd -i passwd4⤵PID:690
-
-
/usr/sbin/nscdnscd -i group4⤵PID:691
-
-
-
-
/usr/bin/sudosudo udevadm control --reload-rules2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:692 -
/sbin/udevadmudevadm control --reload-rules3⤵
- Reads runtime system information
PID:693
-
-
-
/usr/bin/sudosudo udevadm trigger "--action=add" "--sysname-match=uinput"2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:694 -
/sbin/udevadmudevadm trigger "--action=add" "--sysname-match=uinput"3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:695
-
-
-
/usr/bin/sudosudo udevadm settle2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:696 -
/sbin/udevadmudevadm settle3⤵
- Reads runtime system information
PID:698
-
-
-
/usr/bin/sudosudo tee /etc/modules-load.d/uinput.conf2⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:700 -
/usr/bin/teetee /etc/modules-load.d/uinput.conf3⤵PID:701
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Abuse Elevation Control Mechanism
1Sudo and Sudo Caching
1Modify Authentication Process
1Pluggable Authentication Modules
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/group+
- Size 714B
- SHA256 d2f63fa0120a7129708d8cec4fb51ab8c50e59b5f9fc82ad10f0230ab6cf238c
- MD5 c43a43cfee550c8245d3c441e0731f4a
- SHA1 d99b984be89bec64a920ddeb40dd56bfeaaf2294
- SHA512 c8ff04c34e15ab3a8ce7e12244289ce4f895ed125a9e8301b08f6d27998f49c766ba62667930e750aa0a9204df8ec3f137e272bc888f1cf47e91c417f5502148
- TLSH T13F016808B808C5588051184A1A761FEA25B92ECF496BD5C6D97FC8D872118231B75CD4
- MD5 SHA1 SHA512 TLSH
- Path /etc/group+
- Size 718B
- SHA256 9894e31e824efdc781015ac11dca87f2725239b92fdb2f4256e28484644483ad
- MD5 f427aaff336124814cd3661cd92822d6
- SHA1 66b3feb551c6687a9389e2928a5610f102846281
- SHA512 832408859a6193f5827d97730cb523f6d273d5d8c5780811a3a26312470b09849205b9983ce03590612adbeda35fedc4cc424025f2f7001bbed27e0579a66b10
- TLSH T127016808B808C5588051184A1A761FEA25B92ECF496BD5C6D97FC8D87211C231B75CD4
- MD5 SHA1 SHA512 TLSH
- Path /etc/gshadow+
- Size 601B
- SHA256 2f2c719d4fe106c77e11b76525c8f75d4622d58050fa3ff7d0dce927eff01ad7
- MD5 5a8b31f2f0f231625a8bc6ff1f364662
- SHA1 8234f036453293f478d8450828a3f2a037632fb7
- SHA512 9d33564fe7756e43d9eece2a2b1bc173987a9d4552126b892f0b37a146ba61fc34bfa3c61bf959abb23b059eaa18df5096df7f7e55eeeeb131791538a86cabee
- TLSH T123F02450B25A84580106184B7FF54E9B282A7B6A84E8C0C3C976C8C71F288FF2A31CE8
- MD5 SHA1 SHA512 TLSH
- Path /etc/gshadow+
- Size 605B
- SHA256 a68b7dc96a9d26587dcce1cae42aeac76b031021c262247ac5631b8fc7cf6902
- MD5 94576250bebd4d56ae025b6135b29175
- SHA1 4ca9f66ca210e0150e1c78ca8eab24e7f2138cff
- SHA512 f32abd8438fbb05fef34fb8f1cf5e5e0efa663c16b7f3e1c92886cfc7c26d651cf203f55f767bdd1ab73705914544b8947df1d0d2f1d510d6e75221301102121
- TLSH T1BBF02450B25A94580106184B7FF54E9B282A7B7A84E8C0C3C976C8C71F288FF2A31CE8
- MD5 SHA1 SHA512 TLSH
- Path /etc/modules-load.d/uinput.conf
- Size 7B
- SHA256 a771c9695d7283f7771adc00b680bd27391e6ac00e9fd026f4796067ee9a87eb
- MD5 895c8735878bc1611cf6e1ee71f60ee6
- SHA1 988e5f17722d7b062c34d392bd886b49dfa92295
- SHA512 a9b069ed121ffeee887e0583d8cb46035ecf1fa90a26a4ecb3aa11ff03178b2b08621f6676db6b2350f290694c04aabcf36f2ce3e0813a76dde9a33555edb112
- MD5 SHA1 SHA512
- Path /etc/udev/rules.d/99-uinput.rules
- Size 62B
- SHA256 5f7749c460ea4f2321ae677ff1fc2d272b8c901311bcc095b56949cf8a751d9a
- MD5 4310a23bb86769eb36c28d970a9418b9
- SHA1 8f71024801f2fc7cecb3631c86b816397143ac09
- SHA512 7a0825f049d4dbf6de8b48e8bd49fbeaea46b9555dee2b5ba23e1876bf8f99ca0cdf1cc2b62b5a1c5f6132652054b4bf689e580e34abbe5e872decdc88f5e730
- TLSH T1A5A00262D5947E17AD82E06583884662988243D8D41852476A9CA086030C3980325C20
- MD5 SHA1 SHA512 TLSH