284054591fdb903fcbf594d0aabb2a1041b92a54106dd3f960324c7c24360da6

Analysis

max time kernel
10s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
20/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
armcameradriver.sh
Size 20.6MB
Sample260820-plkbysck2x
SHA256 284054591fdb903fcbf594d0aabb2a1041b92a54106dd3f960324c7c24360da6
MD5 ab3abce4f8274e3d2a678f5510c837a0
SHA1 146d13515ce25e3aa88e2d63625a60db9b51eabf
SHA512 601f79a2a07d4236b944c021f2d3f9d811fa0dc52f7de76a7f7f1224436ae4108e5583643c92a0781d7a139be2782be5589ef13772977afc42cfce4d41d4a462
SSDEEP 49152:MdWsOrv9igTpfiXqBjfBtRNNpJCC/uap436w3R/tkQV45gIUR+09vaD16VyNWpXE:J
TLSH
T15E27C0B39363BEAA2FA60C81814939516C4C6CA72330C094FFCC759B58AD574BD7E8B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
738	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/camapp	745	armcameradriver.sh

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/0	open

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/camupdate	armcameradriver.sh

/tmp/armcameradriver.sh
/tmp/armcameradriver.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:710
- /bin/rm
  rm /root/Library/LaunchAgents/com.camdriver.update.plist
  2⤵
  PID:717
- /bin/sed
  sed -n 29p /tmp/armcameradriver.sh
  2⤵
  - Reads runtime system information
  PID:720
- /usr/bin/base64
  base64 --decode
  2⤵
  PID:721
- /bin/chmod
  chmod +x /var/tmp/camapp
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /bin/sed
  sed -n 27p /tmp/armcameradriver.sh
  2⤵
  - Reads runtime system information
  PID:739
- /usr/bin/base64
  base64 --decode
  2⤵
  PID:740
- /bin/open
  open CamDriverUpdate.app
  2⤵
  - Reads runtime system information
  PID:743
- /var/tmp/camapp
  /var/tmp/camapp
  2⤵
  PID:745

/usr/local/sbin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:744

/usr/local/bin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:744

/usr/sbin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:744

/usr/bin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:744

/sbin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:744

/bin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

camupdate

Path /tmp/camupdate
Size 1.3MB
SHA256 7e404b852ddfa4dc4f12f5910c3ee177770ee312556b9fdc1960e5a7a3d9e651
MD5 dcf22eefc4a595b8d026ff673b89b3de
SHA1 f759c2dbc28b5c3172f46b3c5fe05a432a8b7e8e
SHA512 7af185559947de7c5d8ed12629f229c3c260b19bdf6cb042a70c4f85c78c9e65e877288a76782569fb7d08872fcf176713ef5e52d46d276e103c11c0a51c4058
SSDEEP 24576:isEHBxU6SKelzGLYlxHWYBnsqMna6R0VUR7yDxQKN6YpfAhXx520YJ9k:isEhxFfclxHWMbqc6mtH6qYB52hM
TLSH
T1A45533E1AC2878BCD46D68F5E13926597C67F212A79BE78B0239A5493FD4C80C87C14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

camapp

Path /var/tmp/camapp
Size 14.2MB
SHA256 70b56fa0ee9fa30fb42bdb1dc931f1ca867a4b8da07370b1d6f3f555c8a84cb4
MD5 c69a900680f0da5371fa6e265bcc48b0
SHA1 4dc9e03bc95db104859c02229e54752072aac203
SHA512 943badbcd21afc49713459ad864a64ddb1acae4a3ba0d865b10c8a83132eabf75b34fa5305bfa03bc01cd9d1af78f5e344e9f25b98f3d7f96d59c457572b530f
SSDEEP 196608:nadLDeOZiNiwQTFL3ww8QVXfFI4vVEMBVefODxVqD:n0DpENiwQpcBCzETmi
TLSH
T1A8E6AE85BC3D7922E6C661B36F264384313DBC845F82CB166714FB3D9DB27548B22B62
MD5 SHA1 SHA512 SSDEEP TLSH