Overview

overview

7

Static

static

1

3619fbcb12...ion.sh

ubuntu-18.04-amd64

7

3619fbcb12...ion.sh

debian-9-armhf

7

3619fbcb12...ion.sh

debian-9-mips

7

3619fbcb12...ion.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    3s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    13/09/2026, 17:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3619fbcb12d39bbc5009f473a25dcfc95b543f67cbdb88ab203bc4259903eab1_comment-insertion.sh
  • Size 840KB
  • Sample260913-welprsttes
  • SHA256 eaeb09623cc22ccc170a06fe843dddff4199db54b3e761b885a2fa62decbf6e0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deobfuscate/Decode Files or Information 1 TTPs 4 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Reads runtime system information 29 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/3619fbcb12d39bbc5009f473a25dcfc95b543f67cbdb88ab203bc4259903eab1_comment-insertion.sh
    /tmp/3619fbcb12d39bbc5009f473a25dcfc95b543f67cbdb88ab203bc4259903eab1_comment-insertion.sh
    1⤵
    • Writes file to tmp directory
    PID:651
    • /bin/mktemp
      mktemp -d
      2⤵
        PID:671
      • /usr/bin/base64
        base64 -d
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:675
      • /usr/bin/python3
        python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
        2⤵
          PID:676
        • /bin/chmod
          chmod +x /tmp/tmp.duTDeujJnQ/embedded.sh
          2⤵
          • File and Directory Permissions Modification
          PID:682
      • /bin/bash
        bash /tmp/tmp.duTDeujJnQ/embedded.sh
        1⤵
        • Writes file to tmp directory
        PID:651
        • /bin/mkdir
          mkdir -p /var/www/html/digium_phones/
          2⤵
          • Reads runtime system information
          PID:685
        • /bin/mkdir
          mkdir -p /var/www/html/rest_phones/
          2⤵
          • Reads runtime system information
          PID:686
        • /bin/mkdir
          mkdir -p /var/www/html/digium_phoness/
          2⤵
          • Reads runtime system information
          PID:687
        • /bin/mkdir
          mkdir -p /var/www/html/phones/
          2⤵
          • Reads runtime system information
          PID:688
        • /bin/mkdir
          mkdir -p /var/www/html/fpbxphones/
          2⤵
          • Reads runtime system information
          PID:689
        • /bin/mkdir
          mkdir -p /var/www/html/freepbxphones/
          2⤵
          • Reads runtime system information
          PID:690
        • /bin/mkdir
          mkdir -p /var/www/html/freepbx/
          2⤵
          • Reads runtime system information
          PID:691
        • /bin/cp
          cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php
          2⤵
          • Reads runtime system information
          PID:692
        • /bin/cp
          cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/core/ajax.php
          2⤵
          • Reads runtime system information
          PID:693
        • /bin/cp
          cp /var/www/html/admin/views/ajax.php /var/www/html/digium_phones/ajax.php
          2⤵
          • Reads runtime system information
          PID:694
        • /bin/cp
          cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/js/config.php
          2⤵
          • Reads runtime system information
          PID:695
        • /bin/cp
          cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/config.php
          2⤵
          • Reads runtime system information
          PID:696
        • /bin/cp
          cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/ajax.php
          2⤵
          • Reads runtime system information
          PID:697
        • /bin/cp
          cp /var/www/html/rest_phones/ajax.php /var/www/html/admin/modules/core/ajax.php
          2⤵
          • Reads runtime system information
          PID:698
        • /bin/cp
          cp /var/www/html/rest_phones/ajax.php /var/www/html/admin/assets/js/config.php
          2⤵
          • Reads runtime system information
          PID:699
        • /bin/cp
          cp /var/www/html/rest_phones/ajax.php /var/www/html/admin/assets/config.php
          2⤵
          • Reads runtime system information
          PID:700
        • /bin/cp
          cp /var/www/html/rest_phones/ajax.php /var/www/html/admin/assets/ajax.php
          2⤵
          • Reads runtime system information
          PID:701
        • /bin/cp
          cp /var/www/html/rest_phones/ajax.php /var/www/html/phones/ajax.php
          2⤵
          • Reads runtime system information
          PID:702
        • /bin/cp
          cp /var/www/html/rest_phones/ajax.php /var/www/html/digium_phoness/ajax.php
          2⤵
          • Reads runtime system information
          PID:703
        • /bin/cp
          cp /var/www/html/rest_phones/ajax.php /var/www/html/fpbxphones/ajax.php
          2⤵
          • Reads runtime system information
          PID:704
        • /bin/cp
          cp /var/www/html/rest_phones/ajax.php /var/www/html/freepbxphones/ajax.php
          2⤵
          • Reads runtime system information
          PID:705
        • /bin/cp
          cp /var/www/html/rest_phones/ajax.php /var/www/html/freepbx/ajax.php
          2⤵
          • Reads runtime system information
          PID:706
        • /usr/bin/touch
          touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
          2⤵
            PID:707
          • /usr/bin/base64
            base64 -d
            2⤵
            • Deobfuscate/Decode Files or Information
            PID:711
          • /bin/bash
            bash /tmp/test.sh
            2⤵
              PID:712
              • /bin/ls
                ls -la
                3⤵
                • Reads runtime system information
                PID:715
              • /bin/cat
                cat /etc/passwd
                3⤵
                  PID:716
                • /bin/ls
                  ls -ls /home
                  3⤵
                  • Reads runtime system information
                  PID:717
                • /bin/mkdir
                  mkdir -p /var/www/html/admin/modules/freepbx_ha/
                  3⤵
                  • Reads runtime system information
                  PID:718
                • /bin/mv
                  mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
                  3⤵
                  • Reads runtime system information
                  PID:719
                • /usr/bin/base64
                  base64 -d
                  3⤵
                  • Deobfuscate/Decode Files or Information
                  PID:721
                • /bin/rm
                  rm -rf /var/www/html/admin/modules/freepbx_ha/license.php mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
                  3⤵
                    PID:722
                  • /bin/ls
                    ls -la
                    3⤵
                    • Reads runtime system information
                    PID:723
                  • /usr/bin/base64
                    base64 -d
                    3⤵
                    • Deobfuscate/Decode Files or Information
                    PID:725
                  • /bin/ls
                    ls -la
                    3⤵
                    • Reads runtime system information
                    PID:726
                  • /bin/cat
                    cat /etc/passwd
                    3⤵
                      PID:728
                    • /bin/ls
                      ls -ls /home
                      3⤵
                      • Reads runtime system information
                      PID:730
                  • /bin/rm
                    rm -rf /tmp/test.sh
                    2⤵
                      PID:733
                    • /bin/bash
                      bash /var/spool/asterisk/tmp/test.sh
                      2⤵
                        PID:736
                      • /bin/rm
                        rm -rf /var/spool/asterisk/tmp/test.sh
                        2⤵
                          PID:739

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            sh-thd.utqPMe
                            • Path /tmp/sh-thd.utqPMe
                            • Size 827KB
                            • SHA256 578716f7b7bfc5b24e4d7252f631b6a49fc7da9e3010d85ca36d3bc8a9e47d71
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            test.sh
                            • Path /tmp/test.sh
                            • Size 4KB
                            • SHA256 0cc9d103b3f45a593a84a1e4ef3cd7852abc5f3598b5adb01ea69dc425cddb09
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            embedded.sh
                            • Path /tmp/tmp.duTDeujJnQ/embedded.sh
                            • Size 19KB
                            • SHA256 d66de44766d443fb3ba0f1b17fd1c8b719714b49d5479be874d354511da57ab1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download