9466fdca563ea6ced798df7c9a8314dad6e8c89a46854fad1723f7dea2612736

Analysis

max time kernel
149s
max time network
142s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deploy.sh
Size 242KB
Sample261018-ppf4psd16v
SHA256 9466fdca563ea6ced798df7c9a8314dad6e8c89a46854fad1723f7dea2612736
MD5 cdaedc0ed80501bede19097cc93c2976
SHA1 9fba65ad066d1d641d1a008447c816a47e517d51
SHA512 d118d56fc0524c8e3387f822871f7daee6c6d20e17a05b92f8ad10b3102535b86fb7c19abd9d7006c61546a3839ffd9f19cb5d88f795c421ebe3440da92e1e12
SSDEEP 6144:xUea1SaYiQhKrBlrY7xybzSmLLSsKpeHHyJ:xrS94cjrux6SmLq
TLSH
T10C348DF7498338DA38A44D58E8011E915C7D3B43547EE156F9CC39BBE3EA264CE18A38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1502	chmod
1514	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/var/tmp/Dftxzh	1506	deploy.sh
/var/tmp/QXhS5R	1518	deploy.sh

Reads MAC address of network interface 2 TTPs 1 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/ens3/address	QXhS5R

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1510	base64

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	kworker/1:2	1521	QXhS5R

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/self/exe	QXhS5R
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	findmnt
File opened for reading	/proc/self/mountinfo	findmnt
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	restorecon
File opened for reading	/proc/filesystems	chcon

/tmp/deploy.sh
/tmp/deploy.sh
1⤵
- Executes dropped EXE
PID:1491
- /usr/bin/id
  id -un
  2⤵
  - Reads runtime system information
  PID:1492
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:1495
- /usr/bin/getent
  getent passwd root
  2⤵
  PID:1494
- /bin/findmnt
  findmnt -no OPTIONS -T /var/tmp
  2⤵
  - Reads runtime system information
  PID:1497
- /bin/mktemp
  mktemp -p /var/tmp XXXXXX
  2⤵
  PID:1498
- /bin/cat
  cat /bin/true
  2⤵
  PID:1499
- /usr/bin/setfacl
  setfacl -b /var/tmp/Dftxzh
  2⤵
  PID:1500
- /bin/chmod
  /bin/chmod 755 /var/tmp/Dftxzh
  2⤵
  - File and Directory Permissions Modification
  PID:1502
- /usr/bin/chcon
  chcon -t bin_t /var/tmp/Dftxzh
  2⤵
  - Reads runtime system information
  PID:1504
- /usr/bin/chcon
  chcon -t unconfined_exec_t /var/tmp/Dftxzh
  2⤵
  - Reads runtime system information
  PID:1505
- /var/tmp/Dftxzh
  /var/tmp/Dftxzh
  2⤵
  PID:1506
- /bin/rm
  rm -f /var/tmp/Dftxzh
  2⤵
  PID:1507
- /bin/mktemp
  mktemp -p /var/tmp XXXXXX
  2⤵
  PID:1508
- /bin/cat
  cat
  2⤵
  PID:1509
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1510
- /usr/bin/setfacl
  setfacl -b /var/tmp/QXhS5R
  2⤵
  PID:1512
- /bin/chmod
  /bin/chmod 755 /var/tmp/QXhS5R
  2⤵
  - File and Directory Permissions Modification
  PID:1514
- /usr/bin/chcon
  chcon -t bin_t /var/tmp/QXhS5R
  2⤵
  - Reads runtime system information
  PID:1515
- /usr/bin/chcon
  chcon -t unconfined_exec_t /var/tmp/QXhS5R
  2⤵
  - Reads runtime system information
  PID:1516
- /sbin/restorecon
  restorecon /var/tmp/QXhS5R
  2⤵
  - Reads runtime system information
  PID:1517
- /var/tmp/QXhS5R
  /var/tmp/QXhS5R -d -n "[kworker/1:2]"
  2⤵
  - Reads MAC address of network interface
  - Changes its process name
  - Reads runtime system information
  PID:1518
- /bin/rm
  rm -f /var/tmp/QXhS5R
  2⤵
  PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Dftxzh

Path /var/tmp/Dftxzh
Size 30KB
SHA256 09198e56abd1037352418279eb51898ab71cc733642b50bcf69d8a723602841e
MD5 3c30e683c800bf19594e529602b949aa
SHA1 d127b6562d881d6a655296b6d2ae3f765d87e175
SHA512 cace0972d5567a229413280beddba42463f73fffd8a23baaa125cfb42a63fea9081ee1d09c33aeb9aa230c87dd1afcda243ce978519ab0c5ce9e9371002a6a5a
SSDEEP 768:IcfQTsodyOPGJALQQjck7qUWtAiqbol2Ht+I:6sEyGGJA87ON5
TLSH
T13DD21A5BB6C2943EC656877084979A317670BC80A33A5A373944F37D1DC1F686B3CB62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QXhS5R

Path /var/tmp/QXhS5R
Size 177KB
SHA256 41967bcc97fe9ae7515f1325d633df2a98cd3a85daf452cffcc4a4ae99893e30
MD5 ec1839fc0e918164a1dfeb63c99f861f
SHA1 3c2b3983b447beae77cb5de729c2421e869bbeff
SHA512 b113a000132288f8bce70aab40cef9145b23f034af095667ed685399557203b15819b0dff36e0fd5a44dde161c71e2b6096d898d807330f2529891cad0f57bb0
SSDEEP 3072:t/ujjHHu2Aqzj4LXk24qL6oW5SIezINGJ+olSHvn9Z46MQGGfD:t/ufH/Akj4Lpve8JlIP9C6MQGGfD
TLSH
T145045B02F5D190FDC0CAD570479BD2236A76B8D512347A3F2798AE712E3AF20672DB61
MD5 SHA1 SHA512 SSDEEP TLSH