9466fdca563ea6ced798df7c9a8314dad6e8c89a46854fad1723f7dea2612736

Analysis

max time kernel
2s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
18/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deploy.sh
Size 242KB
Sample261018-ppf4psd16v
SHA256 9466fdca563ea6ced798df7c9a8314dad6e8c89a46854fad1723f7dea2612736
MD5 cdaedc0ed80501bede19097cc93c2976
SHA1 9fba65ad066d1d641d1a008447c816a47e517d51
SHA512 d118d56fc0524c8e3387f822871f7daee6c6d20e17a05b92f8ad10b3102535b86fb7c19abd9d7006c61546a3839ffd9f19cb5d88f795c421ebe3440da92e1e12
SSDEEP 6144:xUea1SaYiQhKrBlrY7xybzSmLLSsKpeHHyJ:xrS94cjrux6SmLq
TLSH
T10C348DF7498338DA38A44D58E8011E915C7D3B43547EE156F9CC39BBE3EA264CE18A38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
761	chmod
745	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/var/tmp/PpXt0a	752	deploy.sh
/var/tmp/SlHOsd	767	deploy.sh

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
759	base64

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/mountinfo	findmnt
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	restorecon
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	findmnt

/tmp/deploy.sh
/tmp/deploy.sh
1⤵
- Executes dropped EXE
PID:723
- /usr/bin/id
  id -un
  2⤵
  - Reads runtime system information
  PID:726
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:732
- /usr/bin/getent
  getent passwd root
  2⤵
  PID:730
- /bin/findmnt
  findmnt -no OPTIONS -T /var/tmp
  2⤵
  - Reads runtime system information
  PID:738
- /bin/mktemp
  mktemp -p /var/tmp XXXXXX
  2⤵
  PID:741
- /bin/cat
  cat /bin/true
  2⤵
  PID:743
- /bin/chmod
  /bin/chmod 755 /var/tmp/PpXt0a
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /usr/bin/chcon
  chcon -t bin_t /var/tmp/PpXt0a
  2⤵
  - Reads runtime system information
  PID:747
- /usr/bin/chcon
  chcon -t unconfined_exec_t /var/tmp/PpXt0a
  2⤵
  - Reads runtime system information
  PID:750
- /var/tmp/PpXt0a
  /var/tmp/PpXt0a
  2⤵
  PID:752
- /bin/rm
  rm -f /var/tmp/PpXt0a
  2⤵
  PID:754
- /bin/mktemp
  mktemp -p /var/tmp XXXXXX
  2⤵
  PID:756
- /bin/cat
  cat
  2⤵
  PID:758
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:759
- /bin/chmod
  /bin/chmod 755 /var/tmp/SlHOsd
  2⤵
  - File and Directory Permissions Modification
  PID:761
- /usr/bin/chcon
  chcon -t bin_t /var/tmp/SlHOsd
  2⤵
  - Reads runtime system information
  PID:762
- /usr/bin/chcon
  chcon -t unconfined_exec_t /var/tmp/SlHOsd
  2⤵
  - Reads runtime system information
  PID:764
- /sbin/restorecon
  restorecon /var/tmp/SlHOsd
  2⤵
  - Reads runtime system information
  PID:766
- /var/tmp/SlHOsd
  /var/tmp/SlHOsd -d -n "[kworker/1:2]"
  2⤵
  PID:767

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PpXt0a

Path /var/tmp/PpXt0a
Size 32KB
SHA256 813f9ab8dfb5a1ced7d8fe7a6c826b7c24f37abcd722f4127e736886c4517f6e
MD5 8be3985708f7fc702a060bf77261b093
SHA1 2b7108faf6670a7d12396030e0db1ac17a611fdc
SHA512 c63de33074dae6edadc3fe55b35f0469954bff7ec440ee18faff186b261df5db23171d5c6632ce525813b68e06da8826f877997325ac11a8882e88b742923011
SSDEEP 768:q+G17UZXH3/K7Zb6ouMHRbGtCd9vyqr4rdW:k7UREBPuMHRbGYdqW
TLSH
T103E2C71B2322DF2DE491C3F01AB78BE537E453912EE54509B23DF10D2DABB49291BAD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SlHOsd

Path /var/tmp/SlHOsd
Size 177KB
SHA256 41967bcc97fe9ae7515f1325d633df2a98cd3a85daf452cffcc4a4ae99893e30
MD5 ec1839fc0e918164a1dfeb63c99f861f
SHA1 3c2b3983b447beae77cb5de729c2421e869bbeff
SHA512 b113a000132288f8bce70aab40cef9145b23f034af095667ed685399557203b15819b0dff36e0fd5a44dde161c71e2b6096d898d807330f2529891cad0f57bb0
SSDEEP 3072:t/ujjHHu2Aqzj4LXk24qL6oW5SIezINGJ+olSHvn9Z46MQGGfD:t/ufH/Akj4Lpve8JlIP9C6MQGGfD
TLSH
T145045B02F5D190FDC0CAD570479BD2236A76B8D512347A3F2798AE712E3AF20672DB61
MD5 SHA1 SHA512 SSDEEP TLSH