9466fdca563ea6ced798df7c9a8314dad6e8c89a46854fad1723f7dea2612736

Analysis

max time kernel
2s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
18/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deploy.sh
Size 242KB
Sample261018-ppf4psd16v
SHA256 9466fdca563ea6ced798df7c9a8314dad6e8c89a46854fad1723f7dea2612736
MD5 cdaedc0ed80501bede19097cc93c2976
SHA1 9fba65ad066d1d641d1a008447c816a47e517d51
SHA512 d118d56fc0524c8e3387f822871f7daee6c6d20e17a05b92f8ad10b3102535b86fb7c19abd9d7006c61546a3839ffd9f19cb5d88f795c421ebe3440da92e1e12
SSDEEP 6144:xUea1SaYiQhKrBlrY7xybzSmLLSsKpeHHyJ:xrS94cjrux6SmLq
TLSH
T10C348DF7498338DA38A44D58E8011E915C7D3B43547EE156F9CC39BBE3EA264CE18A38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
745	chmod
731	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/var/tmp/s52A8t	738	deploy.sh
/var/tmp/tU2wP3	750	deploy.sh

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
742	base64

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	restorecon
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	findmnt
File opened for reading	/proc/self/mountinfo	findmnt
File opened for reading	/proc/filesystems	chcon

/tmp/deploy.sh
/tmp/deploy.sh
1⤵
- Executes dropped EXE
PID:707
- /usr/bin/id
  id -un
  2⤵
  - Reads runtime system information
  PID:709
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:715
- /usr/bin/getent
  getent passwd root
  2⤵
  PID:714
- /bin/findmnt
  findmnt -no OPTIONS -T /var/tmp
  2⤵
  - Reads runtime system information
  PID:720
- /bin/mktemp
  mktemp -p /var/tmp XXXXXX
  2⤵
  PID:726
- /bin/cat
  cat /bin/true
  2⤵
  PID:728
- /bin/chmod
  /bin/chmod 755 /var/tmp/s52A8t
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /usr/bin/chcon
  chcon -t bin_t /var/tmp/s52A8t
  2⤵
  - Reads runtime system information
  PID:733
- /usr/bin/chcon
  chcon -t unconfined_exec_t /var/tmp/s52A8t
  2⤵
  - Reads runtime system information
  PID:735
- /var/tmp/s52A8t
  /var/tmp/s52A8t
  2⤵
  PID:738
- /bin/rm
  rm -f /var/tmp/s52A8t
  2⤵
  PID:739
- /bin/mktemp
  mktemp -p /var/tmp XXXXXX
  2⤵
  PID:740
- /bin/cat
  cat
  2⤵
  PID:741
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:742
- /bin/chmod
  /bin/chmod 755 /var/tmp/tU2wP3
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /usr/bin/chcon
  chcon -t bin_t /var/tmp/tU2wP3
  2⤵
  - Reads runtime system information
  PID:746
- /usr/bin/chcon
  chcon -t unconfined_exec_t /var/tmp/tU2wP3
  2⤵
  - Reads runtime system information
  PID:748
- /sbin/restorecon
  restorecon /var/tmp/tU2wP3
  2⤵
  - Reads runtime system information
  PID:749
- /var/tmp/tU2wP3
  /var/tmp/tU2wP3 -d -n "[kworker/1:2]"
  2⤵
  PID:750

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

s52A8t

Path /var/tmp/s52A8t
Size 32KB
SHA256 91d88ccb2744f4467fb526ca12909ecb6da5322f7f483469d5461345cdb715b3
MD5 06eeb123223d4336302dcc320a2726cb
SHA1 48f1c341fa9fd26ff6bdb95096453157b4392e8f
SHA512 1c918dcaab61309b87caae769e92f9565447b840fecc0fae63e62a361b1abeb127744ce7449197da3f5a6c4bfe1b248a16d0570056896ead0c475ed413c44f9b
SSDEEP 768:T44ZHQFCir/tWm8UGsSPL+tynfn393zefz1tSH0KmVCvyqr48:4r/tWm8UGsSPL+t4fnxqfz1tTKm
TLSH
T135E2E71BEB561EE7C4D7CE740D1E8A5330EEC98F63C4A66B711C8A4E2D16BCC4A83548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tU2wP3

Path /var/tmp/tU2wP3
Size 177KB
SHA256 41967bcc97fe9ae7515f1325d633df2a98cd3a85daf452cffcc4a4ae99893e30
MD5 ec1839fc0e918164a1dfeb63c99f861f
SHA1 3c2b3983b447beae77cb5de729c2421e869bbeff
SHA512 b113a000132288f8bce70aab40cef9145b23f034af095667ed685399557203b15819b0dff36e0fd5a44dde161c71e2b6096d898d807330f2529891cad0f57bb0
SSDEEP 3072:t/ujjHHu2Aqzj4LXk24qL6oW5SIezINGJ+olSHvn9Z46MQGGfD:t/ufH/Akj4Lpve8JlIP9C6MQGGfD
TLSH
T145045B02F5D190FDC0CAD570479BD2236A76B8D512347A3F2798AE712E3AF20672DB61
MD5 SHA1 SHA512 SSDEEP TLSH