9466fdca563ea6ced798df7c9a8314dad6e8c89a46854fad1723f7dea2612736

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
18/10/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deploy.sh
Size 242KB
Sample261018-ppvbbszsfy
SHA256 9466fdca563ea6ced798df7c9a8314dad6e8c89a46854fad1723f7dea2612736
MD5 cdaedc0ed80501bede19097cc93c2976
SHA1 9fba65ad066d1d641d1a008447c816a47e517d51
SHA512 d118d56fc0524c8e3387f822871f7daee6c6d20e17a05b92f8ad10b3102535b86fb7c19abd9d7006c61546a3839ffd9f19cb5d88f795c421ebe3440da92e1e12
SSDEEP 6144:xUea1SaYiQhKrBlrY7xybzSmLLSsKpeHHyJ:xrS94cjrux6SmLq
TLSH
T10C348DF7498338DA38A44D58E8011E915C7D3B43547EE156F9CC39BBE3EA264CE18A38
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
684	chmod
670	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/var/tmp/FYbTPg	675	deploy.sh
/var/tmp/WR9CYj	689	deploy.sh

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
682	base64

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	restorecon
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	findmnt
File opened for reading	/proc/self/mountinfo	findmnt
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	chcon
File opened for reading	/proc/filesystems	chcon

/tmp/deploy.sh
/tmp/deploy.sh
1⤵
- Executes dropped EXE
PID:641
- /usr/bin/id
  id -un
  2⤵
  - Reads runtime system information
  PID:643
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:649
- /usr/bin/getent
  getent passwd root
  2⤵
  PID:648
- /bin/findmnt
  findmnt -no OPTIONS -T /var/tmp
  2⤵
  - Reads runtime system information
  PID:654
- /bin/mktemp
  mktemp -p /var/tmp XXXXXX
  2⤵
  PID:660
- /bin/cat
  cat /bin/true
  2⤵
  PID:664
- /bin/chmod
  /bin/chmod 755 /var/tmp/FYbTPg
  2⤵
  - File and Directory Permissions Modification
  PID:670
- /usr/bin/chcon
  chcon -t bin_t /var/tmp/FYbTPg
  2⤵
  - Reads runtime system information
  PID:671
- /usr/bin/chcon
  chcon -t unconfined_exec_t /var/tmp/FYbTPg
  2⤵
  - Reads runtime system information
  PID:673
- /var/tmp/FYbTPg
  /var/tmp/FYbTPg
  2⤵
  PID:675
- /bin/rm
  rm -f /var/tmp/FYbTPg
  2⤵
  PID:676
- /bin/mktemp
  mktemp -p /var/tmp XXXXXX
  2⤵
  PID:678
- /bin/cat
  cat
  2⤵
  PID:681
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:682
- /bin/chmod
  /bin/chmod 755 /var/tmp/WR9CYj
  2⤵
  - File and Directory Permissions Modification
  PID:684
- /usr/bin/chcon
  chcon -t bin_t /var/tmp/WR9CYj
  2⤵
  - Reads runtime system information
  PID:686
- /usr/bin/chcon
  chcon -t unconfined_exec_t /var/tmp/WR9CYj
  2⤵
  - Reads runtime system information
  PID:687
- /sbin/restorecon
  restorecon /var/tmp/WR9CYj
  2⤵
  - Reads runtime system information
  PID:688
- /var/tmp/WR9CYj
  /var/tmp/WR9CYj -d -n "[kworker/1:2]"
  2⤵
  PID:689

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FYbTPg

Path /var/tmp/FYbTPg
Size 21KB
SHA256 9b4183caf74b12ee31ad909c52456d357193eba7d2ac6cc2f1593095ea30f2df
MD5 021bb9056909219d58497060a47695bf
SHA1 b0692aa3897c6b6867f843ba047c12769fa7b0b3
SHA512 6a9583c8ba6d6f1cfcbba486eb03703d73e7c602668682a2ab0f0d960c18dbf37610a384f0b576edaab83f3219257fc25c2a74c35b848f307cd6d35f30d59fb9
SSDEEP 384:D5Up38pYae4n62mr7EPg62HQxRXPJRPvyqr417Mk:D5esY34n62wAg626XTvyqr4d
TLSH
T13AA21AA052494957C4C703B06D7F0A62E7B3DC99562F9B12A60CFC314F2AAAD5F1EB48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WR9CYj

Path /var/tmp/WR9CYj
Size 177KB
SHA256 41967bcc97fe9ae7515f1325d633df2a98cd3a85daf452cffcc4a4ae99893e30
MD5 ec1839fc0e918164a1dfeb63c99f861f
SHA1 3c2b3983b447beae77cb5de729c2421e869bbeff
SHA512 b113a000132288f8bce70aab40cef9145b23f034af095667ed685399557203b15819b0dff36e0fd5a44dde161c71e2b6096d898d807330f2529891cad0f57bb0
SSDEEP 3072:t/ujjHHu2Aqzj4LXk24qL6oW5SIezINGJ+olSHvn9Z46MQGGfD:t/ufH/Akj4Lpve8JlIP9C6MQGGfD
TLSH
T145045B02F5D190FDC0CAD570479BD2236A76B8D512347A3F2798AE712E3AF20672DB61
MD5 SHA1 SHA512 SSDEEP TLSH