c034aa6818c6ec239a91c8f63e96d2fac869feb8b5d9ada98a933710c0f29447

Resubmissions

20/10/2026, 08:23

261020-kagpgabt8k7

20/10/2026, 08:23

261020-kadyksbt7r1

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/10/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
deepseek_bash_20261020_a7b5de.sh
Size 1KB
Sample261020-kagpgabt8k
SHA256 c034aa6818c6ec239a91c8f63e96d2fac869feb8b5d9ada98a933710c0f29447
MD5 e6ae55fa952090453b2e079c867bcbb1
SHA1 a7b5de23874cd6d1e755bf0386e13f60091f41ee
SHA512 02a50d9e3cfcfbe3aa987f5827d8843ab316478b9cb3fcdfbabe75149512cb7bfca61bc809cf2ba48f8ea25a2428f773d1c2231286eaef5a1dab84de652961bb
TLSH
T1D431F1017568B0B9616C911BE626750038DE04FF3A36072F34BB2D2E65E3381C57F676
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion discovery execution privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
660	sudo

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.YuR5wp	apt-get
File opened for modification	/tmp/fileutl.message.31iL8D	apt-get
File opened for modification	/tmp/fileutl.message.QvPLEU	apt-get
File opened for modification	/tmp/fileutl.message.hkzQxc	apt-get

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
677	apt-get

/tmp/deepseek_bash_20261020_a7b5de.sh
/tmp/deepseek_bash_20261020_a7b5de.sh
1⤵
PID:655
- /usr/bin/sudo
  sudo apt-get install -y python3-tk
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:660
- - /usr/bin/apt-get
    apt-get install -y python3-tk
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    - Software Deployment Tools
    PID:677
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:682

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads