9a59b9faebdde2a6bb88f3ab0f8b8adc030d534d96a08bc0a1dbbf6b9fcbe56d

Analysis

max time kernel
15s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
13/11/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a59b9faebdde2a6bb88f3ab0f8b8adc030d534d96a08bc0a1dbbf6b9fcbe56d.sh
Size 2KB
Sample261113-sqa6mac16k
SHA256 9a59b9faebdde2a6bb88f3ab0f8b8adc030d534d96a08bc0a1dbbf6b9fcbe56d
MD5 3fab5749499dfed466295d886c8d5d6e
SHA1 ab5c192315c01375e21516eba482df3c7069ba19
SHA512 362e235936acae90cbbe2338f46655a6f68f5d9cecc085f31f01a0f6e316b26d62eb72481c140f8942a8ca2ffe23ef60cbdeb172936c5b280f098fb027c27484
TLSH
T1F95152C3E2B5993775C9563D9607FA40BAE5302E8862383160B27C5C506F99DD3BAF32
MD5 SHA1 SHA512 TLSH

Score

8^/10

credential_access defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Adds new SSH keys 1 TTPs 2 IoCs

Linux special file to hold SSH keys. The threat actor may add new keys for further remote access.

persistence privilege_escalation

SSH Authorized Keys

T1098.004

description	ioc	Process
File opened for modification	/root/.ssh/authorized_keys	touch
File opened for modification	/root/.ssh/authorized_keys	9a59b9faebdde2a6bb88f3ab0f8b8adc030d534d96a08bc0a1dbbf6b9fcbe56d.sh

Modifies password files for system users/ groups 1 TTPs 4 IoCs

Modifies files storing password hashes of existing users/ groups, likely to grant additional privileges.

persistence credential_access defense_evasion

Pluggable Authentication Modules

T1556.003

description	ioc	Process
File opened for modification	/etc/shadow	useradd
File opened for modification	/etc/passwd	useradd
File opened for modification	/etc/group	useradd
File opened for modification	/etc/gshadow	useradd

OS Credential Dumping 1 TTPs 1 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	useradd

Adds a user to the system 1 IoCs

pid	Process
844	useradd

Enumerates kernel/hardware configuration 1 TTPs 5 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 33 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sshd
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	useradd
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	install
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/757/fd	sshd
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/sys/kernel/ngroups_max	useradd
File opened for reading	/proc/1/environ	systemctl

/tmp/9a59b9faebdde2a6bb88f3ab0f8b8adc030d534d96a08bc0a1dbbf6b9fcbe56d.sh
/tmp/9a59b9faebdde2a6bb88f3ab0f8b8adc030d534d96a08bc0a1dbbf6b9fcbe56d.sh
1⤵
- Adds new SSH keys
PID:726
- /usr/bin/dirname
  dirname /tmp/9a59b9faebdde2a6bb88f3ab0f8b8adc030d534d96a08bc0a1dbbf6b9fcbe56d.sh
  2⤵
  PID:735
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:736
- /bin/cp
  cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak.vnc-lab
  2⤵
  - Reads runtime system information
  PID:741
- /bin/sed
  sed -i "s/^[#]*PasswordAuthentication.*/PasswordAuthentication yes/" /etc/ssh/sshd_config
  2⤵
  - Reads runtime system information
  PID:746
- /bin/sed
  sed -i "s/^[#]*PermitRootLogin.*/PermitRootLogin yes/" /etc/ssh/sshd_config
  2⤵
  - Reads runtime system information
  PID:749
- /bin/sed
  sed -i "s/^[#]*PubkeyAuthentication.*/PubkeyAuthentication yes/" /etc/ssh/sshd_config
  2⤵
  - Reads runtime system information
  PID:751
- /bin/grep
  grep -q "^PasswordAuthentication " /etc/ssh/sshd_config
  2⤵
  PID:752
- /bin/grep
  grep -q "^PermitRootLogin " /etc/ssh/sshd_config
  2⤵
  PID:754
- /bin/grep
  grep -q "^PubkeyAuthentication " /etc/ssh/sshd_config
  2⤵
  PID:756
- /usr/sbin/sshd
  sshd -t
  2⤵
  - Reads runtime system information
  PID:757
- /bin/systemctl
  systemctl enable ssh
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:761
- - /lib/systemd/systemd-sysv-install
    /lib/systemd/systemd-sysv-install enable ssh
    3⤵
    PID:763
  - - /usr/bin/getopt
      getopt -o r: --long root: -- enable ssh
      4⤵
      PID:764
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d ssh defaults
      4⤵
      PID:765
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:767
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:767
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:767
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:767
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:767
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:767
  - - /usr/sbin/update-rc.d
      /usr/sbin/update-rc.d ssh enable
      4⤵
      PID:780
    - - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:781
    - - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:781
    - - /usr/sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:781
    - - /usr/bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:781
    - - /sbin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:781
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:781
- /bin/systemctl
  systemctl enable sshd
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:815
- /bin/systemctl
  systemctl restart ssh
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:817
- /bin/mkdir
  mkdir -p /root/.ssh
  2⤵
  - Reads runtime system information
  PID:828
- /usr/bin/touch
  touch /root/.ssh/authorized_keys
  2⤵
  - Adds new SSH keys
  PID:830
- /bin/grep
  grep -qxF "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzl/BTJNc14ZQkkkYqBZaOQbHvS9s1BBcKItmeEV2+N vnc-lab-coord" /root/.ssh/authorized_keys
  2⤵
  PID:831
- /bin/chmod
  chmod 700 /root/.ssh
  2⤵
  PID:832
- /bin/chmod
  chmod 600 /root/.ssh/authorized_keys
  2⤵
  PID:834
- /usr/bin/getent
  getent passwd scanner
  2⤵
  PID:836
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:837
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:841
- /usr/bin/getent
  getent passwd scaner
  2⤵
  PID:840
- /usr/bin/id
  id vnc-lab
  2⤵
  - Reads runtime system information
  PID:842
- /usr/sbin/useradd
  useradd --system --create-home --home-dir /var/lib/vnc-lab --shell /usr/sbin/nologin vnc-lab
  2⤵
  - Modifies password files for system users/ groups
  - OS Credential Dumping
  - Adds a user to the system
  - Reads runtime system information
  PID:844
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:852
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:853
- - /usr/sbin/nscd
    nscd -i passwd
    3⤵
    PID:855
- - /usr/sbin/nscd
    nscd -i group
    3⤵
    PID:856
- /bin/mkdir
  mkdir -p /var/lib/vnc-lab
  2⤵
  - Reads runtime system information
  PID:857
- /usr/bin/install
  install -m 755 /tmp/vnc-lab /var/lib/vnc-lab/vnc-lab
  2⤵
  - Reads runtime system information
  PID:858

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Privilege Escalation

Account Manipulation

T1098

SSH Authorized Keys

T1098.004

Defense Evasion

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

Credential Access

Modify Authentication Process

T1556

Pluggable Authentication Modules

T1556.003

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

group+

Path /etc/group+
Size 714B
SHA256 f43d8d8a6c1d53da3647274e571328bd7fdd8ee10b25a90b1bd6a4dd55d501b3
MD5 09a2da1736baddd51ad0e146d69c1316
SHA1 e0692d9d91a3e1d92c9d7ce1944ae1ff36ea055e
SHA512 08b67f2c32a907eac4032da976621801d275cd74e0108e690aaf3c7049fe7dbbcf74a43e46c7e7e90742ade6fad10cba9a090db40f8c0b103bee00d54acccea7
TLSH
T1B7016408B808C5588051184A1A765FEA25BA2ECF89ABD5C6D57FC8D87211C331A76CD4
MD5 SHA1 SHA512 TLSH

Submit Download

gshadow+

Path /etc/gshadow+
Size 602B
SHA256 744ff5cdce56c767e4998b6e737735e5b1823ef55bc565ac35e206376d19c210
MD5 803cbe53076e9da389922c0151bc41de
SHA1 daadaff88af259e6b399cce911102d2942958151
SHA512 b2da7773e47185237b58b1d2269c6daef2258e1e41a0caafaf78e7b58be37b402e14cc7051f82b7ee5cf2da091719349ffccf1e5ad547c7ff5210349378d5b43
TLSH
T106F02450B29A84580006184B7FB54E9B282A7A6A84E8C0C3C576C8C71F288FF2A35CF8
MD5 SHA1 SHA512 TLSH

Submit Download

passwd+

Path /etc/passwd+
Size 1KB
SHA256 0f6f79873991bd1fa4e41dd36d47fb761d4d0ca18df913825b9a53218f141333
MD5 b37ca5c41754dd023ff17d69f8144e28
SHA1 be7bb9b13095c1384e60423fc933da5bb83ef075
SHA512 9ac0f3e33089b5396bd8eaa73ec78d00872767db372e3613c6b16a1ed6973b8a56a9f3c72191592febf11cb8af0e91adab6bb560e5ef1f19c3c174034712587a
TLSH
T172313620032990BC9CC1E85A112B7FD414EC78D14A7AFB3DDC7BA144ED8BB6D27648B4
MD5 SHA1 SHA512 TLSH

Submit Download

shadow+

Path /etc/shadow+
Size 890B
SHA256 15e91ed90089c591f82e7b766a6441e28970e1db05d94d2328fbb0af04eea0ef
MD5 4261667c8293d9df4c5f01195c123b13
SHA1 0caea84a58036d28c9594c901c796b07df2b6da4
SHA512 402cc55266f9c3fb66b9c96b9d3eaf98c4e0dc89c65e18cedbf09ef650d2655aac32d46e899d13c775e907edfcd52280e1e68cd075d36866442efae0986d499c
TLSH
T138118180533CEC1843A510DD619206C9D7DF6C760278C18FC817C9374EB48E61329CB6
MD5 SHA1 SHA512 TLSH

Submit Download

sedHXAIrc

Path /etc/ssh/sedHXAIrc
Size 3KB
SHA256 faa382bd15b98d440d6c3b93832ba9d20ca901489c1c7d14854734a745ff04cc
MD5 657ddd030617eba70c4c2556549e7e04
SHA1 239fca30fba77d2c786cea2e1cec896826476e0b
SHA512 e8669861f9d39f6e66e322d10e070710a6bb537968b73da66895b9cd1c3a5f94cc496723a2f81522180dc149c50917fcfca04c17040c5fdd6893454dd4526511
TLSH
T16761A69377A8AD238FC1538F93C155D27772C2BE2DA57C2885A6BC48030F01F4362566
MD5 SHA1 SHA512 TLSH

Submit Download

sedKZrADZ

Path /etc/ssh/sedKZrADZ
Size 3KB
SHA256 b3f45c036083cc8f041acaa9fe942681d9f0f3f3976bcedf41f51b9eaca9c28f
MD5 39d5cf989398cf77318ae3792d691188
SHA1 d1344e6d25ec2703c2ff303d06daeb219a92e5b3
SHA512 aecb8f73b2357a8a23a39f9562bd3dddb5f5ab687f0a1dd7e29dbc10cfb937345833eee7382c70feb821777239985aad2fd6f4d91199d531c092d548a198b01b
TLSH
T1B361859367A8AC238FC1539E93C555D27772C2BE6DA57C2485AABC48030F42F4362667
MD5 SHA1 SHA512 TLSH

Submit Download

sedXibO65

Path /etc/ssh/sedXibO65
Size 3KB
SHA256 5330e74317030c86cf99d822320bf082413b2c48976f9957616fa252cc323586
MD5 b6ec17b91635f523ae0ee3538261bcac
SHA1 10bdd0b012ebed626ad327480c3d0c8c28c7e232
SHA512 6a1a29b2250729cac0b25b5cfc9b49534de914a363868542a7bcc24ddfc605f87d6ddbab02c91da7da1534ece42a5f554c7717f04e552b2319729543971c4fe3
TLSH
T12261A69377A8AC238FC1538F93C155D27772C2BE2DA57C2885AABC48030F01F4362666
MD5 SHA1 SHA512 TLSH

Submit Download

sshd_config.bak.vnc-lab

Path /etc/ssh/sshd_config.bak.vnc-lab
Size 3KB
SHA256 8431c6f565a1a13e95982597051796c564d265706cbce797e33ac223ef136383
MD5 bbad7ed242a834e831c7066901cee49e
SHA1 3b6e6dd3421af3825f7272ecb754d8c4054478ab
SHA512 e70a28f01ac71be989f844b56ff5d398d7d50d4ed4d9ad28646e5aa3a5fcb176eedef9c22335c0b99daa40554f53166c183d1babc51b35aaf35ac9888d26d6cf
TLSH
T14561969367A8AC238FC1538F93C555D27772C2BE6DA57C2485EABC48030F41F4362667
MD5 SHA1 SHA512 TLSH

Submit Download

authorized_keys

Path /root/.ssh/authorized_keys
Size 95B
SHA256 147687b72873c04ebca9b30a5757c80cc0869b50a989cd1e233da4d8271de7e3
MD5 3389f3cbc22107a97b4456f20a99e2f5
SHA1 62081f8d529a7787cb063b6a622f81489077635b
SHA512 ff66a0bcb1064df0be8abfb7feb4091a0610b2fd10522e8d786ad08ec220d27d1e1ae39107e0b32b2cf2b1a1276b0f2512a281d06457ccc6df9a7a0f8dde9182
TLSH
T1F0B0122405C5005545382568590608247D99380B5D88A8276168110CAE6DF053D296AB
MD5 SHA1 SHA512 TLSH

Submit Download

.bash_logout

Path /var/lib/vnc-lab/.bash_logout
Size 220B
SHA256 26882b79471c25f945c970f8233d8ce29d54e9d5eedcd2884f88affa84a18f56
MD5 22bfb8c1dd94b5f3813a2b25da67463f
SHA1 dc216ac4a4c232815731979db6e494f315b507dd
SHA512 c3d739f4934824d81f561c9b626b494e3c256b5a97642667882632db030fc1a8c7d23eb1ae5db7e9f63ae46ee84dbee69d15130dd1482a2c1e8aade1dfc545a2
TLSH
T160D0A74DA8DD2B76601C2C568A46E68030C5180C0A0DBA213055D52D7541378C3911FA
MD5 SHA1 SHA512 TLSH

Submit Download

.bashrc

Path /var/lib/vnc-lab/.bashrc
Size 3KB
SHA256 afae8986f549c6403410e029f9cce7983311512d04b1f02af02e4ce0af0dd2bf
MD5 ee35a240758f374832e809ae0ea4883a
SHA1 1912d65db378e86db92e0ec08c9d90b93e4b0349
SHA512 f44ed7e6ffc61982509b56b9b5dc234838eaf3134c09cec9dc24767149c46373086807c6a96df736de6f7735621b8ee879a0db32cf602305fa75a65bb4f8a7e0
TLSH
T18771B8AAD304E37BAD87419D33DBA1413384F4E26F643F48B058625A7B9315261FA1FC
MD5 SHA1 SHA512 TLSH

Submit Download

.profile

Path /var/lib/vnc-lab/.profile
Size 675B
SHA256 86512cad76131783f5dae4346ddc3fb39f6f7c0f74b3039bff70ca4015ade034
MD5 ecb6d3479ac3823f1da7f314d871989b
SHA1 79d58526d0e0bf4df4f01b383ed3f49c428aaa2a
SHA512 9dc54c15a1103ff44b291241ed514afb89c0bac920ababdb2014379d3dc54ec8f10593301011ca3fcdaeb3a63f8650c7647e8eb2b3abfab2cd86ebc78629cd88
TLSH
T13A01FE27B60E63363AE419F42CD853911B6C30B89AFC7E042068140FBA1616860F73F6
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads