Overview

overview

4

Static

static

1

k.php.sh

ubuntu-18.04-amd64

4

k.php.sh

debian-9-armhf

4

k.php.sh

debian-9-mips

4

k.php.sh

debian-9-mipsel

4

Analysis

  • max time kernel
    0s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260126-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    27/02/2026, 08:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    k.php.sh
  • Size 19KB
  • Sample260227-krq98saw4e
  • SHA256 2b654efe975b48090dde223a41fa2f9ff2b09b80fcf700a2ef49b7aa6c5c48b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
defense_evasiondiscovery

Malware Config

Signatures

  • Deobfuscate/Decode Files or Information 1 TTPs 3 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Reads runtime system information 29 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/k.php.sh
    /tmp/k.php.sh
    1⤵
    • Writes file to tmp directory
    PID:1526
    • /bin/mkdir
      mkdir -p /var/www/html/digium_phones/
      2⤵
      • Reads runtime system information
      PID:1529
    • /bin/mkdir
      mkdir -p /var/www/html/rest_phones/
      2⤵
      • Reads runtime system information
      PID:1530
    • /bin/mkdir
      mkdir -p /var/www/html/digium_phoness/
      2⤵
      • Reads runtime system information
      PID:1531
    • /bin/mkdir
      mkdir -p /var/www/html/phones/
      2⤵
      • Reads runtime system information
      PID:1532
    • /bin/mkdir
      mkdir -p /var/www/html/fpbxphones/
      2⤵
      • Reads runtime system information
      PID:1533
    • /bin/mkdir
      mkdir -p /var/www/html/freepbxphones/
      2⤵
      • Reads runtime system information
      PID:1534
    • /bin/mkdir
      mkdir -p /var/www/html/freepbx/
      2⤵
      • Reads runtime system information
      PID:1535
    • /bin/cp
      cp /var/www/html/admin/views/ajax.php /var/www/html/rest_phones/ajax.php
      2⤵
      • Reads runtime system information
      PID:1536
    • /bin/cp
      cp /var/www/html/admin/views/ajax.php /var/www/html/admin/modules/core/ajax.php
      2⤵
      • Reads runtime system information
      PID:1537
    • /bin/cp
      cp /var/www/html/admin/views/ajax.php /var/www/html/digium_phones/ajax.php
      2⤵
      • Reads runtime system information
      PID:1538
    • /bin/cp
      cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/js/config.php
      2⤵
      • Reads runtime system information
      PID:1539
    • /bin/cp
      cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/config.php
      2⤵
      • Reads runtime system information
      PID:1540
    • /bin/cp
      cp /var/www/html/admin/views/ajax.php /var/www/html/admin/assets/ajax.php
      2⤵
      • Reads runtime system information
      PID:1541
    • /bin/cp
      cp /var/www/html/rest_phones/ajax.php /var/www/html/admin/modules/core/ajax.php
      2⤵
      • Reads runtime system information
      PID:1542
    • /bin/cp
      cp /var/www/html/rest_phones/ajax.php /var/www/html/admin/assets/js/config.php
      2⤵
      • Reads runtime system information
      PID:1543
    • /bin/cp
      cp /var/www/html/rest_phones/ajax.php /var/www/html/admin/assets/config.php
      2⤵
      • Reads runtime system information
      PID:1544
    • /bin/cp
      cp /var/www/html/rest_phones/ajax.php /var/www/html/admin/assets/ajax.php
      2⤵
      • Reads runtime system information
      PID:1545
    • /bin/cp
      cp /var/www/html/rest_phones/ajax.php /var/www/html/phones/ajax.php
      2⤵
      • Reads runtime system information
      PID:1546
    • /bin/cp
      cp /var/www/html/rest_phones/ajax.php /var/www/html/digium_phoness/ajax.php
      2⤵
      • Reads runtime system information
      PID:1547
    • /bin/cp
      cp /var/www/html/rest_phones/ajax.php /var/www/html/fpbxphones/ajax.php
      2⤵
      • Reads runtime system information
      PID:1548
    • /bin/cp
      cp /var/www/html/rest_phones/ajax.php /var/www/html/freepbxphones/ajax.php
      2⤵
      • Reads runtime system information
      PID:1549
    • /bin/cp
      cp /var/www/html/rest_phones/ajax.php /var/www/html/freepbx/ajax.php
      2⤵
      • Reads runtime system information
      PID:1550
    • /usr/bin/touch
      touch /var/www/html/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
      2⤵
        PID:1551
      • /usr/bin/base64
        base64 -d
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:1555
      • /bin/bash
        bash /tmp/test.sh
        2⤵
          PID:1556
          • /bin/ls
            ls -la
            3⤵
            • Reads runtime system information
            PID:1559
          • /bin/cat
            cat /etc/passwd
            3⤵
              PID:1560
            • /bin/ls
              ls -ls /home
              3⤵
              • Reads runtime system information
              PID:1561
            • /bin/mkdir
              mkdir -p /var/www/html/admin/modules/freepbx_ha/
              3⤵
              • Reads runtime system information
              PID:1562
            • /bin/mv
              mv /var/www/html/admin/modules/freepbx_ha/license.php /var/www/html/admin/modules/freepbx_ha/license
              3⤵
              • Reads runtime system information
              PID:1563
            • /usr/bin/base64
              base64 -d
              3⤵
              • Deobfuscate/Decode Files or Information
              PID:1565
            • /bin/rm
              rm -rf /var/www/html/admin/modules/freepbx_ha/license.php mv /var/www/html/admin/modules/freepbx_ha/license /var/www/html/admin/modules/freepbx_ha/license.php
              3⤵
                PID:1566
              • /bin/ls
                ls -la
                3⤵
                • Reads runtime system information
                PID:1567
              • /usr/bin/base64
                base64 -d
                3⤵
                • Deobfuscate/Decode Files or Information
                PID:1569
              • /bin/ls
                ls -la
                3⤵
                • Reads runtime system information
                PID:1570
              • /bin/cat
                cat /etc/passwd
                3⤵
                  PID:1571
                • /bin/ls
                  ls -ls /home
                  3⤵
                  • Reads runtime system information
                  PID:1572
              • /bin/rm
                rm -rf /tmp/test.sh
                2⤵
                  PID:1573
                • /bin/bash
                  bash /var/spool/asterisk/tmp/test.sh
                  2⤵
                    PID:1576
                  • /bin/rm
                    rm -rf /var/spool/asterisk/tmp/test.sh
                    2⤵
                      PID:1577

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        test.sh
                        • Path /tmp/test.sh
                        • Size 4KB
                        • SHA256 0cc9d103b3f45a593a84a1e4ef3cd7852abc5f3598b5adb01ea69dc425cddb09
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download