963b06d98c115aa44fff216ee477e49d66072df33838be1bb1f141dedf6c4d02

Analysis

max time kernel
3s
max time network
493s
platform
debian-9_mipsel
resource
debian9-mipsel-20240611-en
resource tags

arch:mipselimage:debian9-mipsel-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
28/03/2025, 12:35

Target

resources/app/bin/lpm_downgrade.sh
Size

486B
MD5

c2913650e886be90c3dc3464cf257124
SHA1

5f3a2794a1c3be209f5074d73a6485b48a4e98ba
SHA256

c00ee8c9bf0002b7b3a5cbc7c25f3dd7d2846950826f70a79ed66ad8d180d202
SHA512

e7528a5266b8a1c8fb895656bb6dfea67eb7e094a442e93ab51d3a01f4bf3c48048a729a84a8a0a12223fd021bcf773055115533fe6590850fb4ab0b5aec717d

Score

3^/10

discovery

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/sys/crypto/fips_enabled	curl

/tmp/resources/app/bin/lpm_downgrade.sh
/tmp/resources/app/bin/lpm_downgrade.sh
1⤵
PID:811

/bin/bash
bash /tmp/resources/app/bin/lpm_downgrade.sh
1⤵
PID:811
- /usr/bin/dirname
  dirname /tmp/resources/app/bin/lpm_downgrade.sh
  2⤵
  PID:812
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:814
- /bin/date
  date "+%s000"
  2⤵
  PID:820
- /bin/uname
  uname -r
  2⤵
  PID:822
- /usr/bin/tr
  tr -dc a-zA-Z0-9
  2⤵
  PID:825
- /usr/bin/head
  head -80 /dev/urandom
  2⤵
  PID:824
- /usr/bin/fold
  fold -w 32
  2⤵
  PID:826
- /usr/bin/head
  head -1
  2⤵
  PID:827
- /bin/uname
  uname -s
  2⤵
  PID:829
- /bin/date
  date "+%s"
  2⤵
  PID:831
- /usr/bin/curl
  curl -s -X POST "https://perr.lum-lpm.com/client_cgi/perr/?id=lpm_cert.downgrade_no_backup" --data "{\"uuid\": \"54eXBQHSkqlFnXmZwManasl6g6t6SYMu\", \"timestamp\": \"1743162419\", \"ver\": \"%VER%\", \"info\": {\"platform\": \"linux\", \"c_ts\": \"1743162419\", \"c_up_ts\": \"1743162419000\", \"note\": \"\", \"lum\": 0, \"root\":1, \"os_release\":\"4.9.0-13-4kc-malta\"}}" -H "Content-Type: application/json"
  2⤵
  - Reads runtime system information
  PID:832