96697e9ef6a795d45863c91d61be85a9f138596e3151e7c2cd63ccf48aaa8783 | Triage™

Analysis

max time kernel
0s
max time network
132s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20251216-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20251216-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
18/12/2025, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hashcat-6.2.6/extra/tab_completion/install
Size 2KB
Sample251218-pgdzdawjer
SHA256 e7a729a4d10acecf569c974bfcde4595cafce2f9551d07be81ce75e0a616b99c
MD5 653d1385632721bdfb60b6796e7a6539
SHA1 d9b8fc7025fb8b05d2dd6386e7f7d50a0df54ee5
SHA512 bc41a12de23c07335c849916bcb12731ed3a2eba0c8ac2b41402031641038eaea6750cb9813a76b95fd524963c917444a613fe6fd0d9d6a23b8234429701ce34
MD5 SHA1 SHA512

Score

6^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Creates/modifies environment variables 1 TTPs 1 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

description	ioc	Process
File opened for modification	/root/.bashrc	install

Modifies Bash startup script 2 TTPs 1 IoCs

Boot or Logon Autostart Execution

Unix Shell Configuration Modification

description	ioc	Process
File opened for modification	/root/.bashrc	install

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	id

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.Kf6lsR	install

/tmp/hashcat-6.2.6/extra/tab_completion/install
/tmp/hashcat-6.2.6/extra/tab_completion/install
1⤵
- Creates/modifies environment variables
- Modifies Bash startup script
- Writes file to tmp directory
PID:1516
- /usr/bin/dirname
  dirname /tmp/hashcat-6.2.6/extra/tab_completion/install
  2⤵
  PID:1519
- /usr/bin/id
  id -g
  2⤵
  - Reads runtime system information
  PID:1521
- /bin/rm
  rm -f /etc/bash_completion.d/hashcat.sh/hashcat64.sh
  2⤵
  PID:1522
- /bin/cp
  cp /tmp/hashcat-6.2.6/extra/tab_completion/hashcat.sh /etc/bash_completion.d/hashcat.sh
  2⤵
  - Reads runtime system information
  PID:1523
- /bin/sed
  sed -ri "s!^(ROOT=).*!\\1\"/tmp/hashcat-6.2.6/extra\"!" /etc/bash_completion.d/hashcat.sh
  2⤵
  - Reads runtime system information
  PID:1524
- /bin/egrep
  egrep -q "^[^#]*\\. */etc/bash_completion" /root/.bashrc
  2⤵
  PID:1525
- /usr/local/sbin/grep
  grep -E -q "^[^#]*\\. */etc/bash_completion" /root/.bashrc
  2⤵
  PID:1525
- /usr/local/bin/grep
  grep -E -q "^[^#]*\\. */etc/bash_completion" /root/.bashrc
  2⤵
  PID:1525
- /usr/sbin/grep
  grep -E -q "^[^#]*\\. */etc/bash_completion" /root/.bashrc
  2⤵
  PID:1525
- /usr/bin/grep
  grep -E -q "^[^#]*\\. */etc/bash_completion" /root/.bashrc
  2⤵
  PID:1525
- /sbin/grep
  grep -E -q "^[^#]*\\. */etc/bash_completion" /root/.bashrc
  2⤵
  PID:1525
- /bin/grep
  grep -E -q "^[^#]*\\. */etc/bash_completion" /root/.bashrc
  2⤵
  PID:1525
- /bin/cat
  cat
  2⤵
  PID:1526

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Event Triggered Execution

Unix Shell Configuration Modification

Hijack Execution Flow

Path Interception by PATH Environment Variable

Privilege Escalation

Boot or Logon Autostart Execution

Event Triggered Execution

Unix Shell Configuration Modification

Hijack Execution Flow

Path Interception by PATH Environment Variable

Defense Evasion

Hijack Execution Flow

Path Interception by PATH Environment Variable

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hashcat.sh

Path /etc/bash_completion.d/hashcat.sh
Size 28KB
SHA256 cf4e7e696f932d642d8d53328376fff43fdb157bc8bab843d344b44f060de1c5
MD5 e6b0bf3f2e4b12e3feb93e7f7a8e886a
SHA1 7d79389c3fc25475c60cc6b39d9b4cb2f37cd955
SHA512 3e4faa284dd505d198240eb005d9d078522c79d7389e4f818e1ac73ed7bcdb6b28a4875ee5d71122da88cee84c50cf33f8b48e74f63379fbbf55bf8046892fe6
SSDEEP 384:1p/pA8wgCXPSaRJHDGX+2aIZECKVjeAsb+xUvuxmg9:1VePS8JHDj2aEECKVjT
MD5 SHA1 SHA512 SSDEEP

Submit Download

sh-thd.Kf6lsR

Path /tmp/sh-thd.Kf6lsR
Size 71B
SHA256 ed6e772f6da870022de76617eeba5585870f6c63f3d78b98b5af9d32931159ca
MD5 2d3a6be44a77b3a118c669c0b01994de
SHA1 d47260c81421dcb0f909ceaa290240844eba293d
SHA512 265915c63d4edf4ddced5ec4ba26053b03902cf381a499828889786185fb30d1e84042d673cf4ac02971a850f81eb568a0ce4f83c44c35ec3cb0ccf01f1c0670
MD5 SHA1 SHA512

Submit Download