Overview

overview

3

Static

static

1

marketplac...art.sh

ubuntu-18.04-amd64

3

marketplac...art.sh

debian-9-armhf

3

marketplac...art.sh

debian-9-mips

3

marketplac...art.sh

debian-9-mipsel

3

marketplac...der.py

ubuntu-18.04-amd64

3

marketplac...der.py

debian-9-armhf

3

marketplac...der.py

debian-9-mips

3

marketplac...der.py

debian-9-mipsel

3

marketplac...ine.py

ubuntu-18.04-amd64

3

marketplac...ine.py

debian-9-armhf

3

marketplac...ine.py

debian-9-mips

3

marketplac...ine.py

debian-9-mipsel

3

marketplac...use.py

ubuntu-18.04-amd64

3

marketplac...use.py

debian-9-armhf

3

marketplac...use.py

debian-9-mips

3

marketplac...use.py

debian-9-mipsel

3

marketplac...use.py

ubuntu-18.04-amd64

3

marketplac...use.py

debian-9-armhf

3

marketplac...use.py

debian-9-mips

3

marketplac...use.py

debian-9-mipsel

3

marketplac...top.py

ubuntu-18.04-amd64

3

marketplac...top.py

debian-9-armhf

3

marketplac...top.py

debian-9-mips

3

marketplac...top.py

debian-9-mipsel

3

marketplac...mit.py

ubuntu-18.04-amd64

3

marketplac...mit.py

debian-9-armhf

3

marketplac...mit.py

debian-9-mips

3

marketplac...mit.py

debian-9-mipsel

3

marketplac...art.sh

ubuntu-18.04-amd64

3

marketplac...art.sh

debian-9-armhf

3

marketplac...art.sh

debian-9-mips

3

marketplac...art.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    0s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20250619-en
  • resource tags

    arch:armhfimage:debian9-armhf-20250619-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    09/05/2026, 00:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh
  • Size 1KB
  • Sample260509-anpbcsby6j
  • SHA256 58efe97b7f5ccd384e0ee12a2f3dd2e75a38df35841a1b27ea6d9eb833c28912
  • MD5 SHA1 SHA512 TLSH
Score
3/10

Malware Config

Signatures

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh
    /tmp/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh
    1⤵
      PID:667
    • /usr/local/sbin/bash
      bash /tmp/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh
      1⤵
        PID:667
      • /usr/local/bin/bash
        bash /tmp/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh
        1⤵
          PID:667
        • /usr/sbin/bash
          bash /tmp/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh
          1⤵
            PID:667
          • /usr/bin/bash
            bash /tmp/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh
            1⤵
              PID:667
            • /sbin/bash
              bash /tmp/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh
              1⤵
                PID:667
              • /bin/bash
                bash /tmp/marketplaces/claude-plugins-official/plugins/explanatory-output-style/hooks-handlers/session-start.sh
                1⤵
                • Writes file to tmp directory
                PID:667
                • /bin/cat
                  cat
                  2⤵
                    PID:668

                Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      sh-thd.li44rG
                      • Path /tmp/sh-thd.li44rG
                      • Size 1KB
                      • SHA256 e5e41de3a88fe84c15ea7db40838fc628dd8fa22cc384f74f4bbeb6f30b6c1a9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download