Overview

overview

3

Static

static

1

marketplac...art.sh

ubuntu-18.04-amd64

3

marketplac...art.sh

debian-9-armhf

3

marketplac...art.sh

debian-9-mips

3

marketplac...art.sh

debian-9-mipsel

3

marketplac...der.py

ubuntu-18.04-amd64

3

marketplac...der.py

debian-9-armhf

3

marketplac...der.py

debian-9-mips

3

marketplac...der.py

debian-9-mipsel

3

marketplac...ine.py

ubuntu-18.04-amd64

3

marketplac...ine.py

debian-9-armhf

3

marketplac...ine.py

debian-9-mips

3

marketplac...ine.py

debian-9-mipsel

3

marketplac...use.py

ubuntu-18.04-amd64

3

marketplac...use.py

debian-9-armhf

3

marketplac...use.py

debian-9-mips

3

marketplac...use.py

debian-9-mipsel

3

marketplac...use.py

ubuntu-18.04-amd64

3

marketplac...use.py

debian-9-armhf

3

marketplac...use.py

debian-9-mips

3

marketplac...use.py

debian-9-mipsel

3

marketplac...top.py

ubuntu-18.04-amd64

3

marketplac...top.py

debian-9-armhf

3

marketplac...top.py

debian-9-mips

3

marketplac...top.py

debian-9-mipsel

3

marketplac...mit.py

ubuntu-18.04-amd64

3

marketplac...mit.py

debian-9-armhf

3

marketplac...mit.py

debian-9-mips

3

marketplac...mit.py

debian-9-mipsel

3

marketplac...art.sh

ubuntu-18.04-amd64

3

marketplac...art.sh

debian-9-armhf

3

marketplac...art.sh

debian-9-mips

3

marketplac...art.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    0s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    02/06/2026, 12:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    marketplaces/claude-plugins-official/plugins/learning-output-style/hooks-handlers/session-start.sh
  • Size 3KB
  • Sample260602-pdndmscx41
  • SHA256 2b2ef02fffeb9df6d587a3180ab3bb06e1364a75f70e2f534045b599b953731e
  • MD5 SHA1 SHA512 TLSH
Score
3/10

Malware Config

Signatures

  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/marketplaces/claude-plugins-official/plugins/learning-output-style/hooks-handlers/session-start.sh
    /tmp/marketplaces/claude-plugins-official/plugins/learning-output-style/hooks-handlers/session-start.sh
    1⤵
      PID:668
    • /usr/local/sbin/bash
      bash /tmp/marketplaces/claude-plugins-official/plugins/learning-output-style/hooks-handlers/session-start.sh
      1⤵
        PID:668
      • /usr/local/bin/bash
        bash /tmp/marketplaces/claude-plugins-official/plugins/learning-output-style/hooks-handlers/session-start.sh
        1⤵
          PID:668
        • /usr/sbin/bash
          bash /tmp/marketplaces/claude-plugins-official/plugins/learning-output-style/hooks-handlers/session-start.sh
          1⤵
            PID:668
          • /usr/bin/bash
            bash /tmp/marketplaces/claude-plugins-official/plugins/learning-output-style/hooks-handlers/session-start.sh
            1⤵
              PID:668
            • /sbin/bash
              bash /tmp/marketplaces/claude-plugins-official/plugins/learning-output-style/hooks-handlers/session-start.sh
              1⤵
                PID:668
              • /bin/bash
                bash /tmp/marketplaces/claude-plugins-official/plugins/learning-output-style/hooks-handlers/session-start.sh
                1⤵
                • Writes file to tmp directory
                PID:668
                • /bin/cat
                  cat
                  2⤵
                    PID:669

                Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      sh-thd.94QtTc
                      • Path /tmp/sh-thd.94QtTc
                      • Size 3KB
                      • SHA256 0032413bcff8c44305456cb0bd6bfc7ea56be4f4188c89211f240f9419b7253d
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download