082f7685e156738a1b2e2ed8381a621870d4ce8e8c59278034556f05c186eb2e

Analysis

max time kernel
5s
max time network
6s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dotnet-install.sh
Size 62KB
Sample260602-pf91eses2l
SHA256 082f7685e156738a1b2e2ed8381a621870d4ce8e8c59278034556f05c186eb2e
MD5 bbbd1f898ceb859c30145f6293686e62
SHA1 87591a1214a299e311abd86da144c433dedf7973
SHA512 74c0e9674d98c8676d56929b8afd322cd6b76d0a323099f94f878b5241fbaf5b2ec817278024516e8811274766074963c80f08c26fe974023b308f2c2e94be37
SSDEEP 768:YfYsIleU+7kASqI6vliiWHPkiLTOFnxJF0SW4F:Yoe77TqOLfF
TLSH
T16D53B74ABDC2E1F2110D42AEDAE77081B339415701A94828FC9D76087F656BDE2F279F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/maps	awk

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.7UxXPy	bash

/tmp/dotnet-install.sh
/tmp/dotnet-install.sh
1⤵
PID:659

/usr/local/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:659

/usr/local/bin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:659

/usr/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:659

/usr/bin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:659

/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:659

/bin/bash
bash /tmp/dotnet-install.sh
1⤵
- Writes file to tmp directory
PID:659
- /usr/bin/tput
  tput colors
  2⤵
  PID:673
- /usr/bin/basename
  basename /tmp/dotnet-install.sh
  2⤵
  PID:681
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:687
- /bin/uname
  uname -m
  2⤵
  PID:691
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:696
- /bin/uname
  uname
  2⤵
  PID:699
- /bin/grep
  grep -q musl
  2⤵
  PID:702
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:703
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:708
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:712
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:716
- /bin/uname
  uname
  2⤵
  PID:724
- /bin/grep
  grep -q musl
  2⤵
  PID:727
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:728
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:731
- /usr/bin/curl
  curl -I -sSL --retry 5 --retry-delay 2 --connect-timeout 15 https://aka.ms/dotnet/LTS/dotnet-sdk-linux-arm.tar.gz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:733
- /usr/bin/awk
  awk "\$1 ~ /^HTTP/ {print \$2}"
  2⤵
  - Reads runtime system information
  PID:754
- /bin/grep
  grep -vE "^(301|200)\$"
  2⤵
  PID:760
- /bin/sed
  sed "\$d"
  2⤵
  - Reads runtime system information
  PID:759
- /usr/bin/tail
  tail -n 1
  2⤵
  PID:764
- /usr/bin/awk
  awk "\$1 ~ /^Location/{print \$2}"
  2⤵
  - Reads runtime system information
  PID:768
- /usr/bin/tail
  tail -1
  2⤵
  PID:769
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:770
- /usr/bin/curl
  curl -sL --fail https://builds.dotnet.microsoft.com/dotnet/Sdk/10.0.300/sdk-productVersion.txt
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:779
- /bin/mkdir
  mkdir -p
  2⤵
  - Reads runtime system information
  PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.7UxXPy

Path /tmp/sh-thd.7UxXPy
Size 93B
SHA256 b226a7e0fa54a678fafa28c64b3eabe8d7782f372a2665552c92ab684cfd5692
MD5 babde28f9aa9ce20de302e640b046274
SHA1 362146775741e52e6a982c9710ebff2cc222597d
SHA512 13d995ef632a4231c742afe9742142de965a3c8e5f7be59ee0e78c91a61f3c4adc4a8f1e9727733d3baa232cc54b748a73ea03d3655b639111605b6c7acaa52c
TLSH
T176B09222C0015413CF142B461B20B100DC1A059F3642D18C40DC43C2C92218D4052890
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads