082f7685e156738a1b2e2ed8381a621870d4ce8e8c59278034556f05c186eb2e

Analysis

max time kernel
13s
max time network
16s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
02/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dotnet-install.sh
Size 62KB
Sample260602-pf91eses2l
SHA256 082f7685e156738a1b2e2ed8381a621870d4ce8e8c59278034556f05c186eb2e
MD5 bbbd1f898ceb859c30145f6293686e62
SHA1 87591a1214a299e311abd86da144c433dedf7973
SHA512 74c0e9674d98c8676d56929b8afd322cd6b76d0a323099f94f878b5241fbaf5b2ec817278024516e8811274766074963c80f08c26fe974023b308f2c2e94be37
SSDEEP 768:YfYsIleU+7kASqI6vliiWHPkiLTOFnxJF0SW4F:Yoe77TqOLfF
TLSH
T16D53B74ABDC2E1F2110D42AEDAE77081B339415701A94828FC9D76087F656BDE2F279F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.CNViSc	bash

/tmp/dotnet-install.sh
/tmp/dotnet-install.sh
1⤵
PID:714

/usr/local/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:714

/usr/local/bin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:714

/usr/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:714

/usr/bin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:714

/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:714

/bin/bash
bash /tmp/dotnet-install.sh
1⤵
- Writes file to tmp directory
PID:714
- /usr/bin/tput
  tput colors
  2⤵
  PID:727
- /usr/bin/basename
  basename /tmp/dotnet-install.sh
  2⤵
  PID:733
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:738
- /bin/uname
  uname -m
  2⤵
  PID:742
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:746
- /bin/uname
  uname
  2⤵
  PID:750
- /bin/grep
  grep -q musl
  2⤵
  PID:754
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:755
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:760
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:765
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:770
- /bin/uname
  uname
  2⤵
  PID:779
- /bin/grep
  grep -q musl
  2⤵
  PID:782
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:783
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:786
- /usr/bin/curl
  curl -I -sSL --retry 5 --retry-delay 2 --connect-timeout 15 https://aka.ms/dotnet/LTS/dotnet-sdk-linux-x64.tar.gz
  2⤵
  - Reads runtime system information
  PID:788
- /usr/bin/awk
  awk "\$1 ~ /^HTTP/ {print \$2}"
  2⤵
  - Reads runtime system information
  PID:794
- /bin/sed
  sed "\$d"
  2⤵
  - Reads runtime system information
  PID:797
- /bin/grep
  grep -vE "^(301|200)\$"
  2⤵
  PID:798
- /usr/bin/tail
  tail -n 1
  2⤵
  PID:801
- /usr/bin/tail
  tail -1
  2⤵
  PID:805
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:806
- /usr/bin/awk
  awk "\$1 ~ /^Location/{print \$2}"
  2⤵
  - Reads runtime system information
  PID:804
- /usr/bin/curl
  curl -sL --fail https://builds.dotnet.microsoft.com/dotnet/Sdk/10.0.300/sdk-productVersion.txt
  2⤵
  - Reads runtime system information
  PID:811
- /bin/mkdir
  mkdir -p
  2⤵
  - Reads runtime system information
  PID:819

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.CNViSc

Path /tmp/sh-thd.CNViSc
Size 93B
SHA256 3f42fff35ce69ed1fb2858c86866b6f580944ce3d67f4ad0e9b54ac139d236c6
MD5 1906ff3e73f59650cfab25970728b05d
SHA1 d2355a49ee0eebdcc2f7387748d9c321450ec5be
SHA512 a16f1d10d3853fcc5fa700eda4a59bcd4ad59c4698cb9ba5502a48ed7b35c2a6e57f701c85d428313847928f4f3a1e99c814e864e923149b21a4c8103010dd7b
TLSH
T162B01232D0009513CF1927071B30F100DC1B058F3742D2CC44DD43C2C9231CE4053490
MD5 SHA1 SHA512 TLSH

Submit Download