Analysis
- max time kernel
0s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
03/06/2026, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
install-shared-memory.sh
Resource
ubuntu1804-amd64-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
install-shared-memory.sh
Resource
debian9-armhf-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
install-shared-memory.sh
Resource
debian9-mipsbe-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
install-shared-memory.sh
Resource
debian9-mipsel-20260513-en
1 signatures
150 seconds
General
- Target install-shared-memory.sh
- Size 2KB
- Sample260603-pen2kaev3t
- SHA256 bba1f586cb8272167c650eec91e3cb951f3c5b31d4e1716a4cc9b11d47f35288
- MD5 6c2defe4030d58200adf3c4cc82d6f26
- SHA1 d50f2180fa7ba2f82ec5ecfd6c5c63e91c846f94
- SHA512 62b5e42d456eef252ee23b9f62295ad4911014c04605bdabf624bc8552c3c3b6f53e1800b0f1b983ec441d5ad6051111af656850ce8ee9faa6527befdf0c5ba9
- TLSH T19C410036122C91FB7594E3BC305B9ED44906B3A23824EC18F15D7A246BDDBE4B05E332
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/sh-thd.iUYbNO bash
Processes
-
/tmp/install-shared-memory.sh/tmp/install-shared-memory.sh1⤵PID:641
-
/usr/local/sbin/bashbash /tmp/install-shared-memory.sh1⤵PID:641
-
/usr/local/bin/bashbash /tmp/install-shared-memory.sh1⤵PID:641
-
/usr/sbin/bashbash /tmp/install-shared-memory.sh1⤵PID:641
-
/usr/bin/bashbash /tmp/install-shared-memory.sh1⤵PID:641
-
/sbin/bashbash /tmp/install-shared-memory.sh1⤵PID:641
-
/bin/bashbash /tmp/install-shared-memory.sh1⤵
- Writes file to tmp directory
PID:641 -
/bin/catcat2⤵PID:648
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/sh-thd.iUYbNO
- Size 1KB
- SHA256 05ba60d0fd032a315d95ebb675b1b846911e668989f6cfeac76dabe95e2e5f39
- MD5 b95f87868f79de500e45156ddc3c6090
- SHA1 03eb46a1cf6d3d8d7912381ec57cc4d150b3df71
- SHA512 f96b8ba373674ec34f0250247480a89bda58a8458e20dc091de55510717305ec39fa2c8a75d06fd3c9a063adf9246923cfba3ffc0a1a8b4cd474c333a08067d3
- TLSH T1CC117B39212CC5FF7150E37C30576EC06955B3133824AC08B65D76201FDEBA4B10E272
- MD5 SHA1 SHA512 TLSH