2a94c7ec2e926f239240718a0f64b072f11b9bbc9390854c016512c517be36de

Resubmissions

04/06/2026, 22:47

260604-2qrcaagt8z8

04/06/2026, 22:25

260604-2b2vgagt2v8

04/06/2026, 21:13

260604-z2vgzafz8n8

Analysis

max time kernel
44s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/06/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LinuxScript.sh
Size 691B
Sample260604-2b2vgagt2v
SHA256 2a94c7ec2e926f239240718a0f64b072f11b9bbc9390854c016512c517be36de
MD5 e2d9d185c0ceefbe001d285710e41ae4
SHA1 450d5fd3cc6e4e712268dddea761a7e792322e12
SHA512 47def885b16c42a8c57bf17119740cdc8d7dd861c1ce92dcf93cc80208f03bd4d3218f95db6cf52545b47c8513329e228bbddc09a83b01a4dd4cf4cac0221db4
TLSH
T12701C01DE638AD3D2D6003195A5FF7ACC2CE113AC04A72D47925531686EE057E8459B9
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Uses Polkit to run commands 1 IoCs

Uses Polkit pkexec as a proxy to execute commands, possibly to bypass security restrictions.

pid	Process
798	pkexec

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	gmain	803	pkexec
Changes the process name, possibly in an attempt to hide itself	gdbus	804	pkexec

Reads CPU attributes 1 TTPs 38 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/788/stat	ps
File opened for reading	/proc/136/stat	ps
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/293/stat	ps
File opened for reading	/proc/27/status	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/75/status	ps
File opened for reading	/proc/325/stat	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/866/status	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/107/status	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/580/status	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/791/stat	ps
File opened for reading	/proc/599/stat	ps
File opened for reading	/proc/794/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/142/status	ps
File opened for reading	/proc/798/status	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/107/stat	ps
File opened for reading	/proc/97/stat	ps
File opened for reading	/proc/798/stat	ps
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/604/stat	ps
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/799/stat	ps
File opened for reading	/proc/580/stat	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/870/status	ps
File opened for reading	/proc/140/status	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/105/stat	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/325/stat	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/604/stat	ps
File opened for reading	/proc/239/stat	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/325/stat	ps
File opened for reading	/proc/42/stat	ps
File opened for reading	/proc/170/status	ps
File opened for reading	/proc/292/stat	ps
File opened for reading	/proc/780/stat	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/912/stat	ps
File opened for reading	/proc/919/status	ps

System Network Configuration Discovery 1 TTPs 9 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
794	sh
794	sh
794	sh
794	sh
796	dirname
794	sh
794	sh
797	realpath
794	LinuxScript.sh

/tmp/LinuxScript.sh
/tmp/LinuxScript.sh
1⤵
- System Network Configuration Discovery
PID:794

/usr/local/sbin/sh
sh /tmp/LinuxScript.sh
1⤵
- System Network Configuration Discovery
PID:794

/usr/local/bin/sh
sh /tmp/LinuxScript.sh
1⤵
- System Network Configuration Discovery
PID:794

/usr/sbin/sh
sh /tmp/LinuxScript.sh
1⤵
- System Network Configuration Discovery
PID:794

/usr/bin/sh
sh /tmp/LinuxScript.sh
1⤵
- System Network Configuration Discovery
PID:794

/sbin/sh
sh /tmp/LinuxScript.sh
1⤵
- System Network Configuration Discovery
PID:794

/bin/sh
sh /tmp/LinuxScript.sh
1⤵
- System Network Configuration Discovery
PID:794
- /usr/bin/realpath
  realpath -- /tmp/LinuxScript.sh
  2⤵
  - System Network Configuration Discovery
  PID:797
- /usr/bin/dirname
  dirname -- /tmp/LinuxScript.sh
  2⤵
  - System Network Configuration Discovery
  PID:796
- /usr/bin/pkexec
  pkexec sh -c " cd \"/tmp\" \"/tmp/KanvasWebserverLinux\" & # Wait for KanvasLauncher to start while ! ps -A | grep -w KanvasLauncher | grep -v grep > /dev/null; do sleep 1 done # Wait for KanvasLauncher process to finish while ps -A | grep KanvasLauncher | grep -v grep > /dev/null; do sleep 1 done # Close KanvasWebserver nicely pkill KanvasWebserverLinux "
  2⤵
  - Uses Polkit to run commands
  - Changes its process name
  PID:798
- /bin/sh
  /bin/sh -c " cd \"/tmp\" \"/tmp/KanvasWebserverLinux\" & # Wait for KanvasLauncher to start while ! ps -A | grep -w KanvasLauncher | grep -v grep > /dev/null; do sleep 1 done # Wait for KanvasLauncher process to finish while ps -A | grep KanvasLauncher | grep -v grep > /dev/null; do sleep 1 done # Close KanvasWebserver nicely pkill KanvasWebserverLinux "
  2⤵
  PID:798
- - /tmp/KanvasWebserverLinux
    /tmp/KanvasWebserverLinux
    3⤵
    PID:809
- - /bin/grep
    grep -v grep
    3⤵
    PID:812
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:811
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    PID:810
- - /bin/sleep
    sleep 1
    3⤵
    PID:813
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:815
- - /bin/grep
    grep -v grep
    3⤵
    PID:816
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:814
- - /bin/sleep
    sleep 1
    3⤵
    PID:817
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:819
- - /bin/grep
    grep -v grep
    3⤵
    PID:820
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    PID:818
- - /bin/sleep
    sleep 1
    3⤵
    PID:821
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:823
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    PID:822
- - /bin/grep
    grep -v grep
    3⤵
    PID:824
- - /bin/sleep
    sleep 1
    3⤵
    PID:825
- - /bin/grep
    grep -v grep
    3⤵
    PID:828
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:827
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:826
- - /bin/sleep
    sleep 1
    3⤵
    PID:829
- - /bin/grep
    grep -v grep
    3⤵
    PID:832
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:830
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:831
- - /bin/sleep
    sleep 1
    3⤵
    PID:833
- - /bin/grep
    grep -v grep
    3⤵
    PID:836
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:835
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:834
- - /bin/sleep
    sleep 1
    3⤵
    PID:837
- - /bin/grep
    grep -v grep
    3⤵
    PID:840
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:839
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:838
- - /bin/sleep
    sleep 1
    3⤵
    PID:841
- - /bin/grep
    grep -v grep
    3⤵
    PID:844
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:843
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:842
- - /bin/sleep
    sleep 1
    3⤵
    PID:845
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:849
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:848
- - /bin/grep
    grep -v grep
    3⤵
    PID:850
- - /bin/sleep
    sleep 1
    3⤵
    PID:851
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:853
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:852
- - /bin/grep
    grep -v grep
    3⤵
    PID:854
- - /bin/sleep
    sleep 1
    3⤵
    PID:855
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:857
- - /bin/grep
    grep -v grep
    3⤵
    PID:858
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:856
- - /bin/sleep
    sleep 1
    3⤵
    PID:859
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:861
- - /bin/grep
    grep -v grep
    3⤵
    PID:862
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:860
- - /bin/sleep
    sleep 1
    3⤵
    PID:863
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:865
- - /bin/grep
    grep -v grep
    3⤵
    PID:866
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:864
- - /bin/sleep
    sleep 1
    3⤵
    PID:867
- - /bin/grep
    grep -v grep
    3⤵
    PID:870
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:868
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:869
- - /bin/sleep
    sleep 1
    3⤵
    PID:871
- - /bin/grep
    grep -v grep
    3⤵
    PID:874
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:873
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:872
- - /bin/sleep
    sleep 1
    3⤵
    PID:875
- - /bin/grep
    grep -v grep
    3⤵
    PID:878
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:876
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:877
- - /bin/sleep
    sleep 1
    3⤵
    PID:879
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:881
- - /bin/grep
    grep -v grep
    3⤵
    PID:882
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    PID:880
- - /bin/sleep
    sleep 1
    3⤵
    PID:883
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:887
- - /bin/grep
    grep -v grep
    3⤵
    PID:888
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:886
- - /bin/sleep
    sleep 1
    3⤵
    PID:889
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    PID:890
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:891
- - /bin/grep
    grep -v grep
    3⤵
    PID:892
- - /bin/sleep
    sleep 1
    3⤵
    PID:893
- - /bin/grep
    grep -v grep
    3⤵
    PID:896
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:895
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:894
- - /bin/sleep
    sleep 1
    3⤵
    PID:897
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:899
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:898
- - /bin/grep
    grep -v grep
    3⤵
    PID:900
- - /bin/sleep
    sleep 1
    3⤵
    PID:901
- - /bin/grep
    grep -v grep
    3⤵
    PID:904
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:902
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:903
- - /bin/sleep
    sleep 1
    3⤵
    PID:905
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:907
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:906
- - /bin/grep
    grep -v grep
    3⤵
    PID:908
- - /bin/sleep
    sleep 1
    3⤵
    PID:909
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:911
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:910
- - /bin/grep
    grep -v grep
    3⤵
    PID:912
- - /bin/sleep
    sleep 1
    3⤵
    PID:913
- - /bin/grep
    grep -v grep
    3⤵
    PID:916
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:914
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:915
- - /bin/sleep
    sleep 1
    3⤵
    PID:917
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:919
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:918
- - /bin/grep
    grep -v grep
    3⤵
    PID:920
- - /bin/sleep
    sleep 1
    3⤵
    PID:921
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:925
- - /bin/grep
    grep -v grep
    3⤵
    PID:926
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:924
- - /bin/sleep
    sleep 1
    3⤵
    PID:927
- - /bin/grep
    grep -v grep
    3⤵
    PID:930
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:928
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:929
- - /bin/sleep
    sleep 1
    3⤵
    PID:931
- - /bin/grep
    grep -v grep
    3⤵
    PID:934
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:932
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:933
- - /bin/sleep
    sleep 1
    3⤵
    PID:935
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:937
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:936
- - /bin/grep
    grep -v grep
    3⤵
    PID:938
- - /bin/sleep
    sleep 1
    3⤵
    PID:939
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:941
- - /bin/grep
    grep -v grep
    3⤵
    PID:942
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    PID:940
- - /bin/sleep
    sleep 1
    3⤵
    PID:943
- - /bin/grep
    grep -v grep
    3⤵
    PID:946
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:945
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:944
- - /bin/sleep
    sleep 1
    3⤵
    PID:947
- - /bin/grep
    grep -v grep
    3⤵
    PID:950
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:949
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:948
- - /bin/sleep
    sleep 1
    3⤵
    PID:951
- - /bin/grep
    grep -v grep
    3⤵
    PID:954
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:953
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:952
- - /bin/sleep
    sleep 1
    3⤵
    PID:955
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:957
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:956
- - /bin/grep
    grep -v grep
    3⤵
    PID:958
- - /bin/sleep
    sleep 1
    3⤵
    PID:959
- - /bin/grep
    grep -v grep
    3⤵
    PID:964
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:962
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:963
- - /bin/sleep
    sleep 1
    3⤵
    PID:965
- - /bin/grep
    grep -v grep
    3⤵
    PID:968
- - /bin/grep
    grep -w KanvasLauncher
    3⤵
    PID:967
- - /bin/ps
    ps -A
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:966
- - /bin/sleep
    sleep 1
    3⤵
    PID:969

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads