4d6ad3192f300dfbba0e4f5c7a181c4967bc23b4bef535facb25bf892ea8d6ea

Analysis

max time kernel
148s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/06/2026, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffc76abc_Hack.sh
Size 315B
Sample260620-24m7saa14s
SHA256 4d6ad3192f300dfbba0e4f5c7a181c4967bc23b4bef535facb25bf892ea8d6ea
MD5 ee741341b6961b31198dd744630fb594
SHA1 09cc916c7a969def9b20999b566e14bde1a0801e
SHA512 6e1d5c39777fc2b4d21f018e6afb4cffafccce9c794d0092227c6ef11cb945ae552387d8f2bf6104c250c2f6cad64770d496ae5b222e775b91fcff1c6e17d826
TLSH
T141E07284F5403B2A37AE00BC204D695160023E378E0B7200308EA9B81F6A39CF32B23A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 60 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id

/tmp/ffc76abc_Hack.sh
/tmp/ffc76abc_Hack.sh
1⤵
PID:637
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:647
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:657
- /bin/sleep
  sleep 5
  2⤵
  PID:662
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:746
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:748
- /bin/sleep
  sleep 5
  2⤵
  PID:750
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:754
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:756
- /bin/sleep
  sleep 5
  2⤵
  PID:758
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:760
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:762
- /bin/sleep
  sleep 5
  2⤵
  PID:764
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:768
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:770
- /bin/sleep
  sleep 5
  2⤵
  PID:772
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:774
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:776
- /bin/sleep
  sleep 5
  2⤵
  PID:778
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:785
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:787
- /bin/sleep
  sleep 5
  2⤵
  PID:789
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:791
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:793
- /bin/sleep
  sleep 5
  2⤵
  PID:795
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:799
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:801
- /bin/sleep
  sleep 5
  2⤵
  PID:803
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:805
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:807
- /bin/sleep
  sleep 5
  2⤵
  PID:809
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:813
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:815
- /bin/sleep
  sleep 5
  2⤵
  PID:817
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:819
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:821
- /bin/sleep
  sleep 5
  2⤵
  PID:823
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:827
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:829
- /bin/sleep
  sleep 5
  2⤵
  PID:831
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:833
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:835
- /bin/sleep
  sleep 5
  2⤵
  PID:837
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:841
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:843
- /bin/sleep
  sleep 5
  2⤵
  PID:845
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:847
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:849
- /bin/sleep
  sleep 5
  2⤵
  PID:851
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:855
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:857
- /bin/sleep
  sleep 5
  2⤵
  PID:859
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:861
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:863
- /bin/sleep
  sleep 5
  2⤵
  PID:865
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:869
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:871
- /bin/sleep
  sleep 5
  2⤵
  PID:873
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:875
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:877
- /bin/sleep
  sleep 5
  2⤵
  PID:879
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:883
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:885
- /bin/sleep
  sleep 5
  2⤵
  PID:887
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:889
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:891
- /bin/sleep
  sleep 5
  2⤵
  PID:893
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:897
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:899
- /bin/sleep
  sleep 5
  2⤵
  PID:901
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:903
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:905
- /bin/sleep
  sleep 5
  2⤵
  PID:907
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:911
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:913
- /bin/sleep
  sleep 5
  2⤵
  PID:915
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:917
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:919
- /bin/sleep
  sleep 5
  2⤵
  PID:921
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:924
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:926
- /bin/sleep
  sleep 5
  2⤵
  PID:929
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:931
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:933
- /bin/sleep
  sleep 5
  2⤵
  PID:935
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:938
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:940
- /bin/sleep
  sleep 5
  2⤵
  PID:942
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:945
- /usr/bin/id
  id -u " File: \"/dev/console\" ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286"
  2⤵
  - Reads runtime system information
  PID:947
- /bin/sleep
  sleep 5
  2⤵
  PID:949

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads