bf1741518265388933600614e165d73237c44dcd6b2d9dcde7cd2bb3ea177b42

Analysis

max time kernel
148s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
01/07/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_bf1741518265388933600614e165d73237c44dcd6b2d9dcde7cd2bb3ea177b42.sh
Size 204B
Sample260701-xta29aex8x
SHA256 bf1741518265388933600614e165d73237c44dcd6b2d9dcde7cd2bb3ea177b42
MD5 3f619f2a1852861cce566d6539d49907
SHA1 e52460032d082b5b99270ec7d7aff98d88e3b814
SHA512 695e688a277723ec87e8dff70a53614787a52623c5044b5969c0f282d66d2cee0d0aa1417bc9c5fd5925a7a00a79cc562bea6e56d9d7e2143ebc1e15a394f9e3
TLSH
T193D02240F1503F387BF40905848AE8D0FA070FF4CE1D13B0308A84A3B0E910CE0B6E10
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 30 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/81/status	ps
File opened for reading	/proc/793/status	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/111/stat	ps
File opened for reading	/proc/114/stat	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/648/stat	ps
File opened for reading	/proc/228/status	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/157/status	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/6/status	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/312/stat	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/103/status	ps
File opened for reading	/proc/900/status	ps
File opened for reading	/proc/113/stat	ps
File opened for reading	/proc/645/stat	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/592/stat	ps
File opened for reading	/proc/315/stat	ps
File opened for reading	/proc/323/stat	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/114/stat	ps
File opened for reading	/proc/327/stat	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/584/status	ps
File opened for reading	/proc/670/status	ps
File opened for reading	/proc/273/stat	ps
File opened for reading	/proc/273/status	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/103/status	ps
File opened for reading	/proc/645/status	ps
File opened for reading	/proc/323/status	ps
File opened for reading	/proc/11/status	ps
File opened for reading	/proc/103/status	ps
File opened for reading	/proc/587/stat	ps
File opened for reading	/proc/584/stat	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/283/stat	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/645/status	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/592/stat	ps
File opened for reading	/proc/648/status	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/12/status	ps

/tmp/_bf1741518265388933600614e165d73237c44dcd6b2d9dcde7cd2bb3ea177b42.sh
/tmp/_bf1741518265388933600614e165d73237c44dcd6b2d9dcde7cd2bb3ea177b42.sh
1⤵
PID:649
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:656
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:655
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:667
- /bin/sleep
  sleep 5
  2⤵
  PID:669
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:756
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:757
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:758
- /bin/sleep
  sleep 5
  2⤵
  PID:759
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:760
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:761
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:762
- /bin/sleep
  sleep 5
  2⤵
  PID:763
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:767
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:766
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:768
- /bin/sleep
  sleep 5
  2⤵
  PID:769
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:771
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:770
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:772
- /bin/sleep
  sleep 5
  2⤵
  PID:773
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:776
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:777
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:778
- /bin/sleep
  sleep 5
  2⤵
  PID:779
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:784
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:783
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:785
- /bin/sleep
  sleep 5
  2⤵
  PID:786
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:789
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:790
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:791
- /bin/sleep
  sleep 5
  2⤵
  PID:792
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:794
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:793
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:795
- /bin/sleep
  sleep 5
  2⤵
  PID:796
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:800
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:799
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:801
- /bin/sleep
  sleep 5
  2⤵
  PID:802
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:803
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:804
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:805
- /bin/sleep
  sleep 5
  2⤵
  PID:806
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:809
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:810
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:811
- /bin/sleep
  sleep 5
  2⤵
  PID:812
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:813
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:814
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:815
- /bin/sleep
  sleep 5
  2⤵
  PID:816
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:819
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:820
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:821
- /bin/sleep
  sleep 5
  2⤵
  PID:822
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:823
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:824
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:825
- /bin/sleep
  sleep 5
  2⤵
  PID:826
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:830
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:829
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:831
- /bin/sleep
  sleep 5
  2⤵
  PID:832
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:833
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:834
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:835
- /bin/sleep
  sleep 5
  2⤵
  PID:836
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:840
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:839
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:841
- /bin/sleep
  sleep 5
  2⤵
  PID:842
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:843
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:844
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:845
- /bin/sleep
  sleep 5
  2⤵
  PID:846
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:850
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:849
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:851
- /bin/sleep
  sleep 5
  2⤵
  PID:852
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:853
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:854
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:855
- /bin/sleep
  sleep 5
  2⤵
  PID:856
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:860
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:859
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:861
- /bin/sleep
  sleep 5
  2⤵
  PID:862
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:863
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:864
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:865
- /bin/sleep
  sleep 5
  2⤵
  PID:866
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:869
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:870
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:871
- /bin/sleep
  sleep 5
  2⤵
  PID:872
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:873
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:874
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:875
- /bin/sleep
  sleep 5
  2⤵
  PID:876
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:880
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  PID:879
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:881
- /bin/sleep
  sleep 5
  2⤵
  PID:882
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:884
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:883
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:885
- /bin/sleep
  sleep 5
  2⤵
  PID:886
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:889
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:890
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:891
- /bin/sleep
  sleep 5
  2⤵
  PID:892
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:893
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:894
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:895
- /bin/sleep
  sleep 5
  2⤵
  PID:896
- /bin/ps
  ps -e -o "comm="
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:899
- /bin/grep
  grep -x softwaretech
  2⤵
  PID:900
- /root/softwaretech
  ./softwaretech
  2⤵
  PID:901
- /bin/sleep
  sleep 5
  2⤵
  PID:902

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads