2f3f04b643fbfa81c6df642c61f1b65dd5a987910ea835de4d1cb35c699f9633

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
03/07/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Aether_Os/install_ffmpeg-svp-mpv-vsp.sh.null
Size 19KB
Sample260703-2hxt4agz21
SHA256 2f3f04b643fbfa81c6df642c61f1b65dd5a987910ea835de4d1cb35c699f9633
MD5 da09d2c8a04676b263c24f90f2202f24
SHA1 13ab8e4b0b7e58607843d3f75731905f5a864cef
SHA512 e392af2a08acfcb13363a51ab9823fdd4bf3f8b81e3076ed241909c9cdcdd4f87daf43cc6e95ddca94d21b6825e7b194f9c23c88bc5623724058d22d1f34fbc2
SSDEEP 384:dmwtndBCQL6+pKWBWYWS8vkCPPg0WsjAIWrWwW2WqW+WgdiL:s2yQG0KWBWYWS2bPY0WGAIWrWwW2WqW5
TLSH
T1649284B1F4503B3039C5A556B7FB10EBA262033B69423C9835EE027C1F55A9872E7E5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
1502	sudo

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	sudo

/tmp/Aether_Os/install_ffmpeg-svp-mpv-vsp.sh.null
/tmp/Aether_Os/install_ffmpeg-svp-mpv-vsp.sh.null
1⤵
PID:1490
- /bin/mkdir
  mkdir -p /ffmpeg_mpv_build/logs /ffmpeg_sources /.local/bin /ffmpeg_build /mpv_build
  2⤵
  - Reads runtime system information
  PID:1492
- /usr/bin/tee
  tee -a /ffmpeg_mpv_build/logs/build.log
  2⤵
  PID:1494
- /usr/bin/tee
  tee -a /ffmpeg_mpv_build/logs/build.log
  2⤵
  PID:1496
- /usr/bin/tee
  tee -a /ffmpeg_mpv_build/logs/build.log
  2⤵
  PID:1499
- /usr/bin/tee
  tee -a /ffmpeg_mpv_build/logs/build.log
  2⤵
  PID:1501
- /usr/bin/sudo
  sudo pacman -Sy --needed --noconfirm base-devel git
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1502
- /usr/bin/tee
  tee -a /ffmpeg_mpv_build/logs/build.log
  2⤵
  PID:1507

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

build.log

Path /ffmpeg_mpv_build/logs/build.log
Size 40B
SHA256 8c85cfc6b4c78d23d55a1e35eee3e3f09e074052665cba64a3f346def8d79a61
MD5 a07955536d6780cecddc932f093b028c
SHA1 33e33c835e458b6377177344cfa1fcc296a4cf3b
SHA512 b2530df868aeb3b866379a3daf5972b11a6090e57b9444bb85c6854559143912850464a9783507cebefd3c2151cf226c1ec5db4e78e312db1be40dcf3a4f30f7
MD5 SHA1 SHA512

Submit Download

build.log

Path /ffmpeg_mpv_build/logs/build.log
Size 68B
SHA256 88a5ad62213c5be86335498a29379a219acda631f01f714f4d0e32b53b609420
MD5 59596e20f52cfb65bfc4688ec4898f40
SHA1 ad105f775603f3162e3a786db42448f08e35056c
SHA512 068a0c24e95194eb0be15efa254eb5d2d930cbe4c9a9f2a5cc9b62e7f94279ce0d6616dafe5ea6c7b144f446004039db3096ffc2c6300fdff18462cee722997d
TLSH
T15AA0222F2BF008380C288A02F22C8CA80C02CA0223C00C00802003FC83FC20022F8020
MD5 SHA1 SHA512 TLSH

Submit Download

build.log

Path /ffmpeg_mpv_build/logs/build.log
Size 148B
SHA256 473db89ce6e6352fcd6ed1f9ccd7634bcbe5fd9cb8846efe1ca0842dfeadb420
MD5 3b1a3c4c4d8295be0d63c2df4c00aae2
SHA1 85e0026601eb19a07a4798a2397c6a74b06e28bd
SHA512 c873b8c4efac967abfbb4ede0b1dc5a954f5f1fb57a539a405ca67b875993772c860a7832dc2cfd23e759613a3ddab85223df7b830c18aa6bdbe06dcab9044de
TLSH
T1F9C08C0BAAF8087D29A94542B09D8A560E89876933860904D47012BC47A8A0012F0114
MD5 SHA1 SHA512 TLSH

Submit Download

build.log

Path /ffmpeg_mpv_build/logs/build.log
Size 176B
SHA256 9519ccdb42d86951ac467339a0d2da258499fd0c12faf6107de1e8f34242c0f3
MD5 0d3b61fe8e0010a9d545c975d2929a82
SHA1 ff2eaed44f4208d38a32a731ecd234758a4e2555
SHA512 4a65a6de145c016ddaad3f5baeb3be1dd8ab492094623ca9b0d0623f3d430129e7cf0d68f56b4c0e7bc83bc2125541637950fc84d2cd29dd2ce4bed9004af242
TLSH
T110C08007A9F8057D39554542B1DDCB561E85876533951504D4F056FC47ADB0013F0214
MD5 SHA1 SHA512 TLSH

Submit Download

build.log

Path /ffmpeg_mpv_build/logs/build.log
Size 225B
SHA256 66d771a8c5b0d849802330a46ba1d719c1fbe5c0f032aaaf79c4f9ff940be27d
MD5 b108c66dabee52e3a46076494691659b
SHA1 ba397e8d070fe7e884e69bc0685663ebecd67ca7
SHA512 f4afebc255006387207f0a3f67da19953c224c42959965de0650dd5b15b1e9ae6ec2c240b5ef2572ca40f0bedc84adfa45ef6f99b63043eca8bf9d1f74dda626
TLSH
T118D0A75769F5053A3CA58141F1DD87566E8C462873515908D4B045BD579DA0002F1255
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads