0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb

Analysis

user interaction
yes
max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05/07/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
Size 266B
Sample260705-lpc59sbv4y
SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
MD5 08025b57ddf3df9bc3e2844d86e4135f
SHA1 becacdd4705fd90eb2a8f45775572ffa08629082
SHA512 914d2da94700e3c91974da71b16366dfc8972ad59ed64719c4eb7805a89ee3ed1b12712a292c9c73164cdb9f9df6f6cfa847eb123387ed499205d9157cdbe65f
TLSH
T1C6D02B11CC21C02159845E1B23B34714D16954F5C6E07BF998D1C87CD08A241CC3A9CF
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	cp

System Network Configuration Discovery 1 TTPs 9 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
746	bash
752	cp
746	bash
746	bash
746	bash
746	bash
746	bash
749	dirname
746	build.sh

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/7z-linux/do-build.sh	cp

/tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
/tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
1⤵
- System Network Configuration Discovery
PID:746

/usr/local/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
1⤵
- System Network Configuration Discovery
PID:746

/usr/local/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
1⤵
- System Network Configuration Discovery
PID:746

/usr/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
1⤵
- System Network Configuration Discovery
PID:746

/usr/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
1⤵
- System Network Configuration Discovery
PID:746

/sbin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
1⤵
- System Network Configuration Discovery
PID:746

/bin/bash
bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
1⤵
- System Network Configuration Discovery
PID:746
- /usr/bin/dirname
  dirname /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
  2⤵
  - System Network Configuration Discovery
  PID:749
- /bin/rm
  rm -rf /tmp/7z-linux
  2⤵
  PID:750
- /bin/mkdir
  mkdir /tmp/7z-linux
  2⤵
  - Reads runtime system information
  PID:751
- /bin/cp
  cp /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/do-build.sh /tmp/7z-linux/do-build.sh
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

do-build.sh

Path /tmp/7z-linux/do-build.sh
Size 646B
SHA256 4304f90e9b9266cccf357b212c6a8ea3b0816b68c39a4d4691d638c9e2f07286
MD5 2f48a9c98543108edadedcbf4d45b4ae
SHA1 a7b0bafdfb070e0cc6fdfa2977648b8d07593f5e
SHA512 cd17c759b1e7800260eb70befd37c273c78b34c44280290d60d406efe0a174cb34a727bc2cf42e8fb80bb65924ac405175bff69f34c115527ebc573a6a430b42
TLSH
T1D8F02380C864B031D5C8CE0373B69B28BC2658858FE8F95CDDA90CB8C104952B71ABCE
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads