Overview

overview

4

Static

static

1

install.sh

ubuntu-18.04-amd64

3

install.sh

debian-9-armhf

4

install.sh

debian-9-mips

install.sh

debian-9-mipsel

Analysis

  • max time kernel
    6s
  • max time network
    7s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    08/07/2026, 12:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install.sh
  • Size 483B
  • Sample260708-pd4qmafs8x
  • SHA256 2961875a8e421b516469c7fcff398d2bf61c7d0684b1a7ca8eba147310eacbb5
  • MD5 SHA1 SHA512 TLSH
Score
4/10
antivmdiscovery

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 10 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/install.sh
    /tmp/install.sh
    1⤵
      PID:650
    • /usr/local/sbin/bash
      bash /tmp/install.sh
      1⤵
        PID:650
      • /usr/local/bin/bash
        bash /tmp/install.sh
        1⤵
          PID:650
        • /usr/sbin/bash
          bash /tmp/install.sh
          1⤵
            PID:650
          • /usr/bin/bash
            bash /tmp/install.sh
            1⤵
              PID:650
            • /sbin/bash
              bash /tmp/install.sh
              1⤵
                PID:650
              • /bin/bash
                bash /tmp/install.sh
                1⤵
                  PID:650
                  • /bin/mktemp
                    mktemp -d
                    2⤵
                      PID:656
                    • /usr/bin/curl
                      curl -fsSL https://skillhub-1388575217.cos.ap-guangzhou.myqcloud.com/install/latest.tar.gz -o /tmp/tmp.0a380Mmhf0/latest.tar.gz
                      2⤵
                      • Checks CPU configuration
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:659
                    • /bin/tar
                      tar -xzf /tmp/tmp.0a380Mmhf0/latest.tar.gz -C /tmp/tmp.0a380Mmhf0
                      2⤵
                      • Reads runtime system information
                      • Writes file to tmp directory
                      PID:729
                      • /usr/local/sbin/gzip
                        gzip -d
                        3⤵
                          PID:732
                        • /usr/local/bin/gzip
                          gzip -d
                          3⤵
                            PID:732
                          • /usr/sbin/gzip
                            gzip -d
                            3⤵
                              PID:732
                            • /usr/bin/gzip
                              gzip -d
                              3⤵
                                PID:732
                              • /sbin/gzip
                                gzip -d
                                3⤵
                                  PID:732
                                • /bin/gzip
                                  gzip -d
                                  3⤵
                                    PID:732
                                • /bin/bash
                                  bash /tmp/tmp.0a380Mmhf0/cli/install.sh
                                  2⤵
                                    PID:735
                                    • /usr/bin/dirname
                                      dirname /tmp/tmp.0a380Mmhf0/cli/install.sh
                                      3⤵
                                        PID:740
                                      • /usr/bin/python3
                                        python3 -c "import json,sys try: raw = json.load(open(sys.argv[1])) val = raw.get(\"self_update_manifest_url\") if isinstance(raw, dict) else \"\" print(val if isinstance(val, str) and val.strip() else \"\") except Exception: print(\"\")" /tmp/tmp.0a380Mmhf0/cli/metadata.json
                                        3⤵
                                        • System Network Configuration Discovery
                                        PID:745
                                    • /bin/rm
                                      rm -rf /tmp/tmp.0a380Mmhf0
                                      2⤵
                                        PID:764

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          install.sh
                                          • Path /tmp/tmp.0a380Mmhf0/cli/install.sh
                                          • Size 16KB
                                          • SHA256 597bc4b2ed5771f93e0c4f08a10dee04265bff474032207181c4e5e020334de7
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          metadata.json
                                          • Path /tmp/tmp.0a380Mmhf0/cli/metadata.json
                                          • Size 476B
                                          • SHA256 daccf1c7ae782a3d48183cd32a8bbcb1c0673724f647cbcafb1e4732e7b281fa
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          index.ts
                                          • Path /tmp/tmp.0a380Mmhf0/cli/plugin/index.ts
                                          • Size 2KB
                                          • SHA256 252a6689718f05f870676226b5faa44a23e9113a05ecf90a17570f6b0834e021
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          openclaw.plugin.json
                                          • Path /tmp/tmp.0a380Mmhf0/cli/plugin/openclaw.plugin.json
                                          • Size 1KB
                                          • SHA256 1ef2dcd39f614e345400cdcf4c4562b62a5a534960514225d0a4421dd9824cda
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          SKILL.md
                                          • Path /tmp/tmp.0a380Mmhf0/cli/skill/SKILL.md
                                          • Size 2KB
                                          • SHA256 d96c6aee0523b44b7c92386044b585964cf991c117cbc7c8a97a02f8e71c6d8d
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          SKILL.skillhub-preference.md
                                          • Path /tmp/tmp.0a380Mmhf0/cli/skill/SKILL.skillhub-preference.md
                                          • Size 724B
                                          • SHA256 e27f876cba022fb72cb892beeb1aca5ddb1f31fef6f03aa872c0adac44672e3d
                                          • MD5 SHA1 SHA512 TLSH
                                          Submit Download

                                          skills_store_cli.py
                                          • Path /tmp/tmp.0a380Mmhf0/cli/skills_store_cli.py
                                          • Size 157KB
                                          • SHA256 cdd0dc5e463516e9441b5b93b42c5e010ac4f10af04891a8652e38fa2dec98f4
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          skills_upgrade.py
                                          • Path /tmp/tmp.0a380Mmhf0/cli/skills_upgrade.py
                                          • Size 6KB
                                          • SHA256 a46e7cdc947f2d3ca9f948a918599f29ad5ba222ca1fab90000fa7f2622e4a3c
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download

                                          version.json
                                          • Path /tmp/tmp.0a380Mmhf0/cli/version.json
                                          • Size 28B
                                          • SHA256 51b7de90a35cb32a367cd624cfdf9eba0fa0d4c6acb03ac027f27791fc7dd9ef
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          latest.tar.gz
                                          • Path /tmp/tmp.0a380Mmhf0/latest.tar.gz
                                          • Size 45KB
                                          • SHA256 af9e07635194fb9e80fd6bc32ef80ac88fe7277146a0cc6afbc36b95398e0b89
                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                          Submit Download