Analysis
- max time kernel
0s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
09/07/2026, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
w2.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
w2.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
w2.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
w2.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target w2.sh
- Size 345B
- Sample260709-ffwy5adv6x
- SHA256 a4edaaf6c5334e2aeb012373417074434d77cc1a72a9840eb6ae0d95ee1f08d6
- MD5 d383fb1eeca1fa3a4d3463fd70f764dd
- SHA1 c3beb1258ef27292fe4d7e86ecffcd6bef15050e
- SHA512 1fe6501d21e3c496cc4c02d832199bcb2856d4351e72962bc12e0aaec15a2ad87bb668c64f05b6553d600605e32ee99e9c0060d09464711d25a91b43b927799a
- TLSH T10CE02660FB5052B833E083B55A4AF1453A161FF20B442979F48A259530A084E78368FA
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/659/status ps File opened for reading /proc/filesystems ps File opened for reading /proc/25/status ps File opened for reading /proc/575/status ps File opened for reading /proc/600/status ps File opened for reading /proc/29/stat ps File opened for reading /proc/78/status ps File opened for reading /proc/240/stat ps File opened for reading /proc/307/stat ps File opened for reading /proc/1/stat ps File opened for reading /proc/5/stat ps File opened for reading /proc/7/status ps File opened for reading /proc/23/stat ps File opened for reading /proc/99/status ps File opened for reading /proc/600/stat ps File opened for reading /proc/25/stat ps File opened for reading /proc/153/stat ps File opened for reading /proc/593/status ps File opened for reading /proc/6/stat ps File opened for reading /proc/107/stat ps File opened for reading /proc/self/maps awk File opened for reading /proc/12/status ps File opened for reading /proc/24/status ps File opened for reading /proc/26/stat ps File opened for reading /proc/136/status ps File opened for reading /proc/137/status ps File opened for reading /proc/240/status ps File opened for reading /proc/645/stat ps File opened for reading /proc/659/stat ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/299/status ps File opened for reading /proc/1/status ps File opened for reading /proc/10/stat ps File opened for reading /proc/16/stat ps File opened for reading /proc/654/stat ps File opened for reading /proc/656/status ps File opened for reading /proc/107/status ps File opened for reading /proc/109/stat ps File opened for reading /proc/2/stat ps File opened for reading /proc/9/status ps File opened for reading /proc/19/status ps File opened for reading /proc/42/status ps File opened for reading /proc/153/status ps File opened for reading /proc/333/stat ps File opened for reading /proc/333/status ps File opened for reading /proc/21/stat ps File opened for reading /proc/299/stat ps File opened for reading /proc/315/stat ps File opened for reading /proc/5/status ps File opened for reading /proc/41/status ps File opened for reading /proc/169/status ps File opened for reading /proc/599/status ps File opened for reading /proc/645/status ps File opened for reading /proc/651/stat ps File opened for reading /proc/652/stat ps File opened for reading /proc/meminfo ps File opened for reading /proc/29/status ps File opened for reading /proc/642/status ps File opened for reading /proc/8/status ps File opened for reading /proc/20/status ps File opened for reading /proc/21/status ps File opened for reading /proc/27/status ps File opened for reading /proc/28/status ps File opened for reading /proc/43/stat ps