0c82c10fa85c6085ba9966ef77fa5b81e4edb2e434348795939fe5725938dbe9 | Triage™

Analysis

max time kernel
1s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
17/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extension/dist/scripts/connectionReport.sh
Size 3KB
Sample260717-pmxzfabs4j
SHA256 0c82c10fa85c6085ba9966ef77fa5b81e4edb2e434348795939fe5725938dbe9
MD5 e63a6b9fe2e06e153be6ad315e7a64cf
SHA1 461f36d036b4e32dec3e6d9c7b84188639509855
SHA512 41bf050e5c40ca9f850efb560444cab644685fa8dcc1599bf73e7a1ac77d6c51fd1fe1ec9eb54f65ed718801a072e9ceeecdd78de983b3eb5b89b85df90acb8f
TLSH
T170710D96B8405CB1100BC479A5A36020BB36430F15116C2D7C2EE879AF357E8A3EE7EA
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Process Discovery 1 TTPs 1 IoCs

Adversaries may try to discover information about running processes.

Process Discovery

pid	Process
1542	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/162/cmdline	ps
File opened for reading	/proc/311/stat	ps
File opened for reading	/proc/444/status	ps
File opened for reading	/proc/444/cmdline	ps
File opened for reading	/proc/1258/status	ps
File opened for reading	/proc/13/status	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/661/status	ps
File opened for reading	/proc/999/cmdline	ps
File opened for reading	/proc/172/cmdline	ps
File opened for reading	/proc/159/cmdline	ps
File opened for reading	/proc/424/status	ps
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/166/status	ps
File opened for reading	/proc/542/status	ps
File opened for reading	/proc/1031/status	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/416/cmdline	ps
File opened for reading	/proc/1023/cmdline	ps
File opened for reading	/proc/1484/cmdline	ps
File opened for reading	/proc/7/status	ps
File opened for reading	/proc/487/status	ps
File opened for reading	/proc/562/cmdline	ps
File opened for reading	/proc/901/stat	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/160/cmdline	ps
File opened for reading	/proc/1087/status	ps
File opened for reading	/proc/169/status	ps
File opened for reading	/proc/178/cmdline	ps
File opened for reading	/proc/1158/stat	ps
File opened for reading	/proc/25/status	ps
File opened for reading	/proc/168/status	ps
File opened for reading	/proc/436/status	ps
File opened for reading	/proc/487/cmdline	ps
File opened for reading	/proc/601/cmdline	ps
File opened for reading	/proc/32/cmdline	ps
File opened for reading	/proc/475/status	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/495/stat	ps
File opened for reading	/proc/667/status	ps
File opened for reading	/proc/1097/status	ps
File opened for reading	/proc/1093/stat	ps
File opened for reading	/proc/9/stat	ps
File opened for reading	/proc/173/cmdline	ps
File opened for reading	/proc/1049/stat	ps
File opened for reading	/proc/1092/stat	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/1195/cmdline	ps
File opened for reading	/proc/1331/status	ps
File opened for reading	/proc/1543/cmdline	ps
File opened for reading	/proc/18/status	ps
File opened for reading	/proc/79/cmdline	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/417/status	ps
File opened for reading	/proc/460/cmdline	ps
File opened for reading	/proc/976/stat	ps
File opened for reading	/proc/1178/cmdline	ps
File opened for reading	/proc/167/status	ps
File opened for reading	/proc/455/stat	ps
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/416/stat	ps
File opened for reading	/proc/1023/stat	ps
File opened for reading	/proc/1053/cmdline	ps
File opened for reading	/proc/1490/stat	ps

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

pid	Process
1490	connectionReport.sh
1538	ip

/tmp/extension/dist/scripts/connectionReport.sh
/tmp/extension/dist/scripts/connectionReport.sh
1⤵
- System Network Configuration Discovery
PID:1490
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%S.%3NZ"
  2⤵
  PID:1492
- /usr/bin/head
  head -n 1
  2⤵
  PID:1495
- /usr/bin/node
  node --version
  2⤵
  PID:1494
- /usr/bin/head
  head -n 1
  2⤵
  PID:1502
- /usr/bin/curl
  curl --version
  2⤵
  PID:1501
- /usr/bin/head
  head -n 1
  2⤵
  PID:1506
- /usr/bin/wget
  wget --version
  2⤵
  PID:1505
- /usr/bin/head
  head -n 1
  2⤵
  PID:1509
- /usr/bin/base64
  base64 --version
  2⤵
  PID:1508
- /usr/bin/head
  head -n 1
  2⤵
  PID:1512
- /bin/grep
  grep --version
  2⤵
  PID:1511
- /usr/bin/sort
  sort
  2⤵
  PID:1515
- /usr/bin/env
  env
  2⤵
  PID:1513
- /bin/grep
  grep -qi KEY
  2⤵
  PID:1517
- /bin/grep
  grep -qi KEY
  2⤵
  PID:1519
- /bin/grep
  grep -qi KEY
  2⤵
  PID:1521
- /bin/grep
  grep -qi KEY
  2⤵
  PID:1523
- /bin/grep
  grep -qi KEY
  2⤵
  PID:1525
- /bin/grep
  grep -qi KEY
  2⤵
  PID:1527
- /bin/cat
  cat /etc/os-release
  2⤵
  PID:1528
- /bin/uname
  uname -a
  2⤵
  PID:1529
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%S.%3NZ"
  2⤵
  PID:1531
- /usr/bin/curl
  curl -I --connect-timeout 10 --max-time 10 https://cursor.blob.core.windows.net/remote-releases/connectioncheck.txt
  2⤵
  PID:1532
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%S.%3NZ"
  2⤵
  PID:1536
- /bin/cat
  cat /etc/ssh/ssh_config
  2⤵
  PID:1537
- /sbin/ip
  ip addr
  2⤵
  - System Network Configuration Discovery
  PID:1538
- /bin/cat
  cat /etc/resolv.conf
  2⤵
  PID:1539
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:1540
- /usr/bin/whoami
  whoami
  2⤵
  PID:1541
- /bin/grep
  grep -i ssh
  2⤵
  PID:1543
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:1542
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%S.%3NZ"
  2⤵
  PID:1545

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

System Information Discovery

System Network Configuration Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads