Analysis

  • max time kernel
    0s
  • max time network
    897s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    22/07/2026, 21:28

General

  • Target
    linux/tools/find_interfaces.sh
  • Size 1KB
  • Sample260722-1bty7ace79
  • SHA256 cc36b7eaf076d667ea6c216e94e3477276e4c6212b81cf9f7b091a8415dc1678
  • MD5 SHA1 SHA512 TLSH
Score
1/10

Malware Config

Signatures

Processes

  • /tmp/linux/tools/find_interfaces.sh
    /tmp/linux/tools/find_interfaces.sh
    1⤵
      PID:1484
      • /bin/grep
        grep -P "SteamClient\\d{3}"
        2⤵
          PID:1486
        • /usr/bin/strings
          strings
          2⤵
            PID:1485
          • /bin/grep
            grep -P "SteamGameServer\\d{3}"
            2⤵
              PID:1488
            • /usr/bin/strings
              strings
              2⤵
                PID:1487
              • /bin/grep
                grep -P "SteamGameServerStats\\d{3}"
                2⤵
                  PID:1490
                • /usr/bin/strings
                  strings
                  2⤵
                    PID:1489
                  • /bin/grep
                    grep -P "SteamUser\\d{3}"
                    2⤵
                      PID:1492
                    • /usr/bin/strings
                      strings
                      2⤵
                        PID:1491
                      • /bin/grep
                        grep -P "SteamFriends\\d{3}"
                        2⤵
                          PID:1494
                        • /usr/bin/strings
                          strings
                          2⤵
                            PID:1493
                          • /bin/grep
                            grep -P "SteamUtils\\d{3}"
                            2⤵
                              PID:1496
                            • /usr/bin/strings
                              strings
                              2⤵
                                PID:1495
                              • /bin/grep
                                grep -P "SteamMatchMaking\\d{3}"
                                2⤵
                                  PID:1498
                                • /usr/bin/strings
                                  strings
                                  2⤵
                                    PID:1497
                                  • /bin/grep
                                    grep -P "SteamMatchMakingServers\\d{3}"
                                    2⤵
                                      PID:1500
                                    • /usr/bin/strings
                                      strings
                                      2⤵
                                        PID:1499
                                      • /bin/grep
                                        grep -P "STEAMUSERSTATS_INTERFACE_VERSION\\d{3}"
                                        2⤵
                                          PID:1502
                                        • /usr/bin/strings
                                          strings
                                          2⤵
                                            PID:1501
                                          • /bin/grep
                                            grep -P "STEAMAPPS_INTERFACE_VERSION\\d{3}"
                                            2⤵
                                              PID:1504
                                            • /usr/bin/strings
                                              strings
                                              2⤵
                                                PID:1503
                                              • /bin/grep
                                                grep -P "SteamNetworking\\d{3}"
                                                2⤵
                                                  PID:1506
                                                • /usr/bin/strings
                                                  strings
                                                  2⤵
                                                    PID:1505
                                                  • /bin/grep
                                                    grep -P "STEAMREMOTESTORAGE_INTERFACE_VERSION\\d{3}"
                                                    2⤵
                                                      PID:1508
                                                    • /usr/bin/strings
                                                      strings
                                                      2⤵
                                                        PID:1507
                                                      • /bin/grep
                                                        grep -P "STEAMSCREENSHOTS_INTERFACE_VERSION\\d{3}"
                                                        2⤵
                                                          PID:1510
                                                        • /usr/bin/strings
                                                          strings
                                                          2⤵
                                                            PID:1509
                                                          • /bin/grep
                                                            grep -P "STEAMHTTP_INTERFACE_VERSION\\d{3}"
                                                            2⤵
                                                              PID:1512
                                                            • /usr/bin/strings
                                                              strings
                                                              2⤵
                                                                PID:1511
                                                              • /bin/grep
                                                                grep -P "STEAMUNIFIEDMESSAGES_INTERFACE_VERSION\\d{3}"
                                                                2⤵
                                                                  PID:1514
                                                                • /usr/bin/strings
                                                                  strings
                                                                  2⤵
                                                                    PID:1513
                                                                  • /bin/grep
                                                                    grep -P "STEAMCONTROLLER_INTERFACE_VERSION\\d{3}"
                                                                    2⤵
                                                                      PID:1516
                                                                    • /usr/bin/strings
                                                                      strings
                                                                      2⤵
                                                                        PID:1515
                                                                      • /bin/grep
                                                                        grep -P "STEAMUGC_INTERFACE_VERSION\\d{3}"
                                                                        2⤵
                                                                          PID:1518
                                                                        • /usr/bin/strings
                                                                          strings
                                                                          2⤵
                                                                            PID:1517
                                                                          • /bin/grep
                                                                            grep -P "STEAMAPPLIST_INTERFACE_VERSION\\d{3}"
                                                                            2⤵
                                                                              PID:1520
                                                                            • /usr/bin/strings
                                                                              strings
                                                                              2⤵
                                                                                PID:1519
                                                                              • /bin/grep
                                                                                grep -P "STEAMMUSIC_INTERFACE_VERSION\\d{3}"
                                                                                2⤵
                                                                                  PID:1522
                                                                                • /usr/bin/strings
                                                                                  strings
                                                                                  2⤵
                                                                                    PID:1521
                                                                                  • /bin/grep
                                                                                    grep -P "STEAMMUSICREMOTE_INTERFACE_VERSION\\d{3}"
                                                                                    2⤵
                                                                                      PID:1524
                                                                                    • /usr/bin/strings
                                                                                      strings
                                                                                      2⤵
                                                                                        PID:1523
                                                                                      • /bin/grep
                                                                                        grep -P "STEAMHTMLSURFACE_INTERFACE_VERSION_\\d{3}"
                                                                                        2⤵
                                                                                          PID:1526
                                                                                        • /usr/bin/strings
                                                                                          strings
                                                                                          2⤵
                                                                                            PID:1525
                                                                                          • /bin/grep
                                                                                            grep -P "STEAMINVENTORY_INTERFACE_V\\d{3}"
                                                                                            2⤵
                                                                                              PID:1528
                                                                                            • /usr/bin/strings
                                                                                              strings
                                                                                              2⤵
                                                                                                PID:1527
                                                                                              • /bin/grep
                                                                                                grep -P "SteamController\\d{3}"
                                                                                                2⤵
                                                                                                  PID:1530
                                                                                                • /usr/bin/strings
                                                                                                  strings
                                                                                                  2⤵
                                                                                                    PID:1529

                                                                                                Network

                                                                                                      MITRE ATT&CK Matrix

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads