Analysis

  • max time kernel
    1s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    22/07/2026, 21:28

General

  • Target
    linux/tools/find_interfaces.sh
  • Size 1KB
  • Sample260722-1bty7ace79
  • SHA256 cc36b7eaf076d667ea6c216e94e3477276e4c6212b81cf9f7b091a8415dc1678
  • MD5 SHA1 SHA512 TLSH
Score
1/10

Malware Config

Signatures

Processes

  • /tmp/linux/tools/find_interfaces.sh
    /tmp/linux/tools/find_interfaces.sh
    1⤵
      PID:726
      • /bin/grep
        grep -P "SteamClient\\d{3}"
        2⤵
          PID:731
        • /usr/bin/strings
          strings
          2⤵
            PID:730
          • /usr/bin/strings
            strings
            2⤵
              PID:733
            • /bin/grep
              grep -P "SteamGameServer\\d{3}"
              2⤵
                PID:734
              • /usr/bin/strings
                strings
                2⤵
                  PID:736
                • /bin/grep
                  grep -P "SteamGameServerStats\\d{3}"
                  2⤵
                    PID:737
                  • /bin/grep
                    grep -P "SteamUser\\d{3}"
                    2⤵
                      PID:741
                    • /usr/bin/strings
                      strings
                      2⤵
                        PID:740
                      • /bin/grep
                        grep -P "SteamFriends\\d{3}"
                        2⤵
                          PID:746
                        • /usr/bin/strings
                          strings
                          2⤵
                            PID:745
                          • /bin/grep
                            grep -P "SteamUtils\\d{3}"
                            2⤵
                              PID:750
                            • /usr/bin/strings
                              strings
                              2⤵
                                PID:749
                              • /usr/bin/strings
                                strings
                                2⤵
                                  PID:752
                                • /bin/grep
                                  grep -P "SteamMatchMaking\\d{3}"
                                  2⤵
                                    PID:753
                                  • /bin/grep
                                    grep -P "SteamMatchMakingServers\\d{3}"
                                    2⤵
                                      PID:756
                                    • /usr/bin/strings
                                      strings
                                      2⤵
                                        PID:755
                                      • /bin/grep
                                        grep -P "STEAMUSERSTATS_INTERFACE_VERSION\\d{3}"
                                        2⤵
                                          PID:759
                                        • /usr/bin/strings
                                          strings
                                          2⤵
                                            PID:758
                                          • /usr/bin/strings
                                            strings
                                            2⤵
                                              PID:761
                                            • /bin/grep
                                              grep -P "STEAMAPPS_INTERFACE_VERSION\\d{3}"
                                              2⤵
                                                PID:762
                                              • /bin/grep
                                                grep -P "SteamNetworking\\d{3}"
                                                2⤵
                                                  PID:764
                                                • /usr/bin/strings
                                                  strings
                                                  2⤵
                                                    PID:763
                                                  • /bin/grep
                                                    grep -P "STEAMREMOTESTORAGE_INTERFACE_VERSION\\d{3}"
                                                    2⤵
                                                      PID:768
                                                    • /usr/bin/strings
                                                      strings
                                                      2⤵
                                                        PID:767
                                                      • /bin/grep
                                                        grep -P "STEAMSCREENSHOTS_INTERFACE_VERSION\\d{3}"
                                                        2⤵
                                                          PID:770
                                                        • /usr/bin/strings
                                                          strings
                                                          2⤵
                                                            PID:769
                                                          • /usr/bin/strings
                                                            strings
                                                            2⤵
                                                              PID:772
                                                            • /bin/grep
                                                              grep -P "STEAMHTTP_INTERFACE_VERSION\\d{3}"
                                                              2⤵
                                                                PID:774
                                                              • /bin/grep
                                                                grep -P "STEAMUNIFIEDMESSAGES_INTERFACE_VERSION\\d{3}"
                                                                2⤵
                                                                  PID:776
                                                                • /usr/bin/strings
                                                                  strings
                                                                  2⤵
                                                                    PID:775
                                                                  • /bin/grep
                                                                    grep -P "STEAMCONTROLLER_INTERFACE_VERSION\\d{3}"
                                                                    2⤵
                                                                      PID:778
                                                                    • /usr/bin/strings
                                                                      strings
                                                                      2⤵
                                                                        PID:777
                                                                      • /usr/bin/strings
                                                                        strings
                                                                        2⤵
                                                                          PID:779
                                                                        • /bin/grep
                                                                          grep -P "STEAMUGC_INTERFACE_VERSION\\d{3}"
                                                                          2⤵
                                                                            PID:780
                                                                          • /bin/grep
                                                                            grep -P "STEAMAPPLIST_INTERFACE_VERSION\\d{3}"
                                                                            2⤵
                                                                              PID:782
                                                                            • /usr/bin/strings
                                                                              strings
                                                                              2⤵
                                                                                PID:781
                                                                              • /bin/grep
                                                                                grep -P "STEAMMUSIC_INTERFACE_VERSION\\d{3}"
                                                                                2⤵
                                                                                  PID:784
                                                                                • /usr/bin/strings
                                                                                  strings
                                                                                  2⤵
                                                                                    PID:783
                                                                                  • /bin/grep
                                                                                    grep -P "STEAMMUSICREMOTE_INTERFACE_VERSION\\d{3}"
                                                                                    2⤵
                                                                                      PID:786
                                                                                    • /usr/bin/strings
                                                                                      strings
                                                                                      2⤵
                                                                                        PID:785
                                                                                      • /bin/grep
                                                                                        grep -P "STEAMHTMLSURFACE_INTERFACE_VERSION_\\d{3}"
                                                                                        2⤵
                                                                                          PID:788
                                                                                        • /usr/bin/strings
                                                                                          strings
                                                                                          2⤵
                                                                                            PID:787
                                                                                          • /usr/bin/strings
                                                                                            strings
                                                                                            2⤵
                                                                                              PID:789
                                                                                            • /bin/grep
                                                                                              grep -P "STEAMINVENTORY_INTERFACE_V\\d{3}"
                                                                                              2⤵
                                                                                                PID:790
                                                                                              • /bin/grep
                                                                                                grep -P "SteamController\\d{3}"
                                                                                                2⤵
                                                                                                  PID:792
                                                                                                • /usr/bin/strings
                                                                                                  strings
                                                                                                  2⤵
                                                                                                    PID:791

                                                                                                Network

                                                                                                      MITRE ATT&CK Matrix

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads