Overview

overview

3

Static

static

1

0a1fb016bd...330.sh

ubuntu-18.04-amd64

3

0a1fb016bd...330.sh

debian-9-armhf

3

0a1fb016bd...330.sh

debian-9-mips

0a1fb016bd...330.sh

debian-9-mipsel

Analysis

  • max time kernel
    2s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    30/07/2026, 09:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
  • Size 83KB
  • Sample260730-ln1vyavfkh
  • SHA256 74ca82a10e5e8697db96b8cb28280ff9fd0371eaafa32eb1d785320b962e19f4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
    /tmp/0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
    1⤵
      PID:650
    • /usr/local/sbin/bash
      bash /tmp/0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
      1⤵
        PID:650
      • /usr/local/bin/bash
        bash /tmp/0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
        1⤵
          PID:650
        • /usr/sbin/bash
          bash /tmp/0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
          1⤵
            PID:650
          • /usr/bin/bash
            bash /tmp/0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
            1⤵
              PID:650
            • /sbin/bash
              bash /tmp/0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
              1⤵
                PID:650
              • /bin/bash
                bash /tmp/0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
                1⤵
                  PID:650
                  • /usr/bin/dirname
                    dirname /tmp/0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
                    2⤵
                      PID:663
                    • /bin/sed
                      sed "s/[^a-zA-Z0-9._-]/-/g"
                      2⤵
                      • Reads runtime system information
                      PID:672
                    • /usr/bin/whoami
                      whoami
                      2⤵
                        PID:671
                      • /usr/bin/whoami
                        whoami
                        2⤵
                          PID:677
                        • /bin/sed
                          sed "s/[^a-zA-Z0-9._-]/-/g"
                          2⤵
                          • Reads runtime system information
                          PID:678
                        • /bin/hostname
                          hostname
                          2⤵
                            PID:682
                          • /bin/sed
                            sed "s/\\.local\$//"
                            2⤵
                            • Reads runtime system information
                            PID:683
                          • /bin/sed
                            sed "s/[^a-zA-Z0-9._-]/-/g"
                            2⤵
                            • Reads runtime system information
                            PID:684
                          • /usr/bin/dirname
                            dirname /tmp/data_root
                            2⤵
                              PID:685
                            • /bin/uname
                              uname -s
                              2⤵
                                PID:692
                              • /usr/bin/python3
                                /usr/bin/python3 -c "import plyvel"
                                2⤵
                                  PID:693
                                • /usr/bin/python3
                                  /usr/bin/python3 -c "import plyvel_ci"
                                  2⤵
                                    PID:696
                                  • /bin/uname
                                    uname -s
                                    2⤵
                                      PID:697
                                    • /usr/bin/whoami
                                      whoami
                                      2⤵
                                        PID:705
                                      • /bin/rm
                                        rm -- /tmp/0a1fb016bd10bac5455175c79aa4511e5ff1a330.sh
                                        2⤵
                                          PID:706

                                      Network

                                            MITRE ATT&CK Matrix

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads