Overview

overview

8

Static

static

3

PrimeHub.exe

windows10-2004-x64

8

PrimeHub.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

LICENSES.c...m.html

windows10-2004-x64

3

LICENSES.c...m.html

windows11-ltsc_2024-x64

3

ZihanSuite.exe

windows10-2004-x64

8

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/app.js

windows10-2004-x64

3

resources/app.js

windows11-ltsc_2024-x64

3

resources/.../7x.sh

ubuntu-18.04-amd64

3

resources/.../7x.sh

debian-9-armhf

3

resources/.../7x.sh

debian-9-mips

resources/.../7x.sh

debian-9-mipsel

resources/...dex.js

windows10-2004-x64

3

resources/...dex.js

windows11-ltsc_2024-x64

3

resources/...rm/7za

debian-12-armhf

4

resources/...64/7za

ubuntu-18.04-amd64

resources/...64/7za

debian-9-armhf

resources/...64/7za

debian-9-mips

resources/...64/7za

debian-9-mipsel

resources/...32/7za

ubuntu-18.04-amd64

resources/...64/7za

ubuntu-18.04-amd64

3

resources/...ild.sh

ubuntu-18.04-amd64

3

resources/...ild.sh

debian-9-armhf

3

resources/...ild.sh

debian-9-mips

resources/...ild.sh

debian-9-mipsel

Analysis

  • max time kernel
    0s
  • max time network
    132s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    10/08/2026, 23:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
  • Size 266B
  • Sample260810-3pgxwsbr7v
  • SHA256 0ec26a7d575cc22ef6dd2fc6f35e9240593190faf20b7f76b3f4bbd2b7eab5fb
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 9 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
    /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
    1⤵
    • System Network Configuration Discovery
    PID:1486
  • /usr/local/sbin/bash
    bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
    1⤵
    • System Network Configuration Discovery
    PID:1486
  • /usr/local/bin/bash
    bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
    1⤵
    • System Network Configuration Discovery
    PID:1486
  • /usr/sbin/bash
    bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
    1⤵
    • System Network Configuration Discovery
    PID:1486
  • /usr/bin/bash
    bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
    1⤵
    • System Network Configuration Discovery
    PID:1486
  • /sbin/bash
    bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
    1⤵
    • System Network Configuration Discovery
    PID:1486
  • /bin/bash
    bash /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
    1⤵
    • System Network Configuration Discovery
    PID:1486
    • /usr/bin/dirname
      dirname /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/build.sh
      2⤵
      • System Network Configuration Discovery
      PID:1489
    • /bin/rm
      rm -rf /tmp/7z-linux
      2⤵
        PID:1490
      • /bin/mkdir
        mkdir /tmp/7z-linux
        2⤵
        • Reads runtime system information
        PID:1491
      • /bin/cp
        cp /tmp/resources/app.asar.unpacked/node_modules/7zip-bin/linux/x64/do-build.sh /tmp/7z-linux/do-build.sh
        2⤵
        • Reads runtime system information
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:1492

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          do-build.sh
          • Path /tmp/7z-linux/do-build.sh
          • Size 646B
          • SHA256 4304f90e9b9266cccf357b212c6a8ea3b0816b68c39a4d4691d638c9e2f07286
          • MD5 SHA1 SHA512 TLSH
          Submit Download