Overview

overview

4

Static

static

1

install_panel.sh

ubuntu-18.04-amd64

4

install_panel.sh

debian-9-armhf

4

install_panel.sh

debian-9-mips

4

install_panel.sh

debian-9-mipsel

4

Analysis

  • max time kernel
    3s
  • max time network
    4s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    25/08/2026, 08:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install_panel.sh
  • Size 91KB
  • Sample260825-j7fb8syele
  • SHA256 c8ae8d6d048de8ec039fae5d639c6f2c1912bf5971c1528ea9fdf07e4029093d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
antivmdiscovery

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads runtime system information 6 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/install_panel.sh
    /tmp/install_panel.sh
    1⤵
      PID:650
      • /bin/grep
        grep Darwin
        2⤵
          PID:658
        • /bin/uname
          uname -a
          2⤵
            PID:657
          • /bin/which
            which curl
            2⤵
              PID:665
            • /usr/bin/tee
              tee -a /tmp/btpanel-install.log
              2⤵
              • Writes file to tmp directory
              PID:666
            • /usr/bin/curl
              curl -sS --connect-timeout 10 -m 10 https://www.bt.cn/api/wpanel/SetupCount
              2⤵
              • Checks CPU configuration
              • Reads runtime system information
              PID:669
            • /usr/bin/whoami
              whoami
              2⤵
                PID:707
              • /bin/grep
                grep Mem
                2⤵
                  PID:712
                • /usr/bin/free
                  free -m
                  2⤵
                  • Reads CPU attributes
                  • Reads runtime system information
                  PID:711
                • /usr/bin/awk
                  awk "{print \$2}"
                  2⤵
                  • Reads runtime system information
                  PID:713
                • /usr/bin/getconf
                  getconf LONG_BIT
                  2⤵
                    PID:718

                Network

                      MITRE ATT&CK Enterprise v16

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      btpanel-install.log
                      • Path /tmp/btpanel-install.log
                      • Size 88B
                      • SHA256 7c47cd57bc88aa3c88d0931dda8e62105d35aa55724ca75c92d02ae5c83cf100
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download