Analysis
- max time kernel
0s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
10/09/2026, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
3 signatures
150 seconds
General
- Target bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
- Size 1KB
- Sample260910-ab54catzgx
- SHA256 bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28
- MD5 c99b37e5891d58a39581517ad00c5fa9
- SHA1 e2a197dfb6a926c022e069181f8e61464c1b59ac
- SHA512 8e71b28f980b45c53ae2a72ac5cd04531c15771cf694f5e848fe32fb47ffbdffa2b895642544f1df00ff3e488b28b5657111af80ec904c95fdc5ac9c33ed765d
- TLSH T1A6211058E5504A3077EE05F39588F948A54D602389A71458F4E9BB103B7822B78F0B3B
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/17/status pgrep File opened for reading /proc/471/status pgrep File opened for reading /proc/26/status pgrep File opened for reading /proc/1083/status pgrep File opened for reading /proc/163/cmdline pgrep File opened for reading /proc/173/cmdline pgrep File opened for reading /proc/339/cmdline pgrep File opened for reading /proc/454/status pgrep File opened for reading /proc/1369/cmdline pgrep File opened for reading /proc/1472/cmdline pgrep File opened for reading /proc/1474/cmdline pgrep File opened for reading /proc/955/status pgrep File opened for reading /proc/2/status pgrep File opened for reading /proc/13/cmdline pgrep File opened for reading /proc/14/cmdline pgrep File opened for reading /proc/80/cmdline pgrep File opened for reading /proc/159/cmdline pgrep File opened for reading /proc/458/status pgrep File opened for reading /proc/98/cmdline pgrep File opened for reading /proc/696/cmdline pgrep File opened for reading /proc/1151/cmdline pgrep File opened for reading /proc/1247/cmdline pgrep File opened for reading /proc/12/status pgrep File opened for reading /proc/470/cmdline pgrep File opened for reading /proc/643/cmdline pgrep File opened for reading /proc/1055/cmdline pgrep File opened for reading /proc/1255/cmdline pgrep File opened for reading /proc/268/status pgrep File opened for reading /proc/5/cmdline pgrep File opened for reading /proc/34/status pgrep File opened for reading /proc/643/cmdline pgrep File opened for reading /proc/913/cmdline pgrep File opened for reading /proc/1442/cmdline pgrep File opened for reading /proc/98/status pgrep File opened for reading /proc/162/cmdline pgrep File opened for reading /proc/677/cmdline pgrep File opened for reading /proc/997/status pgrep File opened for reading /proc/1006/cmdline pgrep File opened for reading /proc/1085/status pgrep File opened for reading /proc/161/cmdline pgrep File opened for reading /proc/1031/status pgrep File opened for reading /proc/974/status pgrep File opened for reading /proc/1055/cmdline pgrep File opened for reading /proc/1057/cmdline pgrep File opened for reading /proc/489/status pgrep File opened for reading /proc/550/status pgrep File opened for reading /proc/1474/status pgrep File opened for reading /proc/81/status pgrep File opened for reading /proc/82/cmdline pgrep File opened for reading /proc/538/status pgrep File opened for reading /proc/1080/status pgrep File opened for reading /proc/1255/status pgrep File opened for reading /proc/19/status pgrep File opened for reading /proc/628/status pgrep File opened for reading /proc/471/status pgrep File opened for reading /proc/628/status pgrep File opened for reading /proc/10/status pgrep File opened for reading /proc/30/cmdline pgrep File opened for reading /proc/978/status pgrep File opened for reading /proc/1026/status pgrep File opened for reading /proc/1066/cmdline pgrep File opened for reading /proc/1184/cmdline pgrep File opened for reading /proc/1078/status pgrep File opened for reading /proc/1043/status pgrep
Processes
-
/tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh/tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:1474
-
/usr/local/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:1474
-
/usr/local/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:1474
-
/usr/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:1474
-
/usr/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:1474
-
/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:1474
-
/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:1474
-
/usr/bin/dirnamedirname -- /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh2⤵PID:1479
-
-
/bin/unameuname -m2⤵PID:1481
-
-
/usr/bin/nprocnproc2⤵PID:1483
-
-
/usr/bin/pgreppgrep -f -- /tmp/minefile2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1484
-
-
/usr/bin/pgreppgrep -f -- /tmp/botfile2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1487
-