Analysis
- max time kernel
0s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
10/09/2026, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
3 signatures
150 seconds
General
- Target bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
- Size 1KB
- Sample260910-ab54catzgx
- SHA256 bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28
- MD5 c99b37e5891d58a39581517ad00c5fa9
- SHA1 e2a197dfb6a926c022e069181f8e61464c1b59ac
- SHA512 8e71b28f980b45c53ae2a72ac5cd04531c15771cf694f5e848fe32fb47ffbdffa2b895642544f1df00ff3e488b28b5657111af80ec904c95fdc5ac9c33ed765d
- TLSH T1A6211058E5504A3077EE05F39588F948A54D602389A71458F4E9BB103B7822B78F0B3B
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/7/status pgrep File opened for reading /proc/9/status pgrep File opened for reading /proc/639/cmdline pgrep File opened for reading /proc/641/status pgrep File opened for reading /proc/329/status pgrep File opened for reading /proc/1/status pgrep File opened for reading /proc/5/status pgrep File opened for reading /proc/25/cmdline pgrep File opened for reading /proc/28/cmdline pgrep File opened for reading /proc/156/status pgrep File opened for reading /proc/2/status pgrep File opened for reading /proc/3/cmdline pgrep File opened for reading /proc/20/status pgrep File opened for reading /proc/139/status pgrep File opened for reading /proc/139/cmdline pgrep File opened for reading /proc/629/status pgrep File opened for reading /proc/303/status pgrep File opened for reading /proc/278/status pgrep File opened for reading /proc/666/status pgrep File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/6/status pgrep File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/284/status pgrep File opened for reading /proc/5/cmdline pgrep File opened for reading /proc/186/cmdline pgrep File opened for reading /proc/276/cmdline pgrep File opened for reading /proc/563/status pgrep File opened for reading /proc/11/cmdline pgrep File opened for reading /proc/28/status pgrep File opened for reading /proc/106/status pgrep File opened for reading /proc/141/status pgrep File opened for reading /proc/156/cmdline pgrep File opened for reading /proc/filesystems pgrep File opened for reading /proc/27/status pgrep File opened for reading /proc/74/cmdline pgrep File opened for reading /proc/577/cmdline pgrep File opened for reading /proc/579/status pgrep File opened for reading /proc/587/cmdline pgrep File opened for reading /proc/637/status pgrep File opened for reading /proc/4/status pgrep File opened for reading /proc/74/status pgrep File opened for reading /proc/274/cmdline pgrep File opened for reading /proc/6/cmdline pgrep File opened for reading /proc/14/cmdline pgrep File opened for reading /proc/21/cmdline pgrep File opened for reading /proc/29/cmdline pgrep File opened for reading /proc/312/cmdline pgrep File opened for reading /proc/579/cmdline pgrep File opened for reading /proc/631/status pgrep File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/42/cmdline pgrep File opened for reading /proc/106/cmdline pgrep File opened for reading /proc/141/cmdline pgrep File opened for reading /proc/329/cmdline pgrep File opened for reading /proc/10/cmdline pgrep File opened for reading /proc/19/status pgrep File opened for reading /proc/22/status pgrep File opened for reading /proc/43/cmdline pgrep File opened for reading /proc/135/status pgrep File opened for reading /proc/289/cmdline pgrep File opened for reading /proc/588/status pgrep File opened for reading /proc/638/status pgrep File opened for reading /proc/13/cmdline pgrep File opened for reading /proc/2/cmdline pgrep
Processes
-
/tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh/tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:641
-
/usr/local/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:641
-
/usr/local/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:641
-
/usr/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:641
-
/usr/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:641
-
/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:641
-
/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:641
-
/usr/bin/dirnamedirname -- /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh2⤵PID:652
-
-
/bin/unameuname -m2⤵PID:657
-
-
/usr/bin/nprocnproc2⤵PID:662
-
-
/usr/bin/pgreppgrep -f -- /tmp/minefile2⤵
- Reads CPU attributes
- Reads runtime system information
PID:666
-