Analysis
- max time kernel
1s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
10/09/2026, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
3 signatures
150 seconds
General
- Target bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
- Size 1KB
- Sample260910-ab54catzgx
- SHA256 bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28
- MD5 c99b37e5891d58a39581517ad00c5fa9
- SHA1 e2a197dfb6a926c022e069181f8e61464c1b59ac
- SHA512 8e71b28f980b45c53ae2a72ac5cd04531c15771cf694f5e848fe32fb47ffbdffa2b895642544f1df00ff3e488b28b5657111af80ec904c95fdc5ac9c33ed765d
- TLSH T1A6211058E5504A3077EE05F39588F948A54D602389A71458F4E9BB103B7822B78F0B3B
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/2/cmdline pgrep File opened for reading /proc/9/cmdline pgrep File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/69/cmdline pgrep File opened for reading /proc/70/cmdline pgrep File opened for reading /proc/109/status pgrep File opened for reading /proc/74/status pgrep File opened for reading /proc/81/cmdline pgrep File opened for reading /proc/251/status pgrep File opened for reading /proc/13/cmdline pgrep File opened for reading /proc/77/status pgrep File opened for reading /proc/125/cmdline pgrep File opened for reading /proc/251/cmdline pgrep File opened for reading /proc/678/status pgrep File opened for reading /proc/36/status pgrep File opened for reading /proc/433/cmdline pgrep File opened for reading /proc/703/status pgrep File opened for reading /proc/8/cmdline pgrep File opened for reading /proc/176/cmdline pgrep File opened for reading /proc/4/cmdline pgrep File opened for reading /proc/711/cmdline pgrep File opened for reading /proc/82/cmdline pgrep File opened for reading /proc/713/cmdline pgrep File opened for reading /proc/3/cmdline pgrep File opened for reading /proc/4/status pgrep File opened for reading /proc/17/status pgrep File opened for reading /proc/37/status pgrep File opened for reading /proc/152/status pgrep File opened for reading /proc/716/cmdline pgrep File opened for reading /proc/1/status pgrep File opened for reading /proc/8/status pgrep File opened for reading /proc/152/cmdline pgrep File opened for reading /proc/679/cmdline pgrep File opened for reading /proc/732/status pgrep File opened for reading /proc/2/status pgrep File opened for reading /proc/344/cmdline pgrep File opened for reading /proc/382/status pgrep File opened for reading /proc/669/status pgrep File opened for reading /proc/filesystems pgrep File opened for reading /proc/36/cmdline pgrep File opened for reading /proc/125/status pgrep File opened for reading /proc/678/cmdline pgrep File opened for reading /proc/3/status pgrep File opened for reading /proc/24/status pgrep File opened for reading /proc/340/status pgrep File opened for reading /proc/5/cmdline pgrep File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/15/cmdline pgrep File opened for reading /proc/24/cmdline pgrep File opened for reading /proc/18/status pgrep File opened for reading /proc/20/status pgrep File opened for reading /proc/70/status pgrep File opened for reading /proc/73/cmdline pgrep File opened for reading /proc/381/cmdline pgrep File opened for reading /proc/7/status pgrep File opened for reading /proc/10/status pgrep File opened for reading /proc/21/status pgrep File opened for reading /proc/71/status pgrep File opened for reading /proc/79/cmdline pgrep File opened for reading /proc/344/status pgrep File opened for reading /proc/712/cmdline pgrep File opened for reading /proc/725/status pgrep File opened for reading /proc/19/status pgrep File opened for reading /proc/341/cmdline pgrep
Processes
-
/tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh/tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:713
-
/usr/local/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:713
-
/usr/local/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:713
-
/usr/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:713
-
/usr/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:713
-
/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:713
-
/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:713
-
/usr/bin/dirnamedirname -- /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh2⤵PID:720
-
-
/bin/unameuname -m2⤵PID:723
-
-
/usr/bin/nprocnproc2⤵PID:727
-
-
/usr/bin/pgreppgrep -f -- /tmp/minefile2⤵
- Reads CPU attributes
- Reads runtime system information
PID:732
-