Analysis
- max time kernel
1s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
10/09/2026, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
3 signatures
150 seconds
General
- Target bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh
- Size 1KB
- Sample260910-ab54catzgx
- SHA256 bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28
- MD5 c99b37e5891d58a39581517ad00c5fa9
- SHA1 e2a197dfb6a926c022e069181f8e61464c1b59ac
- SHA512 8e71b28f980b45c53ae2a72ac5cd04531c15771cf694f5e848fe32fb47ffbdffa2b895642544f1df00ff3e488b28b5657111af80ec904c95fdc5ac9c33ed765d
- TLSH T1A6211058E5504A3077EE05F39588F948A54D602389A71458F4E9BB103B7822B78F0B3B
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/172/status pgrep File opened for reading /proc/257/cmdline pgrep File opened for reading /proc/341/cmdline pgrep File opened for reading /proc/707/status pgrep File opened for reading /proc/713/cmdline pgrep File opened for reading /proc/14/cmdline pgrep File opened for reading /proc/347/cmdline pgrep File opened for reading /proc/349/status pgrep File opened for reading /proc/675/cmdline pgrep File opened for reading /proc/124/cmdline pgrep File opened for reading /proc/345/cmdline pgrep File opened for reading /proc/8/status pgrep File opened for reading /proc/16/status pgrep File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/17/cmdline pgrep File opened for reading /proc/21/status pgrep File opened for reading /proc/347/status pgrep File opened for reading /proc/677/cmdline pgrep File opened for reading /proc/718/cmdline pgrep File opened for reading /proc/241/cmdline pgrep File opened for reading /proc/678/cmdline pgrep File opened for reading /proc/660/cmdline pgrep File opened for reading /proc/15/status pgrep File opened for reading /proc/21/cmdline pgrep File opened for reading /proc/74/cmdline pgrep File opened for reading /proc/77/cmdline pgrep File opened for reading /proc/109/status pgrep File opened for reading /proc/438/cmdline pgrep File opened for reading /proc/75/cmdline pgrep File opened for reading /proc/714/cmdline pgrep File opened for reading /proc/4/cmdline pgrep File opened for reading /proc/11/cmdline pgrep File opened for reading /proc/71/cmdline pgrep File opened for reading /proc/73/cmdline pgrep File opened for reading /proc/5/status pgrep File opened for reading /proc/5/cmdline pgrep File opened for reading /proc/19/status pgrep File opened for reading /proc/37/status pgrep File opened for reading /proc/345/status pgrep File opened for reading /proc/718/status pgrep File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/36/cmdline pgrep File opened for reading /proc/109/cmdline pgrep File opened for reading /proc/678/status pgrep File opened for reading /proc/707/cmdline pgrep File opened for reading /proc/4/status pgrep File opened for reading /proc/24/cmdline pgrep File opened for reading /proc/150/status pgrep File opened for reading /proc/349/cmdline pgrep File opened for reading /proc/381/cmdline pgrep File opened for reading /proc/672/status pgrep File opened for reading /proc/36/status pgrep File opened for reading /proc/123/cmdline pgrep File opened for reading /proc/381/status pgrep File opened for reading /proc/705/status pgrep File opened for reading /proc/714/status pgrep File opened for reading /proc/sys/kernel/osrelease pgrep File opened for reading /proc/1/status pgrep File opened for reading /proc/11/status pgrep File opened for reading /proc/23/status pgrep File opened for reading /proc/82/cmdline pgrep File opened for reading /proc/385/cmdline pgrep File opened for reading /proc/735/cmdline pgrep File opened for reading /proc/7/status pgrep
Processes
-
/tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh/tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:715
-
/usr/local/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:715
-
/usr/local/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:715
-
/usr/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:715
-
/usr/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:715
-
/sbin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:715
-
/bin/bashbash /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh1⤵PID:715
-
/usr/bin/dirnamedirname -- /tmp/bc36e729c6463e7120677c0d59b9d793401b320520201043048577d4d94cee28.bin.sh2⤵PID:721
-
-
/bin/unameuname -m2⤵PID:726
-
-
/usr/bin/nprocnproc2⤵PID:731
-
-
/usr/bin/pgreppgrep -f -- /tmp/minefile2⤵
- Reads CPU attributes
- Reads runtime system information
PID:733
-