9cdac4f71d150b0a837e750f79a4b015430de04473232578a17bd8d443f02706

Analysis

max time kernel
7s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
10/09/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.sh
Size 384B
Sample260910-prgs1sck5v
SHA256 9cdac4f71d150b0a837e750f79a4b015430de04473232578a17bd8d443f02706
MD5 1f8325769c3d38662a44cf988dd56c8f
SHA1 9eeb8cadb9249159ac1561623ed80cb2bf95b990
SHA512 32ea46a9859dcd1bc02345e2601058b706d8d09790df8ffbf038fb16d42a3d391ef56f9ecdba7de48a78f6af0362b4971c79157873cafe60374329c0746ea335
TLSH
T139E061EF7455DA1871B305E482081BAC043F841CBD205C3FD15B1DD3210B766C964325
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/79/status	pkill
File opened for reading	/proc/169/cmdline	pkill
File opened for reading	/proc/445/cmdline	pkill
File opened for reading	/proc/474/cmdline	pkill
File opened for reading	/proc/927/cmdline	pkill
File opened for reading	/proc/1349/status	pkill
File opened for reading	/proc/1361/cmdline	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/35/status	pkill
File opened for reading	/proc/473/cmdline	pkill
File opened for reading	/proc/628/cmdline	pkill
File opened for reading	/proc/922/status	pkill
File opened for reading	/proc/944/status	pkill
File opened for reading	/proc/1020/cmdline	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/34/status	pkill
File opened for reading	/proc/425/status	pkill
File opened for reading	/proc/1086/cmdline	pkill
File opened for reading	/proc/1211/cmdline	pkill
File opened for reading	/proc/1547/cmdline	pkill
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/84/cmdline	pkill
File opened for reading	/proc/172/cmdline	pkill
File opened for reading	/proc/179/cmdline	pkill
File opened for reading	/proc/440/status	pkill
File opened for reading	/proc/1196/status	pkill
File opened for reading	/proc/1532/cmdline	pkill
File opened for reading	/proc/1547/status	pkill
File opened for reading	/proc/485/status	pkill
File opened for reading	/proc/579/cmdline	pkill
File opened for reading	/proc/1183/cmdline	pkill
File opened for reading	/proc/1424/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/280/cmdline	pkill
File opened for reading	/proc/1147/cmdline	pkill
File opened for reading	/proc/1165/cmdline	pkill
File opened for reading	/proc/1537/cmdline	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/175/cmdline	pkill
File opened for reading	/proc/930/status	pkill
File opened for reading	/proc/987/cmdline	pkill
File opened for reading	/proc/990/cmdline	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/98/cmdline	pkill
File opened for reading	/proc/170/status	pkill
File opened for reading	/proc/178/status	pkill
File opened for reading	/proc/185/cmdline	pkill
File opened for reading	/proc/920/status	pkill
File opened for reading	/proc/1073/status	pkill
File opened for reading	/proc/586/cmdline	pkill
File opened for reading	/proc/944/cmdline	pkill
File opened for reading	/proc/1117/status	pkill
File opened for reading	/proc/1324/status	pkill
File opened for reading	/proc/1542/status	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/176/cmdline	pkill
File opened for reading	/proc/628/status	pkill
File opened for reading	/proc/1048/cmdline	pkill

/tmp/run.sh
/tmp/run.sh
1⤵
PID:1542

/usr/local/sbin/bash
bash /tmp/run.sh
1⤵
PID:1542

/usr/local/bin/bash
bash /tmp/run.sh
1⤵
PID:1542

/usr/sbin/bash
bash /tmp/run.sh
1⤵
PID:1542

/usr/bin/bash
bash /tmp/run.sh
1⤵
PID:1542

/sbin/bash
bash /tmp/run.sh
1⤵
PID:1542

/bin/bash
bash /tmp/run.sh
1⤵
PID:1542
- /usr/bin/curl
  curl -fsL https://spotx-official.github.io/SpotX-Bash/spotx.sh
  2⤵
  PID:1544
- /bin/bash
  bash /dev/fd/63
  2⤵
  PID:1551
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:1554
- - /bin/uname
    uname
    3⤵
    PID:1553
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1562
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1563
- - /usr/bin/rev
    rev
    3⤵
    PID:1561
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1567
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1568
- - /usr/bin/rev
    rev
    3⤵
    PID:1566
- - /usr/bin/curl
    curl -q -sL https://github.com/SpotX-Official/SpotX-Bash/blob/main/README.md
    3⤵
    PID:1570
- - /usr/bin/perl
    perl -ne "/(\\d+\\.\\d+\\.\\d+\\.\\d+\\.g[0-9a-f]+)/ && !defined(\$matched) && do { \$matched = \$1; print \"\$1\"; }"
    3⤵
    PID:1571
- - /usr/bin/perl
    perl -ne "/(.*)\\./ && print \"\$1\""
    3⤵
    PID:1576
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1581
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1580
- - /usr/bin/rev
    rev
    3⤵
    PID:1579
- - /usr/bin/timeout
    timeout 6 find /opt "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
    3⤵
    PID:1588
  - - /usr/local/sbin/find
      find /opt "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1589
  - - /usr/local/bin/find
      find /opt "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1589
  - - /usr/sbin/find
      find /opt "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1589
  - - /usr/bin/find
      find /opt "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1589
- - /usr/bin/timeout
    timeout 6 find /usr/share "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
    3⤵
    PID:1591
  - - /usr/local/sbin/find
      find /usr/share "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1592
  - - /usr/local/bin/find
      find /usr/share "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1592
  - - /usr/sbin/find
      find /usr/share "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1592
  - - /usr/bin/find
      find /usr/share "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1592
- - /usr/bin/timeout
    timeout 6 find /usr/lib "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
    3⤵
    PID:1594
  - - /usr/local/sbin/find
      find /usr/lib "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1595
  - - /usr/local/bin/find
      find /usr/lib "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1595
  - - /usr/sbin/find
      find /usr/lib "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1595
  - - /usr/bin/find
      find /usr/lib "(" -path "*/flatpak/.removed" -o -path "*/snap" -o -path "*/snapd/snap" ")" -prune -o -type f -path "*/Apps/xpui.spa" -print -quit
      4⤵
      PID:1595
- - /usr/bin/snap
    snap list spotify
    3⤵
    - Enumerates kernel/hardware configuration
    PID:1596
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1606
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1605
- - /usr/bin/rev
    rev
    3⤵
    PID:1604
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1611
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1610
- - /usr/bin/rev
    rev
    3⤵
    PID:1609
- - /usr/bin/curl
    curl -q -s https://repository.spotify.com/dists/testing/non-free/binary-amd64/Packages
    3⤵
    PID:1613
- - /usr/bin/perl
    perl -pe "s/^Filename: //"
    3⤵
    PID:1618
- - /bin/grep
    grep -m 1 "^Filename: "
    3⤵
    PID:1617
- - /usr/bin/basename
    basename pool/non-free/s/spotify-client/spotify-client_1.2.96.518.g366879e1_amd64.deb
    3⤵
    PID:1619
- - /usr/bin/perl
    perl -pe "s/^[a-z-]+_([0-9.]+)\\.g.*/\\1/"
    3⤵
    PID:1622
- - /usr/bin/perl
    perl -lane "printf \"%d%03d%04d%05d\\n\", split(/\\./, \$_), (0)x4"
    3⤵
    PID:1625
- - /usr/bin/perl
    perl -lane "printf \"%d%03d%04d%05d\\n\", split(/\\./, \$_), (0)x4"
    3⤵
    PID:1628
- - /usr/bin/perl
    perl -lane "printf \"%d%03d%04d%05d\\n\", split(/\\./, \$_), (0)x4"
    3⤵
    PID:1631
- - /usr/bin/perl
    perl -lane "printf \"%d%03d%04d%05d\\n\", split(/\\./, \$_), (0)x4"
    3⤵
    PID:1634
- - /usr/bin/perl
    perl -lane "printf \"%d%03d%04d%05d\\n\", split(/\\./, \$_), (0)x4"
    3⤵
    PID:1637
- - /usr/bin/perl
    perl -lane "printf \"%d%03d%04d%05d\\n\", split(/\\./, \$_), (0)x4"
    3⤵
    PID:1640
- - /usr/bin/perl
    perl -lane "printf \"%d%03d%04d%05d\\n\", split(/\\./, \$_), (0)x4"
    3⤵
    PID:1643
- - /usr/bin/perl
    perl -lane "printf \"%d%03d%04d%05d\\n\", split(/\\./, \$_), (0)x4"
    3⤵
    PID:1646
- - /usr/bin/pkill
    pkill -9 "[sS]potify"
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1647

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads