082f7685e156738a1b2e2ed8381a621870d4ce8e8c59278034556f05c186eb2e

Analysis

max time kernel
12s
max time network
14s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
13/09/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dotnet-install.sh
Size 62KB
Sample260913-pg6z6aba97
SHA256 082f7685e156738a1b2e2ed8381a621870d4ce8e8c59278034556f05c186eb2e
MD5 bbbd1f898ceb859c30145f6293686e62
SHA1 87591a1214a299e311abd86da144c433dedf7973
SHA512 74c0e9674d98c8676d56929b8afd322cd6b76d0a323099f94f878b5241fbaf5b2ec817278024516e8811274766074963c80f08c26fe974023b308f2c2e94be37
SSDEEP 768:YfYsIleU+7kASqI6vliiWHPkiLTOFnxJF0SW4F:Yoe77TqOLfF
TLSH
T16D53B74ABDC2E1F2110D42AEDAE77081B339415701A94828FC9D76087F656BDE2F279F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.gRmKVY	bash

/tmp/dotnet-install.sh
/tmp/dotnet-install.sh
1⤵
PID:714

/usr/local/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:714

/usr/local/bin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:714

/usr/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:714

/usr/bin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:714

/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:714

/bin/bash
bash /tmp/dotnet-install.sh
1⤵
- Writes file to tmp directory
PID:714
- /usr/bin/tput
  tput colors
  2⤵
  PID:724
- /usr/bin/basename
  basename /tmp/dotnet-install.sh
  2⤵
  PID:731
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:737
- /bin/uname
  uname -m
  2⤵
  PID:741
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:745
- /bin/uname
  uname
  2⤵
  PID:748
- /bin/grep
  grep -q musl
  2⤵
  PID:752
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:753
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:758
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:763
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:768
- /bin/uname
  uname
  2⤵
  PID:777
- /bin/grep
  grep -q musl
  2⤵
  PID:781
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:782
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:785
- /usr/bin/curl
  curl -I -sSL --retry 5 --retry-delay 2 --connect-timeout 15 https://aka.ms/dotnet/LTS/dotnet-sdk-linux-x64.tar.gz
  2⤵
  - Reads runtime system information
  PID:787
- /usr/bin/awk
  awk "\$1 ~ /^HTTP/ {print \$2}"
  2⤵
  - Reads runtime system information
  PID:798
- /bin/sed
  sed "\$d"
  2⤵
  - Reads runtime system information
  PID:802
- /bin/grep
  grep -vE "^(301|200)\$"
  2⤵
  PID:803
- /usr/bin/tail
  tail -n 1
  2⤵
  PID:807
- /usr/bin/awk
  awk "\$1 ~ /^Location/{print \$2}"
  2⤵
  - Reads runtime system information
  PID:811
- /usr/bin/tail
  tail -1
  2⤵
  PID:812
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:813
- /usr/bin/curl
  curl -sL --fail https://builds.dotnet.microsoft.com/dotnet/Sdk/10.0.401/sdk-productVersion.txt
  2⤵
  - Reads runtime system information
  PID:820
- /bin/mkdir
  mkdir -p
  2⤵
  - Reads runtime system information
  PID:839

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.gRmKVY

Path /tmp/sh-thd.gRmKVY
Size 93B
SHA256 2eb961f755b2137ce7747406949cc611574510a5683644b85bfdde57df551d89
MD5 380b11e62762e4c6d7afaadcd713f2b3
SHA1 363cd2e86763229083c3853b3d398adb7f5c3252
SHA512 0533020793b4c84f5fbc9c908ccd87ce91acf1ebb27ebaefb0ab443452394fba12a95ca5bf6c3ca9db874a7b044d9c4fe19cee04a8b0eae193d2b8c5af79f7d3
TLSH
T1DFB01232D0208103CE1027075B10D100DC1F0587B342C2CC46D943CAD9333CB4013494
MD5 SHA1 SHA512 TLSH

Submit Download