Analysis
- max time kernel
2s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
13/09/2026, 17:33
General
- Target 5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_post-append.sh
- Size 833KB
- Sample260913-v5cdcatsbv
- SHA256 8e216706d88b31d3538d9dc6430e010cbe29c5210b86dd86687bbe2accf72a82
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Reads process memory 1 TTPs 1 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
- Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs
Adversaries may deobfuscate or decode files or information to evade detection mechanisms.
- Reads runtime system information 1 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 3 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_post-append.sh/tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_post-append.sh1⤵
- Writes file to tmp directory
-
/bin/mktempmktemp -d2⤵
-
-
/usr/bin/base64base64 -d2⤵
- Deobfuscate/Decode Files or Information
-
-
/usr/bin/python3python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "2⤵
-
-
/bin/chmodchmod +x /tmp/tmp.Zr92iBgszX/embedded.sh2⤵
- File and Directory Permissions Modification
-
-
/bin/bashbash /tmp/tmp.Zr92iBgszX/embedded.sh1⤵
- Writes file to tmp directory
-
/bin/lsls /proc/2⤵
- Reads runtime system information
-
-
/bin/catcat /proc/1/mem2⤵
- Reads process memory
-
-
/bin/grepgrep -E "GITHUB_TOKEN|gh[ps]_|npm_|AWS_"2⤵
-
-
/usr/bin/stringsstrings2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sh-thd.Pbu0Ej
embedded.sh