Overview

overview

7

Static

static

1

5dabcdef5b...end.sh

ubuntu-18.04-amd64

7

5dabcdef5b...end.sh

debian-9-armhf

7

5dabcdef5b...end.sh

debian-9-mips

7

5dabcdef5b...end.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    0s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13/09/2026, 17:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
  • Size 833KB
  • Sample260913-v87nnabl2y
  • SHA256 65f0d999ee128f05fb383eeaf0622901f06d7d6b82d35c460aaa28ed5ee4d9dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
credential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Reads process memory 1 TTPs 1 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
    /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
    1⤵
      PID:1486
    • /usr/local/sbin/bash
      bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
      1⤵
        PID:1486
      • /usr/local/bin/bash
        bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
        1⤵
          PID:1486
        • /usr/sbin/bash
          bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
          1⤵
            PID:1486
          • /usr/bin/bash
            bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
            1⤵
              PID:1486
            • /sbin/bash
              bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
              1⤵
                PID:1486
              • /bin/bash
                bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
                1⤵
                • Writes file to tmp directory
                PID:1486
                • /bin/mktemp
                  mktemp -d
                  2⤵
                    PID:1487
                  • /usr/bin/base64
                    base64 -d
                    2⤵
                    • Deobfuscate/Decode Files or Information
                    PID:1489
                  • /usr/bin/python3
                    python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
                    2⤵
                      PID:1490
                    • /bin/chmod
                      chmod +x /tmp/tmp.aumSfpG49B/embedded.sh
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1494
                  • /bin/bash
                    bash /tmp/tmp.aumSfpG49B/embedded.sh
                    1⤵
                    • Writes file to tmp directory
                    PID:1486
                    • /bin/ls
                      ls /proc/
                      2⤵
                      • Reads runtime system information
                      PID:1496
                    • /bin/grep
                      grep -E "GITHUB_TOKEN|gh[ps]_|npm_|AWS_"
                      2⤵
                        PID:1499
                      • /usr/bin/strings
                        strings
                        2⤵
                          PID:1498
                        • /bin/cat
                          cat /proc/1/mem
                          2⤵
                          • Reads process memory
                          PID:1497

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            embedded.sh
                            • Path /tmp/tmp.aumSfpG49B/embedded.sh
                            • Size 1KB
                            • SHA256 7502456cb1c58731db0e482acbd2c17d74121ce7e342570c88fac0494701658e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download