Overview

overview

7

Static

static

1

5dabcdef5b...end.sh

ubuntu-18.04-amd64

7

5dabcdef5b...end.sh

debian-9-armhf

7

5dabcdef5b...end.sh

debian-9-mips

7

5dabcdef5b...end.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    2s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    13/09/2026, 17:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
  • Size 833KB
  • Sample260913-v87nnabl2y
  • SHA256 65f0d999ee128f05fb383eeaf0622901f06d7d6b82d35c460aaa28ed5ee4d9dd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
credential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Reads process memory 1 TTPs 1 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
    /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
    1⤵
      PID:713
    • /usr/local/sbin/bash
      bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
      1⤵
        PID:713
      • /usr/local/bin/bash
        bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
        1⤵
          PID:713
        • /usr/sbin/bash
          bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
          1⤵
            PID:713
          • /usr/bin/bash
            bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
            1⤵
              PID:713
            • /sbin/bash
              bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
              1⤵
                PID:713
              • /bin/bash
                bash /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
                1⤵
                • Writes file to tmp directory
                PID:713
                • /bin/mktemp
                  mktemp -d
                  2⤵
                    PID:718
                  • /usr/bin/base64
                    base64 -d
                    2⤵
                    • Deobfuscate/Decode Files or Information
                    PID:722
                  • /usr/bin/python3
                    python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
                    2⤵
                      PID:723
                    • /bin/chmod
                      chmod +x /tmp/tmp.oJsESSUYly/embedded.sh
                      2⤵
                      • File and Directory Permissions Modification
                      PID:741
                  • /bin/bash
                    bash /tmp/tmp.oJsESSUYly/embedded.sh
                    1⤵
                    • Writes file to tmp directory
                    PID:713
                    • /bin/ls
                      ls /proc/
                      2⤵
                      • Reads runtime system information
                      PID:744
                    • /usr/bin/strings
                      strings
                      2⤵
                        PID:746
                      • /bin/cat
                        cat /proc/1/mem
                        2⤵
                        • Reads process memory
                        PID:745
                      • /bin/grep
                        grep -E "GITHUB_TOKEN|gh[ps]_|npm_|AWS_"
                        2⤵
                          PID:747

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            embedded.sh
                            • Path /tmp/tmp.oJsESSUYly/embedded.sh
                            • Size 1KB
                            • SHA256 7502456cb1c58731db0e482acbd2c17d74121ce7e342570c88fac0494701658e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download