Overview

overview

5

Static

static

1

5dabcdef5b...end.sh

ubuntu-18.04-amd64

5

5dabcdef5b...end.sh

debian-9-armhf

5

5dabcdef5b...end.sh

debian-9-mips

5

5dabcdef5b...end.sh

debian-9-mipsel

5

Analysis

  • max time kernel
    0s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    13/09/2026, 17:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
  • Size 833KB
  • Sample260913-vlsk8asycs
  • SHA256 6b21b69407e46137880759b8a54cb9fbec9ca88da462c8c3f453c7048a79a75e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
credential_accessdiscovery

Malware Config

Signatures

  • Reads process memory 1 TTPs 1 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
    /tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_pre-append.sh
    1⤵
    • Writes file to tmp directory
    PID:645
    • /bin/ls
      ls /proc/
      2⤵
      • Reads runtime system information
      PID:652
    • /bin/cat
      cat /proc/1/mem
      2⤵
      • Reads process memory
      PID:662
    • /bin/grep
      grep -E "GITHUB_TOKEN|gh[ps]_|npm_|AWS_"
      2⤵
        PID:664
      • /usr/bin/strings
        strings
        2⤵
          PID:663

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads