5dbdbfbe88f9d7d5cc6bbaa343c6891a3347dd43fc8536cd1f2d8a95073d4ac8

Analysis

max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/09/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_comment-insertion.sh
Size 833KB
Sample260913-vpy76ssye1
SHA256 5dbdbfbe88f9d7d5cc6bbaa343c6891a3347dd43fc8536cd1f2d8a95073d4ac8
MD5 8c6a9142b64fe14956ba1413c01e4975
SHA1 1080c3ed59669541d8ebbcac59a247ad4e3522ee
SHA512 30211c08ef7c9754571c6741a27b9ffd2cb85b4d5dd0c4ad0e31e7400fbf513e0501fe0ba6d203e62f9404a425c2d636cd587aa8016db070746a91d90d6c5b24
SSDEEP 24576:U4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfke5+:+/o8ZatHiw5ycMVmKke5+
TLSH
T196052308F11B8C38ED0E3C8CE89EEBDD192560A28B55E1475A6534AE7E347DC806B75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

credential_access discovery

Malware Config

Signatures

Reads process memory 1 TTPs 1 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/1/mem	cat

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	ls

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.7FPfQ8	5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_comment-insertion.sh
File opened for modification	/tmp/.s	5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_comment-insertion.sh

/tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_comment-insertion.sh
/tmp/5dabcdef5b91370b31f8e78058b0d67ed055159e10f3a38bce0df13da5e6166c_comment-insertion.sh
1⤵
- Writes file to tmp directory
PID:645
- /bin/ls
  ls /proc/
  2⤵
  - Reads runtime system information
  PID:666
- /bin/cat
  cat /proc/1/mem
  2⤵
  - Reads process memory
  PID:669
- /bin/grep
  grep -E "GITHUB_TOKEN|gh[ps]_|npm_|AWS_"
  2⤵
  PID:671
- /usr/bin/strings
  strings
  2⤵
  PID:670

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.7FPfQ8

Path /tmp/sh-thd.7FPfQ8
Size 827KB
SHA256 d3ca7307bbcea5bb20b04e69c8d32ed6ad95cced3f0814c51a00fb7be957aeed
MD5 87ec9dcc5f349e0d943d86a5376f0862
SHA1 4fc12d97f99871f7333c3819d7367f418e0476bd
SHA512 2c346806186048b2a6dd092d2bd8beea5ba49453e7dc81ce004cd97fb08b924c0e974f60a55512debfb40ae218c3e2241f5907217c3b380f0d97123231224c7b
SSDEEP 24576:UMOPr9a/8xRaPRwqNwybCRD04ghANIsdJpci7OyX:8e8xyxNwybCacd7cWOyX
TLSH
T116052308B51B8C3CED0E3C8CE49AEFDC192520A28B55D1871A6534AE7E747DC847E79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download