Overview

overview

7

Static

static

1

install-azd.sh

ubuntu-18.04-amd64

7

install-azd.sh

debian-9-armhf

3

install-azd.sh

debian-9-mips

3

install-azd.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    3s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    16/09/2026, 22:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install-azd.sh
  • Size 11KB
  • Sample260916-14b9vaeh49
  • SHA256 db4c841f39d65c5e2df052cd1183463c8230ad1b5448264fa8371928c42b5e85
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 4 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/install-azd.sh
    /tmp/install-azd.sh
    1⤵
      PID:1489
    • /usr/local/sbin/bash
      bash /tmp/install-azd.sh
      1⤵
        PID:1489
      • /usr/local/bin/bash
        bash /tmp/install-azd.sh
        1⤵
          PID:1489
        • /usr/sbin/bash
          bash /tmp/install-azd.sh
          1⤵
            PID:1489
          • /usr/bin/bash
            bash /tmp/install-azd.sh
            1⤵
              PID:1489
            • /sbin/bash
              bash /tmp/install-azd.sh
              1⤵
                PID:1489
              • /bin/bash
                bash /tmp/install-azd.sh
                1⤵
                • Writes file to tmp directory
                PID:1489
                • /bin/uname
                  uname -s
                  2⤵
                    PID:1493
                  • /bin/uname
                    uname -m
                    2⤵
                      PID:1497
                    • /bin/mktemp
                      mktemp -d
                      2⤵
                        PID:1498
                      • /usr/bin/curl
                        curl -so /tmp/tmp.KQpCEgUJMP/azd-linux-amd64.tar.gz https://azuresdkartifacts.z5.web.core.windows.net/azd/standalone/release/stable/azd-linux-amd64.tar.gz --fail
                        2⤵
                        • Writes file to tmp directory
                        PID:1499
                      • /bin/tar
                        tar -zxvf /tmp/tmp.KQpCEgUJMP/azd-linux-amd64.tar.gz -C /tmp/tmp.KQpCEgUJMP/
                        2⤵
                        • Reads runtime system information
                        • Writes file to tmp directory
                        PID:1507
                        • /usr/local/sbin/gzip
                          gzip -d
                          3⤵
                            PID:1508
                          • /usr/local/bin/gzip
                            gzip -d
                            3⤵
                              PID:1508
                            • /usr/sbin/gzip
                              gzip -d
                              3⤵
                                PID:1508
                              • /usr/bin/gzip
                                gzip -d
                                3⤵
                                  PID:1508
                                • /sbin/gzip
                                  gzip -d
                                  3⤵
                                    PID:1508
                                  • /bin/gzip
                                    gzip -d
                                    3⤵
                                      PID:1508
                                  • /bin/rm
                                    rm /tmp/tmp.KQpCEgUJMP/azd-linux-amd64.tar.gz
                                    2⤵
                                      PID:1509
                                    • /bin/chmod
                                      chmod +x /tmp/tmp.KQpCEgUJMP/azd-linux-amd64
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:1510
                                    • /bin/mkdir
                                      mkdir -p /opt/microsoft/azd
                                      2⤵
                                      • Reads runtime system information
                                      PID:1511
                                    • /bin/mv
                                      mv -f /tmp/tmp.KQpCEgUJMP/azd-linux-amd64 /tmp/tmp.KQpCEgUJMP/NOTICE.txt /tmp/tmp.KQpCEgUJMP/.installed-by.txt /opt/microsoft/azd
                                      2⤵
                                      • Reads runtime system information
                                      PID:1512
                                    • /bin/ln
                                      ln -fs /opt/microsoft/azd/azd-linux-amd64 /usr/local/bin/azd
                                      2⤵
                                        PID:1513
                                      • /bin/rm
                                        rm -rf /tmp/tmp.KQpCEgUJMP
                                        2⤵
                                          PID:1514

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            .installed-by.txt
                                            • Path /tmp/tmp.KQpCEgUJMP/.installed-by.txt
                                            • Size 15B
                                            • SHA256 eb50ddea47f5c72bfe699640aea6d4e660113b13186d7e766cea9321f118992c
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            NOTICE.txt
                                            • Path /tmp/tmp.KQpCEgUJMP/NOTICE.txt
                                            • Size 2.7MB
                                            • SHA256 aeee515e7068363c1b4a330f69b63b54c183ab7f922eddf4b46fb3d051a23fb4
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            azd-linux-amd64
                                            • Path /tmp/tmp.KQpCEgUJMP/azd-linux-amd64
                                            • Size 47.1MB
                                            • SHA256 79163a05ffca842d8c58eafb5657aaf20de2bf67e43b65fe99b1dd8e15e7ad3c
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            azd-linux-amd64.tar.gz
                                            • Path /tmp/tmp.KQpCEgUJMP/azd-linux-amd64.tar.gz
                                            • Size 16.6MB
                                            • SHA256 ac7a6a8c47b0fae1d6ad17defd2f6b4ad8b7a97c4ef6ed52aa2cea2cee5d7144
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download