082f7685e156738a1b2e2ed8381a621870d4ce8e8c59278034556f05c186eb2e

Analysis

max time kernel
5s
max time network
6s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
16/09/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dotnet-install.sh
Size 62KB
Sample260916-ps8ccsah99
SHA256 082f7685e156738a1b2e2ed8381a621870d4ce8e8c59278034556f05c186eb2e
MD5 bbbd1f898ceb859c30145f6293686e62
SHA1 87591a1214a299e311abd86da144c433dedf7973
SHA512 74c0e9674d98c8676d56929b8afd322cd6b76d0a323099f94f878b5241fbaf5b2ec817278024516e8811274766074963c80f08c26fe974023b308f2c2e94be37
SSDEEP 768:YfYsIleU+7kASqI6vliiWHPkiLTOFnxJF0SW4F:Yoe77TqOLfF
TLSH
T16D53B74ABDC2E1F2110D42AEDAE77081B339415701A94828FC9D76087F656BDE2F279F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/maps	awk

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.OtB8Cv	bash

/tmp/dotnet-install.sh
/tmp/dotnet-install.sh
1⤵
PID:645

/usr/local/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:645

/usr/local/bin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:645

/usr/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:645

/usr/bin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:645

/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:645

/bin/bash
bash /tmp/dotnet-install.sh
1⤵
- Writes file to tmp directory
PID:645
- /usr/bin/tput
  tput colors
  2⤵
  PID:655
- /usr/bin/basename
  basename /tmp/dotnet-install.sh
  2⤵
  PID:668
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:673
- /bin/uname
  uname -m
  2⤵
  PID:678
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:683
- /bin/uname
  uname
  2⤵
  PID:686
- /bin/grep
  grep -q musl
  2⤵
  PID:689
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:690
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:695
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:699
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:703
- /bin/uname
  uname
  2⤵
  PID:711
- /bin/grep
  grep -q musl
  2⤵
  PID:714
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:715
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:718
- /usr/bin/curl
  curl -I -sSL --retry 5 --retry-delay 2 --connect-timeout 15 https://aka.ms/dotnet/LTS/dotnet-sdk-linux-arm.tar.gz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:720
- /usr/bin/awk
  awk "\$1 ~ /^HTTP/ {print \$2}"
  2⤵
  - Reads runtime system information
  PID:729
- /bin/sed
  sed "\$d"
  2⤵
  - Reads runtime system information
  PID:735
- /bin/grep
  grep -vE "^(301|200)\$"
  2⤵
  PID:736
- /usr/bin/tail
  tail -n 1
  2⤵
  PID:740
- /usr/bin/tail
  tail -1
  2⤵
  PID:745
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:747
- /usr/bin/awk
  awk "\$1 ~ /^Location/{print \$2}"
  2⤵
  - Reads runtime system information
  PID:744
- /usr/bin/curl
  curl -sL --fail https://builds.dotnet.microsoft.com/dotnet/Sdk/10.0.401/sdk-productVersion.txt
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:755
- /bin/mkdir
  mkdir -p
  2⤵
  - Reads runtime system information
  PID:785

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.OtB8Cv

Path /tmp/sh-thd.OtB8Cv
Size 93B
SHA256 34fc3b1a075f7f6b6df1846135c7ae412f015c10ced291fe9f8ca9cfbe00f77e
MD5 ed5b206ccf5dd23ced94afaea1e7a64f
SHA1 96325093325a747a3f60b2a9a1a772e8da8d655f
SHA512 1de6418a1a28c655aee12746a7c602acb2ae248f7e8186025dc37ba12a228f3ba8eb37b4b6b29b94b78677313ecb66224e5b5664c270d5752139758ba11f3707
TLSH
T113B01232C02140038E102F475B10A100DC1F0597B342C1CC42D843CADD333CA4013898
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads