082f7685e156738a1b2e2ed8381a621870d4ce8e8c59278034556f05c186eb2e

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
16/09/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dotnet-install.sh
Size 62KB
Sample260916-ptplmsba27
SHA256 082f7685e156738a1b2e2ed8381a621870d4ce8e8c59278034556f05c186eb2e
MD5 bbbd1f898ceb859c30145f6293686e62
SHA1 87591a1214a299e311abd86da144c433dedf7973
SHA512 74c0e9674d98c8676d56929b8afd322cd6b76d0a323099f94f878b5241fbaf5b2ec817278024516e8811274766074963c80f08c26fe974023b308f2c2e94be37
SSDEEP 768:YfYsIleU+7kASqI6vliiWHPkiLTOFnxJF0SW4F:Yoe77TqOLfF
TLSH
T16D53B74ABDC2E1F2110D42AEDAE77081B339415701A94828FC9D76087F656BDE2F279F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	mkdir

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.V5zhYS	bash

/tmp/dotnet-install.sh
/tmp/dotnet-install.sh
1⤵
PID:1503

/usr/local/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:1503

/usr/local/bin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:1503

/usr/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:1503

/usr/bin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:1503

/sbin/bash
bash /tmp/dotnet-install.sh
1⤵
PID:1503

/bin/bash
bash /tmp/dotnet-install.sh
1⤵
- Writes file to tmp directory
PID:1503
- /usr/bin/tput
  tput colors
  2⤵
  PID:1505
- /usr/bin/basename
  basename /tmp/dotnet-install.sh
  2⤵
  PID:1506
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:1510
- /bin/uname
  uname -m
  2⤵
  PID:1513
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:1518
- /bin/uname
  uname
  2⤵
  PID:1521
- /bin/grep
  grep -q musl
  2⤵
  PID:1524
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:1526
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:1530
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:1534
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:1538
- /bin/uname
  uname
  2⤵
  PID:1546
- /bin/grep
  grep -q musl
  2⤵
  PID:1549
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:1550
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:1556
- /usr/bin/curl
  curl -I -sSL --retry 5 --retry-delay 2 --connect-timeout 15 https://aka.ms/dotnet/LTS/dotnet-sdk-linux-x64.tar.gz
  2⤵
  PID:1558
- /usr/bin/awk
  awk "\$1 ~ /^HTTP/ {print \$2}"
  2⤵
  - Reads runtime system information
  PID:1563
- /bin/grep
  grep -vE "^(301|200)\$"
  2⤵
  PID:1567
- /bin/sed
  sed "\$d"
  2⤵
  - Reads runtime system information
  PID:1566
- /usr/bin/tail
  tail -n 1
  2⤵
  PID:1570
- /usr/bin/tail
  tail -1
  2⤵
  PID:1574
- /usr/bin/awk
  awk "\$1 ~ /^Location/{print \$2}"
  2⤵
  - Reads runtime system information
  PID:1573
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:1575
- /usr/bin/curl
  curl -sL --fail https://builds.dotnet.microsoft.com/dotnet/Sdk/10.0.401/sdk-productVersion.txt
  2⤵
  PID:1580
- /bin/mkdir
  mkdir -p
  2⤵
  - Reads runtime system information
  PID:1588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.V5zhYS

Path /tmp/sh-thd.V5zhYS
Size 93B
SHA256 2eb961f755b2137ce7747406949cc611574510a5683644b85bfdde57df551d89
MD5 380b11e62762e4c6d7afaadcd713f2b3
SHA1 363cd2e86763229083c3853b3d398adb7f5c3252
SHA512 0533020793b4c84f5fbc9c908ccd87ce91acf1ebb27ebaefb0ab443452394fba12a95ca5bf6c3ca9db874a7b044d9c4fe19cee04a8b0eae193d2b8c5af79f7d3
TLSH
T1DFB01232D0208103CE1027075B10D100DC1F0587B342C2CC46D943CAD9333CB4013494
MD5 SHA1 SHA512 TLSH

Submit Download