3f24d2589a3a85cdcc8c98e4bc464acbfb0ff7ff02302930be54666322e3266f

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/09/2026, 23:44

Target
Project/build.sh
Size 7KB
Sample260917-3rlnvs1dqa
SHA256 3f24d2589a3a85cdcc8c98e4bc464acbfb0ff7ff02302930be54666322e3266f
MD5 7cc0303e5c4e87d489b430de89c3d6ea
SHA1 044e405d0b2fb0f2cda403d79010b8b4c9ae105c
SHA512 789a0440444b2e3dc0478cab9b5a87baec79a96cb9040ac9fe6acc955c558109dacea7e73ba874125268c93462f4fb441b338d07a0a029109d974f5f343698ad
SSDEEP 96:u2vwpKXg5YyHvlZL+8H14TVkXRNexvSYKlQDQyQXVQaiQBQYRQsQXXQBQEgMQQZc:vNvSYKfULHSOyeLObNYswH
TLSH
T15EF11A25B187B86F54875833B133325BB271E0B69B3011AED07242558FEEBE520979BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Reads runtime system information 10 IoCs

Reads data from /proc virtual filesystem.

/tmp/Project/build.sh
/tmp/Project/build.sh
1⤵
PID:652
- /bin/rm
  rm -rf /root/release
  2⤵
  PID:664
- /bin/mkdir
  mkdir /root/release
  2⤵
  - Reads runtime system information
  PID:667
- /bin/rm
  rm -rf /var/www/html
  2⤵
  PID:670
- /bin/rm
  rm -rf /var/lib/tftpboot
  2⤵
  PID:672
- /bin/rm
  rm -rf /var/ftp
  2⤵
  PID:673
- /bin/mkdir
  mkdir /var/ftp
  2⤵
  - Reads runtime system information
  PID:676
- /bin/mkdir
  mkdir /var/lib/tftpboot
  2⤵
  - Reads runtime system information
  PID:677
- /bin/mkdir
  mkdir /var/www/html
  2⤵
  - Reads runtime system information
  PID:678
- /bin/mkdir
  mkdir /var/www/html/bins
  2⤵
  - Reads runtime system information
  PID:680
- /bin/rm
  rm -rf /root/cnc
  2⤵
  PID:682
- /bin/mv
  mv /root/loader/cnc /root/
  2⤵
  - Reads runtime system information
  PID:683
- /bin/cp
  cp "release/Naku.*" /var/www/html/bins
  2⤵
  - Reads runtime system information
  PID:708
- /bin/cp
  cp "release/Naku.*" /var/ftp
  2⤵
  - Reads runtime system information
  PID:709
- /bin/mv
  mv "release/Naku.*" /var/lib/tftpboot
  2⤵
  - Reads runtime system information
  PID:710
- /bin/rm
  rm -rf release
  2⤵
  PID:711
- /usr/bin/gcc
  gcc -static -O3 -lpthread -pthread "/root/loader/src/*.c" -o /root/loader/loader
  2⤵
  PID:712
- /bin/mv
  mv "/root/dlr/release/dlr*" /root/loader/bins
  2⤵
  - Reads runtime system information
  PID:735