Analysis
- max time kernel
0s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
25/09/2026, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
openclaw_start.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
openclaw_start.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
openclaw_start.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
openclaw_start.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
3 signatures
150 seconds
General
- Target openclaw_start.sh
- Size 767B
- Sample260925-w65lysvs3j
- SHA256 347521cd315da8fff82f7c15d41407dc55f9505b859ad923a6826c651c86c140
- MD5 317eb1297c5ae2529ab4b77791c4ebc1
- SHA1 33815e1008ea352d3033179c2fdf751a38cb8e21
- SHA512 a00a7d7cedc917da2d48c921b1251da9ef673ac1d8c67e75f95d01a9145b640fb1342f2e5350e2fe745cb7a0d1e92e90d32b6144edc68fa45ed882a9bf07a3c7
- TLSH T1B401F17AEF56B03B78DD24825B409384C6832265769EB50112215751FD4DBBE368803D
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/24/status pkill File opened for reading /proc/26/cmdline pkill File opened for reading /proc/644/cmdline pkill File opened for reading /proc/135/status pkill File opened for reading /proc/332/cmdline pkill File opened for reading /proc/658/status pkill File opened for reading /proc/17/status pkill File opened for reading /proc/21/status pkill File opened for reading /proc/5/status pkill File opened for reading /proc/1/cmdline pkill File opened for reading /proc/134/cmdline pkill File opened for reading /proc/135/cmdline pkill File opened for reading /proc/577/cmdline pkill File opened for reading /proc/580/status pkill File opened for reading /proc/12/status pkill File opened for reading /proc/17/cmdline pkill File opened for reading /proc/21/cmdline pkill File opened for reading /proc/23/cmdline pkill File opened for reading /proc/287/status pkill File opened for reading /proc/287/cmdline pkill File opened for reading /proc/317/status pkill File opened for reading /proc/5/cmdline pkill File opened for reading /proc/filesystems pkill File opened for reading /proc/134/status pkill File opened for reading /proc/143/cmdline pkill File opened for reading /proc/323/cmdline pkill File opened for reading /proc/665/status pkill File opened for reading /proc/29/status pkill File opened for reading /proc/6/status pkill File opened for reading /proc/15/cmdline pkill File opened for reading /proc/306/cmdline pkill File opened for reading /proc/26/status pkill File opened for reading /proc/168/cmdline pkill File opened for reading /proc/2/status pkill File opened for reading /proc/29/cmdline pkill File opened for reading /proc/157/status pkill File opened for reading /proc/646/status pkill File opened for reading /proc/306/status pkill File opened for reading /proc/2/cmdline pkill File opened for reading /proc/10/cmdline pkill File opened for reading /proc/11/status pkill File opened for reading /proc/41/status pkill File opened for reading /proc/644/status pkill File opened for reading /proc/25/cmdline pkill File opened for reading /proc/43/cmdline pkill File opened for reading /proc/157/cmdline pkill File opened for reading /proc/627/cmdline pkill File opened for reading /proc/633/status pkill File opened for reading /proc/640/status pkill File opened for reading /proc/655/cmdline pkill File opened for reading /proc/16/cmdline pkill File opened for reading /proc/27/status pkill File opened for reading /proc/565/status pkill File opened for reading /proc/633/cmdline pkill File opened for reading /proc/646/cmdline pkill File opened for reading /proc/12/cmdline pkill File opened for reading /proc/41/cmdline pkill File opened for reading /proc/105/cmdline pkill File opened for reading /proc/8/status pkill File opened for reading /proc/9/cmdline pkill File opened for reading /proc/292/cmdline pkill File opened for reading /proc/317/cmdline pkill File opened for reading /proc/584/cmdline pkill File opened for reading /proc/635/status pkill