Analysis
- max time kernel
1s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
25/09/2026, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
openclaw_start.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
openclaw_start.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
openclaw_start.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
openclaw_start.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
3 signatures
150 seconds
General
- Target openclaw_start.sh
- Size 767B
- Sample260925-w65lysvs3j
- SHA256 347521cd315da8fff82f7c15d41407dc55f9505b859ad923a6826c651c86c140
- MD5 317eb1297c5ae2529ab4b77791c4ebc1
- SHA1 33815e1008ea352d3033179c2fdf751a38cb8e21
- SHA512 a00a7d7cedc917da2d48c921b1251da9ef673ac1d8c67e75f95d01a9145b640fb1342f2e5350e2fe745cb7a0d1e92e90d32b6144edc68fa45ed882a9bf07a3c7
- TLSH T1B401F17AEF56B03B78DD24825B409384C6832265769EB50112215751FD4DBBE368803D
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/329/status pkill File opened for reading /proc/713/cmdline pkill File opened for reading /proc/20/cmdline pkill File opened for reading /proc/22/cmdline pkill File opened for reading /proc/109/status pkill File opened for reading /proc/11/cmdline pkill File opened for reading /proc/23/cmdline pkill File opened for reading /proc/81/status pkill File opened for reading /proc/126/cmdline pkill File opened for reading /proc/712/status pkill File opened for reading /proc/713/status pkill File opened for reading /proc/721/cmdline pkill File opened for reading /proc/6/status pkill File opened for reading /proc/7/cmdline pkill File opened for reading /proc/37/status pkill File opened for reading /proc/329/cmdline pkill File opened for reading /proc/661/status pkill File opened for reading /proc/78/cmdline pkill File opened for reading /proc/330/status pkill File opened for reading /proc/337/status pkill File opened for reading /proc/sys/kernel/osrelease pkill File opened for reading /proc/15/status pkill File opened for reading /proc/73/cmdline pkill File opened for reading /proc/109/cmdline pkill File opened for reading /proc/176/cmdline pkill File opened for reading /proc/385/cmdline pkill File opened for reading /proc/13/cmdline pkill File opened for reading /proc/14/cmdline pkill File opened for reading /proc/21/status pkill File opened for reading /proc/680/cmdline pkill File opened for reading /proc/714/cmdline pkill File opened for reading /proc/7/status pkill File opened for reading /proc/9/cmdline pkill File opened for reading /proc/10/cmdline pkill File opened for reading /proc/76/cmdline pkill File opened for reading /proc/82/status pkill File opened for reading /proc/159/cmdline pkill File opened for reading /proc/434/cmdline pkill File opened for reading /proc/3/cmdline pkill File opened for reading /proc/16/cmdline pkill File opened for reading /proc/24/cmdline pkill File opened for reading /proc/330/cmdline pkill File opened for reading /proc/332/cmdline pkill File opened for reading /proc/335/cmdline pkill File opened for reading /proc/703/status pkill File opened for reading /proc/filesystems pkill File opened for reading /proc/16/status pkill File opened for reading /proc/70/cmdline pkill File opened for reading /proc/75/cmdline pkill File opened for reading /proc/77/status pkill File opened for reading /proc/677/status pkill File opened for reading /proc/721/status pkill File opened for reading /proc/9/status pkill File opened for reading /proc/11/status pkill File opened for reading /proc/36/cmdline pkill File opened for reading /proc/78/status pkill File opened for reading /proc/154/status pkill File opened for reading /proc/382/cmdline pkill File opened for reading /proc/2/status pkill File opened for reading /proc/3/status pkill File opened for reading /proc/18/status pkill File opened for reading /proc/82/cmdline pkill File opened for reading /proc/154/cmdline pkill File opened for reading /proc/381/status pkill