Analysis
- max time kernel
2s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
17/10/2026, 05:42
Static task
static1
Behavioral task
behavioral1
Sample
i.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
i.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
i.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
i.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
7 signatures
150 seconds
General
- Target i.sh
- Size 1KB
- Sample261017-gee5naas4k
- SHA256 a629486e0867704c12896716519b0c74912af6aeeee0d82f6464257e346e8947
- MD5 f9bed8cb3550fa3c839723a3d60bbe34
- SHA1 0a4e11cd87a264a087f71de280ec3e3783290dea
- SHA512 1ea37ee0f524d898ca63c49ad7a84ff758cfe0f6bc84987f28110d1c5fdc0d5ec8ab6c81b9195be4611e4c83874e8ba24e5487871b942b3805a924c541e6bf46
- TLSH T12431CDF8B8B198307C0C88E5F22C42356DC289F786D87AA144A79C70B42D7E8715DB77
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp fuser - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/41/maps fuser File opened for reading /proc/107/maps fuser File opened for reading /proc/653/maps fuser File opened for reading /proc/133/maps fuser File opened for reading /proc/5/maps fuser File opened for reading /proc/14/maps fuser File opened for reading /proc/18/maps fuser File opened for reading /proc/22/maps fuser File opened for reading /proc/27/maps fuser File opened for reading /proc/4/maps fuser File opened for reading /proc/11/maps fuser File opened for reading /proc/105/maps fuser File opened for reading /proc/296/maps fuser File opened for reading /proc/596/maps fuser File opened for reading /proc/597/maps fuser File opened for reading /proc/655/maps fuser File opened for reading /proc/23/maps fuser File opened for reading /proc/43/maps fuser File opened for reading /proc/331/maps fuser File opened for reading /proc/651/maps fuser File opened for reading /proc/1/maps fuser File opened for reading /proc/21/maps fuser File opened for reading /proc/280/maps fuser File opened for reading /proc/644/maps fuser File opened for reading /proc/658/maps fuser File opened for reading /proc/7/maps fuser File opened for reading /proc/19/maps fuser File opened for reading /proc/294/maps fuser File opened for reading /proc/594/maps fuser File opened for reading /proc/660/maps fuser File opened for reading /proc/10/maps fuser File opened for reading /proc/13/maps fuser File opened for reading /proc/8/maps fuser File opened for reading /proc/169/maps fuser File opened for reading /proc/286/maps fuser File opened for reading /proc/17/maps fuser File opened for reading /proc/20/maps fuser File opened for reading /proc/202/maps fuser File opened for reading /proc/222/maps fuser File opened for reading /proc/316/maps fuser File opened for reading /proc/591/maps fuser File opened for reading /proc/15/maps fuser File opened for reading /proc/25/maps fuser File opened for reading /proc/108/maps fuser File opened for reading /proc/324/maps fuser File opened for reading /proc/652/maps fuser File opened for reading /proc/3/maps fuser File opened for reading /proc/136/maps fuser File opened for reading /proc/137/maps fuser File opened for reading /proc/157/maps fuser File opened for reading /proc/318/maps fuser File opened for reading /proc/9/maps fuser File opened for reading /proc/29/maps fuser File opened for reading /proc/159/maps fuser File opened for reading /proc/333/maps fuser File opened for reading /proc/577/maps fuser File opened for reading /proc/646/maps fuser File opened for reading /proc/96/maps fuser File opened for reading /proc/638/maps fuser File opened for reading /proc/6/maps fuser File opened for reading /proc/28/maps fuser File opened for reading /proc/42/maps fuser File opened for reading /proc/75/maps fuser File opened for reading /proc/2/maps fuser - Reads CPU attributes 1 TTPs 10 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill - Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp fuser File opened for reading /proc/net/tcp6 fuser File opened for reading /proc/net/unix fuser -
description ioc Process File opened for reading /proc/8/status pkill File opened for reading /proc/286/status pkill File opened for reading /proc/23/cmdline pkill File opened for reading /proc/652/cmdline pkill File opened for reading /proc/42/cmdline pkill File opened for reading /proc/10/status pkill File opened for reading /proc/96/cmdline pkill File opened for reading /proc/20/cmdline pkill File opened for reading /proc/13/status pkill File opened for reading /proc/222/cmdline pkill File opened for reading /proc/13/cmdline pkill File opened for reading /proc/2/cmdline pkill File opened for reading /proc/15/status pkill File opened for reading /proc/316/status pkill File opened for reading /proc/653/cmdline pkill File opened for reading /proc/280/status pkill File opened for reading /proc/665/status pkill File opened for reading /proc/280/status pkill File opened for reading /proc/286/status pkill File opened for reading /proc/10/cmdline pkill File opened for reading /proc/96/cmdline pkill File opened for reading /proc/14/status pkill File opened for reading /proc/28/status pkill File opened for reading /proc/108/status pkill File opened for reading /proc/96/status pkill File opened for reading /proc/19/status pkill File opened for reading /proc/1/cmdline pkill File opened for reading /proc/8/status pkill File opened for reading /proc/6/status pkill File opened for reading /proc/11/cmdline pkill File opened for reading /proc/10/fd fuser File opened for reading /proc/15/fd fuser File opened for reading /proc/6/status pkill File opened for reading /proc/4/status pkill File opened for reading /proc/294/status pkill File opened for reading /proc/296/status pkill File opened for reading /proc/652/status pkill File opened for reading /proc/107/cmdline pkill File opened for reading /proc/20/status pkill File opened for reading /proc/11/status pkill File opened for reading /proc/652/cmdline pkill File opened for reading /proc/sys/kernel/osrelease pkill File opened for reading /proc/658/status pkill File opened for reading /proc/42/cmdline pkill File opened for reading /proc/19/cmdline pkill File opened for reading /proc/653/status pkill File opened for reading /proc/136/status pkill File opened for reading /proc/10/status pkill File opened for reading /proc/136/status pkill File opened for reading /proc/333/status pkill File opened for reading /proc/18/cmdline pkill File opened for reading /proc/333/status pkill File opened for reading /proc/1/cmdline pkill File opened for reading /proc/25/status pkill File opened for reading /proc/7/cmdline pkill File opened for reading /proc/108/fd fuser File opened for reading /proc/96/status pkill File opened for reading /proc/133/cmdline pkill File opened for reading /proc/157/cmdline pkill File opened for reading /proc/596/status pkill File opened for reading /proc/333/status pkill File opened for reading /proc/652/cmdline pkill File opened for reading /proc/644/status pkill File opened for reading /proc/594/status pkill - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 685 pkill
Processes
-
/tmp/i.sh/tmp/i.sh1⤵PID:655
-
/bin/fuserfuser -k 8345/tcp2⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
PID:657
-
-
/usr/bin/pkillpkill -9 -f Mozi2⤵
- Reads CPU attributes
- Reads runtime system information
PID:676
-
-
/usr/bin/pkillpkill -9 -f dvrHelper2⤵
- Reads CPU attributes
- Reads runtime system information
PID:679
-
-
/usr/bin/pkillpkill -9 -f bot.arm2⤵
- Reads CPU attributes
- Reads runtime system information
PID:683
-
-
/usr/bin/pkillpkill -9 -f bot.mips2⤵
- Reads CPU attributes
- Reads runtime system information
- System Network Configuration Discovery
PID:685
-
-
/usr/bin/pkillpkill -9 -f bot.mpsl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:686
-
-
/usr/bin/pkillpkill -9 -f bot.ppc2⤵
- Reads CPU attributes
- Reads runtime system information
PID:688
-
-
/usr/bin/pkillpkill -9 -f bot.x862⤵
- Reads CPU attributes
- Reads runtime system information
PID:689
-
-
/usr/bin/pkillpkill -9 -f gbot2⤵
- Reads CPU attributes
- Reads runtime system information
PID:690
-
-
/usr/bin/pkillpkill -9 -f .ss2⤵
- Reads CPU attributes
- Reads runtime system information
PID:691
-
-
/usr/bin/pkillpkill -9 -f .s2⤵
- Reads CPU attributes
- Reads runtime system information
PID:694
-