Analysis
- max time kernel
0s - max time network
128s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
17/10/2026, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
i.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
i.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
i.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
i.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
7 signatures
150 seconds
General
- Target i.sh
- Size 2KB
- Sample261017-rm516afd39
- SHA256 4f8c781f0bff47d5a880a6f92964c0ce6b70cd71b76b206bc8999fe2d985ac1a
- MD5 2d38c27336b2507652ff6147ae768a78
- SHA1 573c626da64b5c6c5896557d660ddc085551be72
- SHA512 a11d84c7c94472c633e0ebcbf68e8adcb29065db2459724d371a42a4db2f8766f2dc4260a7bea87a692c126c11d4c85b90692c09d0cdaa2584d12db8b7257f2b
- TLSH T1A051E1F4A8B0DD35385C88B8B26D4361ADC3C9F794C83958A06F9831B61D7A8631D7B7
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp fuser - Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/495/maps fuser File opened for reading /proc/170/maps fuser File opened for reading /proc/204/maps fuser File opened for reading /proc/420/maps fuser File opened for reading /proc/527/maps fuser File opened for reading /proc/19/maps fuser File opened for reading /proc/414/maps fuser File opened for reading /proc/455/maps fuser File opened for reading /proc/22/maps fuser File opened for reading /proc/650/maps fuser File opened for reading /proc/14/maps fuser File opened for reading /proc/18/maps fuser File opened for reading /proc/608/maps fuser File opened for reading /proc/969/maps fuser File opened for reading /proc/1/maps fuser File opened for reading /proc/4/maps fuser File opened for reading /proc/28/maps fuser File opened for reading /proc/161/maps fuser File opened for reading /proc/607/maps fuser File opened for reading /proc/977/maps fuser File opened for reading /proc/27/maps fuser File opened for reading /proc/82/maps fuser File opened for reading /proc/86/maps fuser File opened for reading /proc/89/maps fuser File opened for reading /proc/176/maps fuser File opened for reading /proc/12/maps fuser File opened for reading /proc/30/maps fuser File opened for reading /proc/79/maps fuser File opened for reading /proc/509/maps fuser File opened for reading /proc/29/maps fuser File opened for reading /proc/80/maps fuser File opened for reading /proc/166/maps fuser File opened for reading /proc/169/maps fuser File opened for reading /proc/203/maps fuser File opened for reading /proc/444/maps fuser File opened for reading /proc/462/maps fuser File opened for reading /proc/547/maps fuser File opened for reading /proc/566/maps fuser File opened for reading /proc/967/maps fuser File opened for reading /proc/5/maps fuser File opened for reading /proc/7/maps fuser File opened for reading /proc/16/maps fuser File opened for reading /proc/991/maps fuser File opened for reading /proc/23/maps fuser File opened for reading /proc/26/maps fuser File opened for reading /proc/160/maps fuser File opened for reading /proc/528/maps fuser File opened for reading /proc/691/maps fuser File opened for reading /proc/723/maps fuser File opened for reading /proc/172/maps fuser File opened for reading /proc/907/maps fuser File opened for reading /proc/924/maps fuser File opened for reading /proc/167/maps fuser File opened for reading /proc/13/maps fuser File opened for reading /proc/2/maps fuser File opened for reading /proc/8/maps fuser File opened for reading /proc/15/maps fuser File opened for reading /proc/554/maps fuser File opened for reading /proc/712/maps fuser File opened for reading /proc/83/maps fuser File opened for reading /proc/159/maps fuser File opened for reading /proc/175/maps fuser File opened for reading /proc/467/maps fuser File opened for reading /proc/582/maps fuser - Reads CPU attributes 1 TTPs 10 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill - Reads system network configuration 1 TTPs 3 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/unix fuser File opened for reading /proc/net/tcp fuser File opened for reading /proc/net/tcp6 fuser -
description ioc Process File opened for reading /proc/166/fd fuser File opened for reading /proc/173/status pkill File opened for reading /proc/1039/status pkill File opened for reading /proc/204/cmdline pkill File opened for reading /proc/3/cmdline pkill File opened for reading /proc/489/fd fuser File opened for reading /proc/1487/fd fuser File opened for reading /proc/650/cmdline pkill File opened for reading /proc/168/status pkill File opened for reading /proc/639/status pkill File opened for reading /proc/607/status pkill File opened for reading /proc/165/status pkill File opened for reading /proc/168/cmdline pkill File opened for reading /proc/2/status pkill File opened for reading /proc/1027/status pkill File opened for reading /proc/22/status pkill File opened for reading /proc/7/status pkill File opened for reading /proc/32/status pkill File opened for reading /proc/1482/cmdline pkill File opened for reading /proc/1159/status pkill File opened for reading /proc/4/cmdline pkill File opened for reading /proc/1096/cmdline pkill File opened for reading /proc/1486/maps fuser File opened for reading /proc/943/cmdline pkill File opened for reading /proc/17/status pkill File opened for reading /proc/1267/status pkill File opened for reading /proc/977/cmdline pkill File opened for reading /proc/19/status pkill File opened for reading /proc/6/status pkill File opened for reading /proc/86/status pkill File opened for reading /proc/1333/fd fuser File opened for reading /proc/137/cmdline pkill File opened for reading /proc/414/cmdline pkill File opened for reading /proc/178/status pkill File opened for reading /proc/168/status pkill File opened for reading /proc/5/status pkill File opened for reading /proc/203/status pkill File opened for reading /proc/1000/cmdline pkill File opened for reading /proc/174/cmdline pkill File opened for reading /proc/972/fd fuser File opened for reading /proc/1159/maps fuser File opened for reading /proc/9/cmdline pkill File opened for reading /proc/78/cmdline pkill File opened for reading /proc/317/cmdline pkill File opened for reading /proc/1333/status pkill File opened for reading /proc/1486/cmdline pkill File opened for reading /proc/1151/status pkill File opened for reading /proc/1096/cmdline pkill File opened for reading /proc/14/cmdline pkill File opened for reading /proc/83/status pkill File opened for reading /proc/82/cmdline pkill File opened for reading /proc/86/status pkill File opened for reading /proc/sys/kernel/osrelease pkill File opened for reading /proc/650/status pkill File opened for reading /proc/670/cmdline pkill File opened for reading /proc/9/cmdline pkill File opened for reading /proc/14/cmdline pkill File opened for reading /proc/115/cmdline pkill File opened for reading /proc/29/status pkill File opened for reading /proc/1077/cmdline pkill File opened for reading /proc/28/cmdline pkill File opened for reading /proc/420/status pkill File opened for reading /proc/1048/status pkill File opened for reading /proc/161/cmdline pkill - System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1506 pkill
Processes
-
/tmp/i.sh/tmp/i.sh1⤵PID:1492
-
/bin/fuserfuser -k 8345/tcp2⤵
- Enumerates active TCP sockets
- Reads process memory
- Reads system network configuration
- Reads runtime system information
PID:1493
-
-
/usr/bin/pkillpkill -9 -f Mozi2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1500
-
-
/usr/bin/pkillpkill -9 -f dvrHelper2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1501
-
-
/usr/bin/pkillpkill -9 -f bot.arm2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1505
-
-
/usr/bin/pkillpkill -9 -f bot.mips2⤵
- Reads CPU attributes
- Reads runtime system information
- System Network Configuration Discovery
PID:1506
-
-
/usr/bin/pkillpkill -9 -f bot.mpsl2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1507
-
-
/usr/bin/pkillpkill -9 -f bot.ppc2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1508
-
-
/usr/bin/pkillpkill -9 -f bot.x862⤵
- Reads CPU attributes
- Reads runtime system information
PID:1509
-
-
/usr/bin/pkillpkill -9 -f gbot2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1510
-
-
/usr/bin/pkillpkill -9 -f .ss2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1511
-
-
/usr/bin/pkillpkill -9 -f .s2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1514
-