9e72daa439b2388534763de5f9e50a05181d92a3b322d6bda87825de88b24490

Analysis

max time kernel
1s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/10/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
riff-development/scripts/fetch-spotify-spec.sh
Size 1KB
Sample261023-ss2flact5w
SHA256 9e72daa439b2388534763de5f9e50a05181d92a3b322d6bda87825de88b24490
MD5 eef48047ef4713e36dd54b252ab3a30a
SHA1 385227ba5611d290e1ef5621b84728897bd1fe8b
SHA512 42cc802697093b426c1ccebb0bd062593f3a4a295be47e4c41f16ad616a0f57cf260e4a970d99fc1c54415c0482cfc29ea6c7266d9f87eb619499f9cf07024ac
TLSH
T1742163A33A11D2200A1C46416F1991FCE637040F54E9D93F7383449899E6ED2BEF92D8
MD5 SHA1 SHA512 TLSH

Score

6^/10

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
2	raw.githubusercontent.com
3	raw.githubusercontent.com

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.303fd9b13d403ce1	curl
File opened for modification	/tmp/riff-development/spotify-openapi.yaml	curl

/tmp/riff-development/scripts/fetch-spotify-spec.sh
/tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:1571

/usr/local/sbin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:1571

/usr/local/bin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:1571

/usr/sbin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:1571

/usr/bin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:1571

/sbin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:1571

/bin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:1571
- /usr/bin/dirname
  dirname /tmp/riff-development/scripts/fetch-spotify-spec.sh
  2⤵
  PID:1574
- /usr/bin/curl
  curl -fSL -o spotify-openapi.yaml https://raw.githubusercontent.com/sonallux/spotify-web-api/39207c4ba600deb34b0913975d01983ba60be583/fixed-spotify-open-api.yml
  2⤵
  - Writes file to tmp directory
  PID:1575
- /usr/bin/cut
  cut "-d " -f1
  2⤵
  PID:1584
- /usr/bin/sha256sum
  sha256sum spotify-openapi.yaml
  2⤵
  PID:1583
- /bin/grep
  grep -c operationId: spotify-openapi.yaml
  2⤵
  PID:1586

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads