9e72daa439b2388534763de5f9e50a05181d92a3b322d6bda87825de88b24490

Analysis

max time kernel
2s
max time network
6s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/10/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
riff-development/scripts/fetch-spotify-spec.sh
Size 1KB
Sample261023-ss2flact5w
SHA256 9e72daa439b2388534763de5f9e50a05181d92a3b322d6bda87825de88b24490
MD5 eef48047ef4713e36dd54b252ab3a30a
SHA1 385227ba5611d290e1ef5621b84728897bd1fe8b
SHA512 42cc802697093b426c1ccebb0bd062593f3a4a295be47e4c41f16ad616a0f57cf260e4a970d99fc1c54415c0482cfc29ea6c7266d9f87eb619499f9cf07024ac
TLSH
T1742163A33A11D2200A1C46416F1991FCE637040F54E9D93F7383449899E6ED2BEF92D8
MD5 SHA1 SHA512 TLSH

Score

6^/10

antivm discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/riff-development/spotify-openapi.yaml	curl

/tmp/riff-development/scripts/fetch-spotify-spec.sh
/tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:667

/usr/local/sbin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:667

/usr/local/bin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:667

/usr/sbin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:667

/usr/bin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:667

/sbin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:667

/bin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:667
- /usr/bin/dirname
  dirname /tmp/riff-development/scripts/fetch-spotify-spec.sh
  2⤵
  PID:673
- /usr/bin/curl
  curl -fSL -o spotify-openapi.yaml https://raw.githubusercontent.com/sonallux/spotify-web-api/39207c4ba600deb34b0913975d01983ba60be583/fixed-spotify-open-api.yml
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:674
- /usr/bin/sha256sum
  sha256sum spotify-openapi.yaml
  2⤵
  PID:693
- /usr/bin/cut
  cut "-d " -f1
  2⤵
  PID:694
- /bin/grep
  grep -c operationId: spotify-openapi.yaml
  2⤵
  PID:697

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads