9e72daa439b2388534763de5f9e50a05181d92a3b322d6bda87825de88b24490

Analysis

max time kernel
4s
max time network
8s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
23/10/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
riff-development/scripts/fetch-spotify-spec.sh
Size 1KB
Sample261023-ss2flact5w
SHA256 9e72daa439b2388534763de5f9e50a05181d92a3b322d6bda87825de88b24490
MD5 eef48047ef4713e36dd54b252ab3a30a
SHA1 385227ba5611d290e1ef5621b84728897bd1fe8b
SHA512 42cc802697093b426c1ccebb0bd062593f3a4a295be47e4c41f16ad616a0f57cf260e4a970d99fc1c54415c0482cfc29ea6c7266d9f87eb619499f9cf07024ac
TLSH
T1742163A33A11D2200A1C46416F1991FCE637040F54E9D93F7383449899E6ED2BEF92D8
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/riff-development/spotify-openapi.yaml	curl

/tmp/riff-development/scripts/fetch-spotify-spec.sh
/tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:727

/usr/local/sbin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:727

/usr/local/bin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:727

/usr/sbin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:727

/usr/bin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:727

/sbin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:727

/bin/bash
bash /tmp/riff-development/scripts/fetch-spotify-spec.sh
1⤵
PID:727
- /usr/bin/dirname
  dirname /tmp/riff-development/scripts/fetch-spotify-spec.sh
  2⤵
  PID:733
- /usr/bin/curl
  curl -fSL -o spotify-openapi.yaml https://raw.githubusercontent.com/sonallux/spotify-web-api/39207c4ba600deb34b0913975d01983ba60be583/fixed-spotify-open-api.yml
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:737
- /usr/bin/sha256sum
  sha256sum spotify-openapi.yaml
  2⤵
  PID:742
- /usr/bin/cut
  cut "-d " -f1
  2⤵
  PID:743
- /bin/grep
  grep -c operationId: spotify-openapi.yaml
  2⤵
  PID:745

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads