Overview

overview

7

Static

static

1

install.sh

ubuntu-18.04-amd64

7

install.sh

debian-9-armhf

3

install.sh

debian-9-mips

3

install.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    2s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    30/10/2026, 18:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install.sh
  • Size 112KB
  • Sample261030-wymq6set71
  • SHA256 ba07019d1eab0bdb8859d44ba7bf90a961a2bbd7f2ce2c716378fbd3e368587f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 5 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/install.sh
    /tmp/install.sh
    1⤵
      PID:644
    • /usr/local/sbin/bash
      bash /tmp/install.sh
      1⤵
        PID:644
      • /usr/local/bin/bash
        bash /tmp/install.sh
        1⤵
          PID:644
        • /usr/sbin/bash
          bash /tmp/install.sh
          1⤵
            PID:644
          • /usr/bin/bash
            bash /tmp/install.sh
            1⤵
              PID:644
            • /sbin/bash
              bash /tmp/install.sh
              1⤵
                PID:644
              • /bin/bash
                bash /tmp/install.sh
                1⤵
                  PID:644
                  • /usr/bin/cut
                    cut -d: -f6
                    2⤵
                      PID:658
                    • /usr/bin/id
                      id -un
                      2⤵
                      • Reads runtime system information
                      PID:662
                    • /usr/bin/getent
                      getent passwd root
                      2⤵
                        PID:657
                      • /usr/bin/id
                        id -u
                        2⤵
                        • Reads runtime system information
                        PID:672
                      • /bin/uname
                        uname -s
                        2⤵
                          PID:679
                        • /usr/bin/tr
                          tr "[:upper:]" "[:lower:]"
                          2⤵
                            PID:682
                          • /bin/uname
                            uname -m
                            2⤵
                              PID:683
                            • /bin/uname
                              uname -m
                              2⤵
                                PID:684
                              • /bin/mkdir
                                mkdir -p /root/.rafikicode
                                2⤵
                                • Reads runtime system information
                                PID:686
                              • /bin/date
                                date -u "+%Y-%m-%d %H:%M:%S UTC"
                                2⤵
                                  PID:688
                                • /bin/uname
                                  uname -a
                                  2⤵
                                    PID:690
                                  • /bin/sed
                                    sed "s|//[^/@]*@|//***@|"
                                    2⤵
                                    • Reads runtime system information
                                    PID:693
                                  • /usr/bin/dirname
                                    dirname /root/.rafikicode/bin
                                    2⤵
                                      PID:696
                                    • /bin/df
                                      df -h /tmp /root/.rafikicode
                                      2⤵
                                      • Reads runtime system information
                                      PID:697

                                  Network

                                        MITRE ATT&CK Matrix

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 91B
                                        • SHA256 4aeb1819d6850ef9ae95d9a591460a6d2fa91d1b617967ae24e5bc1db4d329be
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 376B
                                        • SHA256 be4c2c0de7439bfa09e36d1ef4f504d1a9fd0727280e13c56425d4987de484fe
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 497B
                                        • SHA256 9d601c5a699f6c3c24e282cd48fd8de3b7e2d80698d362d43cde8eebd69c442c
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 626B
                                        • SHA256 c35ef5902e4c82cb56fc2938e72934bacd73aaa0c24e6bae88bcea3c3aa21412
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download