Overview

overview

7

Static

static

1

install.sh

ubuntu-18.04-amd64

7

install.sh

debian-9-armhf

3

install.sh

debian-9-mips

3

install.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    3s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20260513-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    30/10/2026, 18:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install.sh
  • Size 112KB
  • Sample261030-wymq6set71
  • SHA256 ba07019d1eab0bdb8859d44ba7bf90a961a2bbd7f2ce2c716378fbd3e368587f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 5 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/install.sh
    /tmp/install.sh
    1⤵
      PID:712
    • /usr/local/sbin/bash
      bash /tmp/install.sh
      1⤵
        PID:712
      • /usr/local/bin/bash
        bash /tmp/install.sh
        1⤵
          PID:712
        • /usr/sbin/bash
          bash /tmp/install.sh
          1⤵
            PID:712
          • /usr/bin/bash
            bash /tmp/install.sh
            1⤵
              PID:712
            • /sbin/bash
              bash /tmp/install.sh
              1⤵
                PID:712
              • /bin/bash
                bash /tmp/install.sh
                1⤵
                  PID:712
                  • /usr/bin/cut
                    cut -d: -f6
                    2⤵
                      PID:726
                    • /usr/bin/id
                      id -un
                      2⤵
                      • Reads runtime system information
                      PID:729
                    • /usr/bin/getent
                      getent passwd root
                      2⤵
                        PID:725
                      • /usr/bin/id
                        id -u
                        2⤵
                        • Reads runtime system information
                        PID:735
                      • /bin/uname
                        uname -s
                        2⤵
                          PID:740
                        • /usr/bin/tr
                          tr "[:upper:]" "[:lower:]"
                          2⤵
                            PID:743
                          • /bin/uname
                            uname -m
                            2⤵
                              PID:745
                            • /bin/uname
                              uname -m
                              2⤵
                                PID:747
                              • /bin/mkdir
                                mkdir -p /root/.rafikicode
                                2⤵
                                • Reads runtime system information
                                PID:750
                              • /bin/date
                                date -u "+%Y-%m-%d %H:%M:%S UTC"
                                2⤵
                                  PID:752
                                • /bin/uname
                                  uname -a
                                  2⤵
                                    PID:755
                                  • /bin/sed
                                    sed "s|//[^/@]*@|//***@|"
                                    2⤵
                                    • Reads runtime system information
                                    PID:758
                                  • /usr/bin/dirname
                                    dirname /root/.rafikicode/bin
                                    2⤵
                                      PID:761
                                    • /bin/df
                                      df -h /tmp /root/.rafikicode
                                      2⤵
                                      • Reads runtime system information
                                      PID:762

                                  Network

                                        MITRE ATT&CK Matrix

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 91B
                                        • SHA256 5e47a9532a02b33a610d61302271f5f36b7a4f2da511deb57aa8fb819dc02f13
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 370B
                                        • SHA256 0e0a0b3ce8709412a20fb9e82b34490af9217b59eaf4ee90e7170c76949f83be
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 491B
                                        • SHA256 c199c460b654622eb3ba42ee0d8fe259927763b5d3b7a5359634ff28f15a497b
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 620B
                                        • SHA256 0512f57270993094250dde7e092b7a27572531613a298914a88a41cb63cdb8b3
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download