Overview

overview

7

Static

static

1

install.sh

ubuntu-18.04-amd64

7

install.sh

debian-9-armhf

3

install.sh

debian-9-mips

3

install.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    3s
  • platform
    debian-9_mipsel
  • resource
    debian9-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
  • submitted
    30/10/2026, 18:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install.sh
  • Size 112KB
  • Sample261030-wymq6set71
  • SHA256 ba07019d1eab0bdb8859d44ba7bf90a961a2bbd7f2ce2c716378fbd3e368587f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 5 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/install.sh
    /tmp/install.sh
    1⤵
      PID:718
    • /usr/local/sbin/bash
      bash /tmp/install.sh
      1⤵
        PID:718
      • /usr/local/bin/bash
        bash /tmp/install.sh
        1⤵
          PID:718
        • /usr/sbin/bash
          bash /tmp/install.sh
          1⤵
            PID:718
          • /usr/bin/bash
            bash /tmp/install.sh
            1⤵
              PID:718
            • /sbin/bash
              bash /tmp/install.sh
              1⤵
                PID:718
              • /bin/bash
                bash /tmp/install.sh
                1⤵
                  PID:718
                  • /usr/bin/cut
                    cut -d: -f6
                    2⤵
                      PID:732
                    • /usr/bin/id
                      id -un
                      2⤵
                      • Reads runtime system information
                      PID:734
                    • /usr/bin/getent
                      getent passwd root
                      2⤵
                        PID:730
                      • /usr/bin/id
                        id -u
                        2⤵
                        • Reads runtime system information
                        PID:740
                      • /bin/uname
                        uname -s
                        2⤵
                          PID:745
                        • /usr/bin/tr
                          tr "[:upper:]" "[:lower:]"
                          2⤵
                            PID:748
                          • /bin/uname
                            uname -m
                            2⤵
                              PID:750
                            • /bin/uname
                              uname -m
                              2⤵
                                PID:751
                              • /bin/mkdir
                                mkdir -p /root/.rafikicode
                                2⤵
                                • Reads runtime system information
                                PID:753
                              • /bin/date
                                date -u "+%Y-%m-%d %H:%M:%S UTC"
                                2⤵
                                  PID:756
                                • /bin/uname
                                  uname -a
                                  2⤵
                                    PID:760
                                  • /bin/sed
                                    sed "s|//[^/@]*@|//***@|"
                                    2⤵
                                    • Reads runtime system information
                                    PID:763
                                  • /usr/bin/dirname
                                    dirname /root/.rafikicode/bin
                                    2⤵
                                      PID:766
                                    • /bin/df
                                      df -h /tmp /root/.rafikicode
                                      2⤵
                                      • Reads runtime system information
                                      PID:768

                                  Network

                                        MITRE ATT&CK Matrix

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 91B
                                        • SHA256 bde70989c8e298bbaa89787bc8ac10dbbf2297253600a79c19be74c94f5c78c2
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 371B
                                        • SHA256 647911635c3bb05dba07243a66ec8f3abc9645b03f25633cf7f84dca1b0035e6
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 492B
                                        • SHA256 a88026bfc1b72acee07f920c02ba85bc9fd774ff772341d152bb4f4b3fe10a28
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download

                                        install.log
                                        • Path /root/.rafikicode/install.log
                                        • Size 621B
                                        • SHA256 a269e24ccab7380df18a56a9b212195fa6c6c25acd76749d5bb2ca55323fe550
                                        • MD5 SHA1 SHA512 TLSH
                                        Submit Download