349b7ecb71378c3e5ee2ad318528b31e868a31d7982fe8b5bd3663ff86ee31f8 | Triage™

Login
Reports

Overview

overview

3

Static

static

1

action.sh

ubuntu-18.04-amd64

action.sh

debian-9-armhf

action.sh

debian-9-mips

action.sh

debian-9-mipsel

bin/duckctl.sh

ubuntu-18.04-amd64

bin/duckctl.sh

debian-9-armhf

bin/duckctl.sh

debian-9-mips

bin/duckctl.sh

debian-9-mipsel

bin/duckd

ubuntu-18.04-amd64

bin/duckd

debian-9-armhf

bin/duckd

debian-9-mips

bin/duckd

debian-9-mipsel

bin/tini-arm64

ubuntu-18.04-amd64

bin/tini-arm64

debian-9-armhf

bin/tini-arm64

debian-9-mips

bin/tini-arm64

debian-9-mipsel

boot-completed.sh

ubuntu-18.04-amd64

boot-completed.sh

debian-9-armhf

boot-completed.sh

debian-9-mips

boot-completed.sh

debian-9-mipsel

customize.sh

ubuntu-18.04-amd64

customize.sh

debian-9-armhf

customize.sh

debian-9-mips

customize.sh

debian-9-mipsel

device-faker.sh

windows10-2004-x64

3

device-faker.sh

windows11-ltsc_2024-x64

3

device-fak...engine

ubuntu-18.04-amd64

device-fak...engine

debian-9-armhf

device-fak...engine

debian-9-mips

device-fak...engine

debian-9-mipsel

hotinstall.sh

ubuntu-18.04-amd64

hotinstall.sh

debian-9-armhf

Sharing

Copy URL Twitter E-mail

General

Target
349b7ecb71378c3e5ee2ad318528b31e868a31d7982fe8b5bd3663ff86ee31f8
Size 10.9MB
Sample261102-mj4lpseg57
SHA256 349b7ecb71378c3e5ee2ad318528b31e868a31d7982fe8b5bd3663ff86ee31f8
MD5 0ddb51d8a18d836a6fcfdb1d1404d84f
SHA1 d3b88dfe381e6420f93e7b21cd931943ddd1a008
SHA512 a0c56653c93a2ae136b0c5daa08b0dc4e2493f00db859df67df9e4930833ad3c6530bd036880616ff633899650a58c619e0a316277de9e4ca6c190ab9e6409a0
SSDEEP 196608:PeNJb4cy/3EjVj/LYrzHk3gaFHS1kqh+3fjWnAVpXAsa0Bd6g7Y7nocHLWDBO1ix:GR4hMBjjMNaxSL0fjPAsaOGbRHKD8b98
TLSH
T15CB63378906AA173C573D8F1CC034927918B3C58902E384EB1B7966E9EF9AD3C79163D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution linux

Static task

static1

Behavioral task

behavioral1

Sample

action.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

action.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

action.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

action.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

bin/duckctl.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

bin/duckctl.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

bin/duckctl.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

bin/duckctl.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

bin/duckd

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

bin/duckd

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

bin/duckd

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

bin/duckd

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

bin/tini-arm64

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

bin/tini-arm64

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

bin/tini-arm64

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

bin/tini-arm64

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

boot-completed.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

boot-completed.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

boot-completed.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

boot-completed.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

customize.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

customize.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

customize.sh

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

customize.sh

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

device-faker.sh

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral26

Sample

device-faker.sh

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral27

Sample

device-faker/device-faker-engine

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

device-faker/device-faker-engine

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

device-faker/device-faker-engine

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

device-faker/device-faker-engine

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

hotinstall.sh

Resource

ubuntu1804-amd64-20261019-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

hotinstall.sh

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Malware Config

Targets

- Target
  action.sh
- Size 1KB
- SHA256 32c5c50ffb1e1017f418e1b93d8290269c33c8e6db40f2f14dad9a35a5004ee8
- MD5 41a3c7aed72e083e5c4dd3c3ff9f6280
- SHA1 92b076ac7ff6fd7c9f0ecb824b92a1cca67260ab
- SHA512 fee8c511585a8cb020870091ed9df32f58f9a37e73e85ab75fe7cde96d72297aeec1fadd0ebd1ee9bab961d0a7e141d4885967ffebfe4fb714dbf0b6bf03f2da
- TLSH
  T19B4163F3F0611839785E096BAB4A10D0B793A4930C195928B0F7D37DBD3D1B172AF66A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  bin/duckctl.sh
- Size 2KB
- SHA256 93f2c6c76ba1145be5f4a931b8789502bb043f7666580f97e1fd7cd3c9dc89fa
- MD5 c547575915895ed0d42e92dbb8d82d72
- SHA1 350a79b1c41adb3d3bd56ba4f7131995c847c6d7
- SHA512 6fa4974aa479946c327c772742f922c9919d0d4f9d47ffef9a407c2e91d48d004566bcc54f65b5c2caf5160c4ebbfe00a62839f75a14d1a23174a29a8a12edea
- TLSH
  T1A05142495F554335154D48B05264E8D174446D9363EE38F1FC6C52BC2F741F27CFAA89
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  bin/duckd
- Size 9.3MB
- SHA256 a520cabea6e3b0cfebb129f157612c515364f3353a0c52852ae1c4fbc1ceb935
- MD5 8ffcb809113551ec89b6ece523f7a67d
- SHA1 5409824e0ea0b66fa0e72e76b63a3b9bb880706a
- SHA512 45ea46ed23a9496f52d286274bfd33dd172222b6c8689785cff88d0a66537de6f14e4daba72cc14a5cb6ea34f1ab29095004cf5189e9867a11104701d0f197bf
- SSDEEP 196608:zVBnaUkrjbfMy2IQNgX/R8M8yotY418X:zVBIfMy2IMgX/R8M8yAg
- TLSH
  T155A6BE5DE14DD82ADFC6F0FC8D4C08A7B11A7AB41424C0B93826464DF593BFA8779B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  bin/tini-arm64
- Size 533KB
- SHA256 eae1d3aa50c48fb23b8cbdf4e369d0910dfc538566bfd09df89a774aa84a48b9
- MD5 710d849f8664a5364ff06c551972881c
- SHA1 e90ce37e9db032a0ac686ab5ccbe6611a2277bf7
- SHA512 bdae740a39631d82011c6771fc6f31b8e039636e26b4b184353c9e5a8f79740fc200ea98be7560ec2f84856db9f6720317796d48f68a99dab684c25c83190b68
- SSDEEP 12288:Qq65y5186yhuA0m2frc3CuxrGsfqL4HuV+72CHygKJOe:f6E5m6yhDCrcyQrnu4OV62Zn
- TLSH
  T1EAC47D9C7E4E3D43D2C7F23DDA4A8761723B74B8E363C2A27501026DD5D2DA9CBA1261
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  boot-completed.sh
- Size 1KB
- SHA256 55ecd2a670162825b751a3f6f9c37c7f29d507ad78e6d100ba263b8d5858c698
- MD5 55029dda790f6eececa7f659117f723c
- SHA1 1292ee670d4b5be83a682b06f2b7bf9b5f11769d
- SHA512 65d5adf2dfd9df154ea06958ced897c7019351ef0bbe181c8e0773557640f48fc4798ab416596d0734d12209dcc716f2487dc70ac196ba68c10f3d3b746d3533
- TLSH
  T1C44167E3B624093C2659560DFC08C1E23D5A092207FD1670F0DEE68C7E485345AB97F8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18 behavioral19 behavioral20
- Target
  customize.sh
- Size 2KB
- SHA256 2761bb1dfef1d858253ea8037a67fefe8f2d5235a610e2dedc71dba0c8b14c2b
- MD5 9f38ff2a0f76e167c7b9723267c87b5d
- SHA1 8ac0097d44a337d6fc014971344a9739b02bfd44
- SHA512 02e455faa2c064234b60aa17a8b78447e7e2b3b52769f91096421d460726160f3738e1f7e09b749100fbd2f8b36a1fce4e35f488ca97c510de8b830f9961c865
- TLSH
  T1F751531BF5349631370A1F87E102D0513A57A6E04FF078F9709AA6FC3E707B069BAA11
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22 behavioral23 behavioral24
- Target
  device-faker.sh
- Size 267B
- SHA256 9fbfec9ce3800d1508e064dc66012e433671c5788fdddee38ec16972359593a7
- MD5 6e2a6b55bc6361108d6e4bf7c2086cf7
- SHA1 43f0aa5b3bf3435b08ca249645d92ab71933bc4b
- SHA512 ea130b548d71fedae41d26819acd2cdd13e63af5dfec0ea38a347a81e13729d6944f5799beb3e1d2aac22512ce28a2d590c0c6f76d95daf8b5f4f4d34cca73f5
- TLSH
  T1A7D017B0E9A2D83C023E5A10EC641A047DBFCE418368B9E9F2CEE9AC7D84C109812325
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  device-faker/device-faker-engine
- Size 860KB
- SHA256 fb9f3f7a44afb1434f5b3b0289dcda0780f8e1c0772fd9dd930460226a75f588
- MD5 1f555b934144ca5321759dfe34fa545c
- SHA1 eedbd56985707fb17aa92720c906f1c7f9932d1b
- SHA512 f13b6aa3e07d00354145b3bfeebf619066b3661266b3375ef0f21a8a142910540cd83499da69ed3fe9637831012b697d4b8b119fe982fc62f5f58c4403bf79d1
- SSDEEP 12288:x5PP5HK6PgOR08COjj/GSz/u/H9RCL0h/K45mVsohU4wlbMyqQ+GBGn2v4+iO:HXtPoOTDujCL0t5mVsohZwzqQ+GVr
- TLSH
  T179159F44AE4CA82ADEC2F0FD8D5804E1B12F39FC1125D1BA3826525DF8937E5477AB39
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  hotinstall.sh
- Size 319B
- SHA256 75f788a3e8ede8227d44a90f8269c1c2f0ac4f4745ecb24130e95f1188f65a86
- MD5 8e021610da63e88947bb2c4d35dcbeb7
- SHA1 5292a060fd51b73b79ef2ec4cd590a53310bcbe0
- SHA512 823cb39be4a2fd1a1478d893b5cbf41ba4bd22b12f638858e1bc34d73353bd509dc36a679f9ac2da9e6201509372a072e42e9220dcc61a78ab106176d474b5cf
- TLSH
  T1F2E02699333019252A05B19AE41714213AA68B2755B070A994CEC8C89D2A858131E7B4
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy