f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2

Analysis

max time kernel
0s
max time network
8s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/11/2026, 11:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
Size 3KB
Sample261102-n3fvesht71
SHA256 f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2
MD5 29bbd3363632c8f8837d0a72b9137cb3
SHA1 d3f2cb9642e093473fa99cd7a208ee2a6be6c7db
SHA512 19270c07968e8efc7c57a94e32f41bfd733b2d9c7840ff8c9ba168973c1d86e02d09f695f86d45c1dc1a20805f62ace950334007f01f96ddfbb974939eb6b1ca
TLSH
T19981A1C8A2E5E61F3BCC4D53ED10AADAA9A6872A95C177078798FF5C14EC307E15C4E0
MD5 SHA1 SHA512 TLSH

Score

6^/10

credential_access discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads process memory 1 TTPs 64 IoCs

Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

credential_access

Proc Filesystem

T1003.007

description	ioc	Process
File opened for reading	/proc/82/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/167/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/444/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/482/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/11/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/169/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/242/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/467/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/512/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/468/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/472/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/891/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/958/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/975/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/162/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/30/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/78/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/79/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/83/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/98/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/163/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/3/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/628/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/899/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/15/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/22/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/26/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/511/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/137/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/29/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/528/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/7/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/13/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/86/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/19/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/456/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/656/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/8/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/160/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/165/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/173/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/31/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/338/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/473/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/960/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/34/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/539/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/6/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/645/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/692/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/9/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/918/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/175/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/24/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/551/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/81/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/158/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/171/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/32/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/36/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/423/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/23/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/27/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/5/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh

Reads runtime system information 49 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1020/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1073/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1232/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1501/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1083/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1292/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1011/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1038/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1075/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1143/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1184/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1285/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1293/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1320/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1002/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1028/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1054/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1057/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1080/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1301/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1365/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1499/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1006/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1055/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1058/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1079/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1126/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1473/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1496/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1024/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1037/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1041/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1043/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1064/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1137/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1331/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1500/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/1045/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1071/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1140/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1159/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1226/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1338/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1503/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1015/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1033/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1085/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
File opened for reading	/proc/1202/maps	f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh

/tmp/f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
/tmp/f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
1⤵
- Reads process memory
- Reads runtime system information
PID:1503
- /bin/mkdir
  mkdir -p /home/webLib
  2⤵
  - Reads runtime system information
  PID:1506

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

OS Credential Dumping

T1003

Proc Filesystem

T1003.007

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sspi_init

Path /home/webLib/sspi_init
Size 4B
SHA256 29ef5f0b7fc0c2facd22af7e616542825331312745dfc31f37423ab0b5e005ee
MD5 053ade8bc0514fd9f8411fec9ae6b566
SHA1 c90a0564cc13262fab6ef52f7dcd9f502e5d59d6
SHA512 9e0f874bf4781134a1dbbbbb17f8144aa40ead1de67c424c01c000137e2dd872a2ca0e3a8b90c5701a613256cb4e819d812c783a79a00a022e864529eb589a20
MD5 SHA1 SHA512

Submit Download