Analysis
- max time kernel
0s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
02/11/2026, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
3 signatures
40 seconds
Behavioral task
behavioral2
Sample
f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
40 seconds
Behavioral task
behavioral3
Sample
f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
3 signatures
40 seconds
Behavioral task
behavioral4
Sample
f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
40 seconds
General
- Target f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
- Size 3KB
- Sample261102-n3fvesht71
- SHA256 f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2
- MD5 29bbd3363632c8f8837d0a72b9137cb3
- SHA1 d3f2cb9642e093473fa99cd7a208ee2a6be6c7db
- SHA512 19270c07968e8efc7c57a94e32f41bfd733b2d9c7840ff8c9ba168973c1d86e02d09f695f86d45c1dc1a20805f62ace950334007f01f96ddfbb974939eb6b1ca
- TLSH T19981A1C8A2E5E61F3BCC4D53ED10AADAA9A6872A95C177078798FF5C14EC307E15C4E0
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/27/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/648/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/102/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/196/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/42/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/1/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/111/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/140/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/17/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/288/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/300/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/4/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/570/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/10/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/14/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/2/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/7/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/8/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/158/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/20/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/326/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/41/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/5/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/28/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/594/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/6/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/13/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/21/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/23/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/24/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/25/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/29/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/588/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/647/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/112/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/297/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/3/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/652/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/147/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/18/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/225/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/328/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/109/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/318/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/585/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/22/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/639/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/9/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/15/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/296/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/301/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/593/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/642/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/645/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/11/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/12/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/19/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/43/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/646/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/172/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/26/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/287/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/80/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/139/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh -
description ioc Process File opened for reading /proc/filesystems mkdir
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /home/webLib/sspi_init
- Size 4B
- SHA256 29ef5f0b7fc0c2facd22af7e616542825331312745dfc31f37423ab0b5e005ee
- MD5 053ade8bc0514fd9f8411fec9ae6b566
- SHA1 c90a0564cc13262fab6ef52f7dcd9f502e5d59d6
- SHA512 9e0f874bf4781134a1dbbbbb17f8144aa40ead1de67c424c01c000137e2dd872a2ca0e3a8b90c5701a613256cb4e819d812c783a79a00a022e864529eb589a20
- MD5 SHA1 SHA512
- Path /home/webLib/sspi_init
- Size 4B
- SHA256 5ba22c28ca5e198f96731dda13761ed0853d04cfe4e0399867caf9cea15c272e
- MD5 5321951a8ceb122075cf6e80fce468ca
- SHA1 f29923d781f5c0915498a6f53f1dce37765ef305
- SHA512 8de21f591f377c3531c44c355f9f4a143192c5e6e6d37c4389c398a842eb41f9792e4416b0838efc995ad77b0da8f351c7d6f4903d0c04c0def489fa4c45bd6f
- MD5 SHA1 SHA512