Analysis
- max time kernel
0s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
02/11/2026, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
3 signatures
40 seconds
Behavioral task
behavioral2
Sample
f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
40 seconds
Behavioral task
behavioral3
Sample
f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
3 signatures
40 seconds
Behavioral task
behavioral4
Sample
f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
40 seconds
General
- Target f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh
- Size 3KB
- Sample261102-n3fvesht71
- SHA256 f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2
- MD5 29bbd3363632c8f8837d0a72b9137cb3
- SHA1 d3f2cb9642e093473fa99cd7a208ee2a6be6c7db
- SHA512 19270c07968e8efc7c57a94e32f41bfd733b2d9c7840ff8c9ba168973c1d86e02d09f695f86d45c1dc1a20805f62ace950334007f01f96ddfbb974939eb6b1ca
- TLSH T19981A1C8A2E5E61F3BCC4D53ED10AADAA9A6872A95C177078798FF5C14EC307E15C4E0
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads process memory 1 TTPs 64 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/680/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/703/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/126/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/710/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/24/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/368/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/666/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/705/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/712/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/72/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/8/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/82/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/1/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/10/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/12/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/337/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/36/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/371/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/677/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/17/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/234/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/254/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/37/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/109/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/11/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/367/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/70/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/13/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/22/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/3/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/7/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/714/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/74/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/77/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/15/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/71/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/75/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/76/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/23/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/340/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/416/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/6/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/160/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/20/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/382/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/393/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/4/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/21/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/383/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/5/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/79/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/9/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/2/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/679/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/717/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/16/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/14/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/150/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/176/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/674/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/711/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/80/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/125/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh File opened for reading /proc/18/maps f1d4de01de1e6de618539e9bb2e149374924cadd33554ec18f2c68e7e2c632f2.sh -
description ioc Process File opened for reading /proc/filesystems mkdir
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /home/webLib/sspi_init
- Size 4B
- SHA256 29ef5f0b7fc0c2facd22af7e616542825331312745dfc31f37423ab0b5e005ee
- MD5 053ade8bc0514fd9f8411fec9ae6b566
- SHA1 c90a0564cc13262fab6ef52f7dcd9f502e5d59d6
- SHA512 9e0f874bf4781134a1dbbbbb17f8144aa40ead1de67c424c01c000137e2dd872a2ca0e3a8b90c5701a613256cb4e819d812c783a79a00a022e864529eb589a20
- MD5 SHA1 SHA512
- Path /home/webLib/sspi_init
- Size 4B
- SHA256 5ba22c28ca5e198f96731dda13761ed0853d04cfe4e0399867caf9cea15c272e
- MD5 5321951a8ceb122075cf6e80fce468ca
- SHA1 f29923d781f5c0915498a6f53f1dce37765ef305
- SHA512 8de21f591f377c3531c44c355f9f4a143192c5e6e6d37c4389c398a842eb41f9792e4416b0838efc995ad77b0da8f351c7d6f4903d0c04c0def489fa4c45bd6f
- MD5 SHA1 SHA512