Overview

overview

3

Static

static

1

smashtest.sh

ubuntu-18.04-amd64

3

smashtest.sh

debian-9-armhf

3

smashtest.sh

debian-9-mips

3

smashtest.sh

debian-9-mipsel

3

Analysis

  • max time kernel
    0s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20261019-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    07/11/2026, 12:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    smashtest.sh
  • Size 837B
  • Sample261107-phyeeabx4x
  • SHA256 b9b6d3fc222f1b18c066c52c202b0210fca7acb55dddc3dd37909bdfd0eff996
  • MD5 SHA1 SHA512 TLSH
Score
3/10
discovery

Malware Config

Signatures

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/smashtest.sh
    /tmp/smashtest.sh
    1⤵
    • Writes file to tmp directory
    PID:1519
    • /usr/bin/gdb
      gdb -batch -x /tmp/.a/dump.gdb --args /tmp/.a/runner 63 212
      2⤵
      • Reads runtime system information
      PID:1520
      • /usr/local/sbin/iconv
        iconv -l
        3⤵
          PID:1524
        • /usr/local/bin/iconv
          iconv -l
          3⤵
            PID:1524
          • /usr/sbin/iconv
            iconv -l
            3⤵
              PID:1524
            • /usr/bin/iconv
              iconv -l
              3⤵
                PID:1524
            • /usr/bin/head
              head -1
              2⤵
                PID:1528
              • /bin/grep
                grep -oP "memory corruption: \\K0x[0-9a-f]+" /tmp/sm__.txt
                2⤵
                  PID:1527

              Network

                    MITRE ATT&CK Matrix

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    sm__.txt
                    • Path /tmp/sm__.txt
                    • Size 96B
                    • SHA256 64ac0f1d3e64d8e94509d72e6155af6c0ee130864b14bc083a6ba0efd5f8988b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __init__.cpython-36.pyc.139795458703968
                    • Path /usr/share/gdb/python/gdb/__pycache__/__init__.cpython-36.pyc.139795458703968
                    • Size 3KB
                    • SHA256 984f4f3973a2fca8333de1b24129d8ee2c790f8fc2e06dfb4b0214d59048cbc1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __init__.cpython-36.pyc.139795457709400
                    • Path /usr/share/gdb/python/gdb/command/__pycache__/__init__.cpython-36.pyc.139795457709400
                    • Size 128B
                    • SHA256 392dbf8bdba6c3f175670db3162d7899606403f914c0e38119cba50de2fbd054
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __init__.cpython-36.pyc.139795457708800
                    • Path /usr/share/gdb/python/gdb/function/__pycache__/__init__.cpython-36.pyc.139795457708800
                    • Size 129B
                    • SHA256 0e931d4b20a1be6c54d9797c8b2a2ee9972d7fe01bb40ca7cb3754e125bfe4eb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __init__.cpython-36.pyc.139795456590472
                    • Path /usr/share/gdb/python/gdb/printer/__pycache__/__init__.cpython-36.pyc.139795456590472
                    • Size 128B
                    • SHA256 1ffb6ac93a9bcb8f0d346976772320bd9c04a1d4cd54db6d0127066f0c4faf21
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download