13eff26504b50540742450724693e0b4a97554a7be1bef7a4f10b7751ac70c28

Analysis

max time kernel
0s
max time network
155s
platform
debian-12_armhf
resource
debian12-armhf-20240221-en
resource tags

arch:armhfimage:debian12-armhf-20240221-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
21/03/2025, 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1e23894b2ab04f5a22ed05b0cf3720af1825b19
Size

477KB
MD5

5fa0454db32325c42ee70186cd5760c2
SHA1

e1e23894b2ab04f5a22ed05b0cf3720af1825b19
SHA256

13eff26504b50540742450724693e0b4a97554a7be1bef7a4f10b7751ac70c28
SHA512

2071db597c55baf733ed051a8708fb35faaccc2cba340753181f9a790b8f3c199ea3d98d0f245246017d41fc9231ee301f7870d1ab0a8c01de00bd59875b5325
SSDEEP

12288:mImKqCjN6zugS32U4oVPE3pNdsDrxzSNaWlCBPOe1WC:ZmKqCfgdj9zD

Score

7^/10

antivm

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
709	e1e23894b2ab04f5a22ed05b0cf3720af1825b19

Renames itself 1 IoCs

pid	Process
709	e1e23894b2ab04f5a22ed05b0cf3720af1825b19

Checks hardware identifiers (DMI) 1 TTPs 1 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/sys_vendor	e1e23894b2ab04f5a22ed05b0cf3720af1825b19

/tmp/e1e23894b2ab04f5a22ed05b0cf3720af1825b19
/tmp/e1e23894b2ab04f5a22ed05b0cf3720af1825b19
1⤵
- Deletes itself
- Renames itself
- Checks hardware identifiers (DMI)
PID:709

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads