Overview

overview

7

Static

static

1

UKRP

debian-12-armhf

7

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260126-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    15/04/2026, 12:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    UKRP
  • Size 125KB
  • Sample260415-pm6ataes8n
  • SHA256 6a9a2fd72c6dd58658f09a6743885605c77be428948c72d6a4539e3982e67418
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmcredential_access

Malware Config

Signatures

  • OS Credential Dumping 1 TTPs 1 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/UKRP
    /tmp/UKRP
    1⤵
    • OS Credential Dumping
    • Checks CPU configuration
    • Writes file to tmp directory
    PID:779
    • /usr/local/sbin/uname
      uname -a
      2⤵
        PID:783
      • /usr/local/bin/uname
        uname -a
        2⤵
          PID:783
        • /usr/sbin/uname
          uname -a
          2⤵
            PID:783
          • /usr/bin/uname
            uname -a
            2⤵
              PID:783

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                .zwxGXIla
                • Path /tmp/.zwxGXIla
                • Size 18B
                • SHA256 7b689759c59ae3d2f9468fd1542c0b29e7fa372e4fd9a5c6666757d8cd2960a3
                • MD5 SHA1 SHA512
                Submit Download