Overview

overview

7

Static

static

1

HVAH

debian-12-armhf

7

Analysis

  • max time kernel
    143s
  • max time network
    148s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260126-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260126-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    15/04/2026, 12:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    HVAH
  • Size 126KB
  • Sample260415-pm6ataes9j
  • SHA256 b89e0bddab26ae722e8af161ab726eb7f25232f00b3cbdc0e6cad665513047df
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmcredential_access

Malware Config

Signatures

  • OS Credential Dumping 1 TTPs 1 IoCs

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/HVAH
    /tmp/HVAH
    1⤵
    • OS Credential Dumping
    • Checks CPU configuration
    • Writes file to tmp directory
    PID:775
    • /usr/local/sbin/uname
      uname -a
      2⤵
        PID:783
      • /usr/local/bin/uname
        uname -a
        2⤵
          PID:783
        • /usr/sbin/uname
          uname -a
          2⤵
            PID:783
          • /usr/bin/uname
            uname -a
            2⤵
              PID:783

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                .zwxGXIla
                • Path /tmp/.zwxGXIla
                • Size 18B
                • SHA256 2e683868f45063bf15f36a2016c1f35ce113619e19fcf9077f7cb50ea3b39140
                • MD5 SHA1 SHA512
                Submit Download