Analysis
- max time kernel
0s - max time network
147s - platform
debian-12_armhf - resource
debian12-armhf-20250619-en - resource tags
- submitted
08/05/2026, 00:24
General
- Target nezha-agent
- Size 16.1MB
- Sample260508-ap2cbabz9w
- SHA256 f0046a0525b3c14f54c430f180e5f234d2ae78703a1d5f448c9eb214cbefbe8e
Score
3/10
Malware Config
Signatures
- Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 4 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/nezha-agent/tmp/nezha-agent1⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
config.yml