Overview

overview

4

Static

static

1

c9da1097e9...ef415d

ubuntu-18.04-amd64

3

c9da1097e9...ef415d

debian-9-armhf

4

c9da1097e9...ef415d

debian-9-mips

3

c9da1097e9...ef415d

debian-9-mipsel

3

Analysis

  • max time kernel
    6s
  • max time network
    8s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    27/06/2026, 20:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c9da1097e9b0c7500aff411699878ec1b33c6345e332dbcb626b9e1c47ef415d
  • Size 1KB
  • Sample260627-ysm6vsds81
  • SHA256 c9da1097e9b0c7500aff411699878ec1b33c6345e332dbcb626b9e1c47ef415d
  • MD5 SHA1 SHA512 TLSH
Score
4/10
antivmdiscovery

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 3 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 6 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/c9da1097e9b0c7500aff411699878ec1b33c6345e332dbcb626b9e1c47ef415d
    /tmp/c9da1097e9b0c7500aff411699878ec1b33c6345e332dbcb626b9e1c47ef415d
    1⤵
    • Writes file to tmp directory
    PID:644
    • /usr/bin/curl
      curl -sk --header "Authorization: Bearer 3cqzht.a5edb9b1266e42c5" https://7c3486b0-e8dd-4089-ad1b-236a97ed0ae1.k8s.ondigitalocean.com:443/api/v1/nodes
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      PID:651
    • /usr/bin/python3
      python3
      2⤵
        PID:653
      • /usr/bin/curl
        curl -sk --header "Authorization: Bearer 3cqzht.a5edb9b1266e42c5" https://7c3486b0-e8dd-4089-ad1b-236a97ed0ae1.k8s.ondigitalocean.com:443/api/v1/secrets
        2⤵
        • Checks CPU configuration
        • Reads runtime system information
        PID:693
      • /usr/bin/python3
        python3
        2⤵
          PID:694
        • /usr/bin/curl
          curl -sk --header "Authorization: Bearer 3cqzht.a5edb9b1266e42c5" https://7c3486b0-e8dd-4089-ad1b-236a97ed0ae1.k8s.ondigitalocean.com:443/api/v1/namespaces/kube-system/secrets/digitalocean
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          PID:743
        • /usr/bin/python3
          python3
          2⤵
            PID:744

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              sh-thd.Cy5zjU
              • Path /tmp/sh-thd.Cy5zjU
              • Size 279B
              • SHA256 69131bbf4577b2fb1e12bb21b1caf05d0638241f255a8c7d2e763db3159ee37a
              • MD5 SHA1 SHA512 TLSH
              Submit Download