8bfb0d63675fa08fc89aac7fc04663d2f05bce0add2de008bde0af7d6d869993

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/06/2026, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8bfb0d63675fa08fc89aac7fc04663d2f05bce0add2de008bde0af7d6d869993
Size 1KB
Sample260627-ywjylsdt21
SHA256 8bfb0d63675fa08fc89aac7fc04663d2f05bce0add2de008bde0af7d6d869993
MD5 99717ce82c3ce1aedd99ba27e367ba91
SHA1 c119cf60e84c673f89357eea2657409585cd4a54
SHA512 5946b68578256a2a4023aa6194ede0f2c33796294648162bb194fd9c5331d8e927b8d63768c74bf3d9863060fe5c14f0de997a1883c2c48e7f71c5abcfcdec59
TLSH
T14631D0D27F9E9CB5B6CE22FF786B8724B8F3751A20117800B05734B52B41A896254607
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

/tmp/8bfb0d63675fa08fc89aac7fc04663d2f05bce0add2de008bde0af7d6d869993
/tmp/8bfb0d63675fa08fc89aac7fc04663d2f05bce0add2de008bde0af7d6d869993
1⤵
PID:651
- /usr/bin/curl
  curl -sk --cert /var/lib/kubelet/pki/kubelet-client-current.pem --key /var/lib/kubelet/pki/kubelet-client-current.pem https://localhost:10250/pods
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:660
- /usr/bin/python3
  python3 -c " import sys,json data = json.load(sys.stdin) for item in data.get('items',[]): if 'do-node-agent' in item['metadata']['name']: print(item['metadata']['uid']) "
  2⤵
  PID:682

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads