Analysis
- max time kernel
1s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
30/06/2026, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target 14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
- Size 122KB
- Sample260630-2xw64sbs8t
- SHA256 14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
- MD5 bbd5cac02e5a6df02668f0d62ed4061a
- SHA1 3bfe75039b163508564f51641d5e9a2e70454571
- SHA512 b4480f644de34163f89700cbda8b1db64f27e774b41bfb4acea19b171dfbcd649c36c65c3637a67c40adad1de17c3539203131a2492bddca74211644475a668d
- SSDEEP 1536:U2Gbr4bmp4zHSFhQo+Pww6JPh6UiTX430AjJSSaED/y9yTnML:pqr4bmKHSIPq6U1tzpq
- TLSH T143C3EA2269514DF434C8D67C46C751502738A00B890A2D2CF4AEF6683FAEA78B1F67FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/2/cmdline ps File opened for reading /proc/22/cmdline ps File opened for reading /proc/298/stat ps File opened for reading /proc/14/status ps File opened for reading /proc/24/cmdline ps File opened for reading /proc/643/stat ps File opened for reading /proc/674/status ps File opened for reading /proc/169/stat ps File opened for reading /proc/315/cmdline ps File opened for reading /proc/5/status ps File opened for reading /proc/6/cmdline ps File opened for reading /proc/9/stat ps File opened for reading /proc/17/status ps File opened for reading /proc/185/stat ps File opened for reading /proc/292/status ps File opened for reading /proc/3/status ps File opened for reading /proc/23/stat ps File opened for reading /proc/42/stat ps File opened for reading /proc/679/cmdline ps File opened for reading /proc/159/stat ps File opened for reading /proc/185/cmdline ps File opened for reading /proc/278/cmdline ps File opened for reading /proc/315/stat ps File opened for reading /proc/677/cmdline ps File opened for reading /proc/76/status ps File opened for reading /proc/315/status ps File opened for reading /proc/582/cmdline ps File opened for reading /proc/filesystems mkdir File opened for reading /proc/298/status ps File opened for reading /proc/641/status ps File opened for reading /proc/12/cmdline ps File opened for reading /proc/17/cmdline ps File opened for reading /proc/25/status ps File opened for reading /proc/tty/drivers ps File opened for reading /proc/647/status ps File opened for reading /proc/19/status ps File opened for reading /proc/23/cmdline ps File opened for reading /proc/677/status ps File opened for reading /proc/29/cmdline ps File opened for reading /proc/76/stat ps File opened for reading /proc/642/cmdline ps File opened for reading /proc/3/cmdline ps File opened for reading /proc/16/stat ps File opened for reading /proc/19/stat ps File opened for reading /proc/678/stat ps File opened for reading /proc/5/stat ps File opened for reading /proc/29/status ps File opened for reading /proc/136/cmdline ps File opened for reading /proc/159/status ps File opened for reading /proc/582/stat ps File opened for reading /proc/26/status ps File opened for reading /proc/10/status ps File opened for reading /proc/filesystems ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/636/status ps File opened for reading /proc/1/cmdline ps File opened for reading /proc/11/stat ps File opened for reading /proc/98/stat ps File opened for reading /proc/138/stat ps File opened for reading /proc/636/stat ps File opened for reading /proc/meminfo ps File opened for reading /proc/106/status ps File opened for reading /proc/226/cmdline ps
Processes
-
/tmp/14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397/tmp/14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b2045683971⤵PID:645
-
/bin/grepgrep "^VERSION_ID" /etc/os-release2⤵PID:653
-
-
/usr/bin/trtr -d "\""2⤵PID:656
-
-
/usr/bin/trtr -d .2⤵PID:657
-
-
/usr/bin/cutcut -d "=" -f22⤵PID:654
-
-
/bin/mkdirmkdir -p /var/log/x-ui2⤵
- Reads runtime system information
PID:661
-
-
/bin/grepgrep -v grep2⤵PID:678
-
-
/bin/grepgrep xray-linux2⤵PID:677
-
-
/bin/psps -ef2⤵
- Reads CPU attributes
- Reads runtime system information
PID:676
-
-
/usr/bin/wcwc -l2⤵PID:679
-