c179ee1ae4f1027f6938c4934778d8e17f7ca6fd12597338510015eb18eee621

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/07/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rakit.sh
Size 63KB
Sample260702-wycafagy6n
SHA256 c179ee1ae4f1027f6938c4934778d8e17f7ca6fd12597338510015eb18eee621
MD5 0034128052c9cc21c4092daade69791b
SHA1 7a87ba65d3f67dc027c998c393d7c1ee8ef8efde
SHA512 f3875e711ac0ea7fe958911966d97ab2d7ea04e89dcc3a2b85b159370744d2c3555398b0b077489fbd0484c3c7c6f04924c6243e1f2407f23bf66c855cc3e573
SSDEEP 1536:KlqJqPBJPkiZwSkHHQiHwPvkKWN5755IGyEL/agWaqaeyflelX71vJ7s/h9a949Y:cnPLZoHH3HwEK8955IGyEL/agWaqaC7n
TLSH
T12B53E85E7CF48DF1100BC539E9866015EDBAF18F4AB8B86CF29F682C13B8590786C45E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery

Malware Config

Signatures

Checks system information (zLinux) 1 TTPs 2 IoCs

Check system information on IBM zSystems which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/sysinfo	lscpu
File opened for reading	/proc/sysinfo	lscpu

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	lscpu
File opened for reading	/proc/cpuinfo	lscpu

Reads CPU attributes 1 TTPs 49 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/level	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	lscpu
File opened for reading	/sys/devices/system/cpu/online	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/level	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/present	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/size	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/size	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	lscpu
File opened for reading	/sys/devices/system/cpu/possible	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/level	lscpu
File opened for reading	/sys/devices/system/cpu/kernel_max	lscpu
File opened for reading	/sys/devices/system/cpu/online	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/size	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/level	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/thread_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/thread_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/level	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/level	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/size	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/level	lscpu
File opened for reading	/sys/devices/system/cpu/present	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/level	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	lscpu
File opened for reading	/sys/devices/system/cpu/kernel_max	lscpu
File opened for reading	/sys/devices/system/cpu/possible	lscpu

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node	lscpu
File opened for reading	/sys/devices/system/node/node0/cpumap	lscpu
File opened for reading	/sys/devices/system/node	lscpu
File opened for reading	/sys/devices/system/node/node0/cpumap	lscpu

Reads runtime system information 15 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	lscpu
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/self/fd	lsb_release
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/kernel/osrelease	lscpu
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/fd	lsb_release

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1516	ip
1523	awk
1530	awk

/tmp/Rakit.sh
/tmp/Rakit.sh
1⤵
PID:1496
- /usr/bin/clear
  clear
  2⤵
  PID:1497
- /usr/bin/clear
  clear
  2⤵
  PID:1498
- /usr/bin/awk
  awk "-F@" "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:1502
- /usr/bin/awk
  awk -F: "/^Model name:/{print \$2}"
  2⤵
  - Reads runtime system information
  PID:1501
- /usr/bin/xargs
  xargs
  2⤵
  - Reads runtime system information
  PID:1504
- - /usr/local/sbin/echo
    echo
    3⤵
    PID:1507
- - /usr/local/bin/echo
    echo
    3⤵
    PID:1507
- - /usr/sbin/echo
    echo
    3⤵
    PID:1507
- - /usr/bin/echo
    echo
    3⤵
    PID:1507
- - /sbin/echo
    echo
    3⤵
    PID:1507
- - /bin/echo
    echo
    3⤵
    PID:1507
- /usr/bin/awk
  awk -FCPU "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:1503
- /usr/bin/lscpu
  lscpu
  2⤵
  - Checks system information (zLinux)
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1500
- /usr/bin/awk
  awk "/Socket/{print \$2}"
  2⤵
  - Reads runtime system information
  PID:1510
- /usr/bin/lscpu
  lscpu
  2⤵
  - Checks system information (zLinux)
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1509
- /usr/bin/awk
  awk "/^Mem/{print \$2,\$3}"
  2⤵
  - Reads runtime system information
  PID:1513
- /usr/bin/free
  free -h
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1512
- /usr/bin/wc
  wc -l
  2⤵
  PID:1519
- /bin/grep
  grep "\\<inet\\>"
  2⤵
  PID:1518
- /bin/grep
  grep -v 127.0.0.1
  2⤵
  PID:1517
- /sbin/ip
  ip a
  2⤵
  - System Network Configuration Discovery
  PID:1516
- /usr/bin/awk
  awk "/^Description/{print \$2}"
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:1523
- /usr/bin/lsb_release
  lsb_release -a
  2⤵
  - Reads runtime system information
  PID:1522
- - /usr/local/sbin/dpkg-query
    dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
    3⤵
    PID:1524
- - /usr/local/bin/dpkg-query
    dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
    3⤵
    PID:1524
- - /usr/sbin/dpkg-query
    dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
    3⤵
    PID:1524
- - /usr/bin/dpkg-query
    dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
    3⤵
    PID:1524
- /usr/bin/awk
  awk "/^Description/{print \$3}"
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:1530
- /usr/bin/lsb_release
  lsb_release -a
  2⤵
  - Reads runtime system information
  PID:1529
- - /usr/local/sbin/dpkg-query
    dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
    3⤵
    PID:1531
- - /usr/local/bin/dpkg-query
    dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
    3⤵
    PID:1531
- - /usr/sbin/dpkg-query
    dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
    3⤵
    PID:1531
- - /usr/bin/dpkg-query
    dpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security
    3⤵
    PID:1531
- /usr/bin/awk
  awk -F. "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:1534
- /bin/rm
  rm -rf speedtest-cli.py
  2⤵
  PID:1535
- /bin/rm
  rm -f /tmp/Rakit.sh
  2⤵
  PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads