c179ee1ae4f1027f6938c4934778d8e17f7ca6fd12597338510015eb18eee621

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/07/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rakit.sh
Size 63KB
Sample260702-wylh4sby21
SHA256 c179ee1ae4f1027f6938c4934778d8e17f7ca6fd12597338510015eb18eee621
MD5 0034128052c9cc21c4092daade69791b
SHA1 7a87ba65d3f67dc027c998c393d7c1ee8ef8efde
SHA512 f3875e711ac0ea7fe958911966d97ab2d7ea04e89dcc3a2b85b159370744d2c3555398b0b077489fbd0484c3c7c6f04924c6243e1f2407f23bf66c855cc3e573
SSDEEP 1536:KlqJqPBJPkiZwSkHHQiHwPvkKWN5755IGyEL/agWaqaeyflelX71vJ7s/h9a949Y:cnPLZoHH3HwEK8955IGyEL/agWaqaC7n
TLSH
T12B53E85E7CF48DF1100BC539E9866015EDBAF18F4AB8B86CF29F682C13B8590786C45E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery

Malware Config

Signatures

Checks system information (zLinux) 1 TTPs 2 IoCs

Check system information on IBM zSystems which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/sysinfo	lscpu
File opened for reading	/proc/sysinfo	lscpu

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	lscpu
File opened for reading	/proc/cpuinfo	lscpu

Reads CPU attributes 1 TTPs 17 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	lscpu
File opened for reading	/sys/devices/system/cpu/present	lscpu
File opened for reading	/sys/devices/system/cpu/online	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/thread_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/cpu0/topology/thread_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/kernel_max	lscpu
File opened for reading	/sys/devices/system/cpu/possible	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	lscpu
File opened for reading	/sys/devices/system/cpu/possible	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	lscpu
File opened for reading	/sys/devices/system/cpu/present	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/kernel_max	lscpu

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node	lscpu
File opened for reading	/sys/firmware/efi/systab	lscpu
File opened for reading	/sys/devices/system/node	lscpu
File opened for reading	/sys/firmware/efi/systab	lscpu

Reads runtime system information 19 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/sys/kernel/osrelease	lscpu
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/device-tree/compatible	lscpu
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/efi/systab	lscpu
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/efi/systab	lscpu
File opened for reading	/proc/filesystems	free
File opened for reading	/proc/self/status	lscpu
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/device-tree/compatible	lscpu
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/bus/pci/devices	lscpu
File opened for reading	/proc/sys/kernel/osrelease	lscpu
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/status	lscpu
File opened for reading	/proc/bus/pci/devices	lscpu

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
687	ip

/tmp/Rakit.sh
/tmp/Rakit.sh
1⤵
PID:643
- /usr/bin/clear
  clear
  2⤵
  PID:670
- /usr/bin/clear
  clear
  2⤵
  PID:671
- /usr/bin/lscpu
  lscpu
  2⤵
  - Checks system information (zLinux)
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:673
- /usr/bin/awk
  awk "-F@" "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:675
- /usr/bin/awk
  awk -F: "/^Model name:/{print \$2}"
  2⤵
  - Reads runtime system information
  PID:674
- /usr/bin/awk
  awk -FCPU "{print \$2}"
  2⤵
  - Reads runtime system information
  PID:676
- /usr/bin/xargs
  xargs
  2⤵
  - Reads runtime system information
  PID:677
- - /usr/local/sbin/echo
    echo
    3⤵
    PID:678
- - /usr/local/bin/echo
    echo
    3⤵
    PID:678
- - /usr/sbin/echo
    echo
    3⤵
    PID:678
- - /usr/bin/echo
    echo
    3⤵
    PID:678
- - /sbin/echo
    echo
    3⤵
    PID:678
- - /bin/echo
    echo
    3⤵
    PID:678
- /usr/bin/lscpu
  lscpu
  2⤵
  - Checks system information (zLinux)
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:680
- /usr/bin/awk
  awk "/Socket/{print \$2}"
  2⤵
  - Reads runtime system information
  PID:681
- /usr/bin/free
  free -h
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:684
- /usr/bin/awk
  awk "/^Mem/{print \$2,\$3}"
  2⤵
  - Reads runtime system information
  PID:685
- /bin/grep
  grep -v 127.0.0.1
  2⤵
  PID:688
- /bin/grep
  grep "\\<inet\\>"
  2⤵
  PID:689
- /sbin/ip
  ip a
  2⤵
  - System Network Configuration Discovery
  PID:687
- /usr/bin/wc
  wc -l
  2⤵
  PID:690
- /bin/rm
  rm -rf speedtest-cli.py
  2⤵
  PID:691
- /bin/rm
  rm -f /tmp/Rakit.sh
  2⤵
  PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads