19e7ebfdff1b06177d65587b78aba16db4043f1f780a510d4cba4646d2444096

Analysis

max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install
Size 5KB
Sample260707-pdgk4aev6p
SHA256 19e7ebfdff1b06177d65587b78aba16db4043f1f780a510d4cba4646d2444096
MD5 804cb0663bb10da0aa6d358e836e59eb
SHA1 50059391fef7afceeaa47a49a5f850a21cb9069f
SHA512 94140c17b13930c8a8238b4d7851fcc661999016e0b515a6cac6fe6d687c64738624bdef7cec3cf6745bdec20b15c86d35e06b12a37c36699586498e6d1c4fd3
SSDEEP 96:RVeRzsoF59czXRYS95ZZwl4jPoXPxpiaTQPb3u5/hSrqi1ImWcP+os1Op:iZsoF59czXRYSQCPoxp9Tqbe5/0mwILq
TLSH
T160C130027010177E2159E6B58DB9B149672D100B4D1A7C2CF4AE618AFF997CC33B9BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery execution

Malware Config

Signatures

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.xzNZfa	apt-get
File opened for modification	/tmp/fileutl.message.qJqJYh	apt-get
File opened for modification	/tmp/fileutl.message.0dFKMi	apt-get
File opened for modification	/tmp/fileutl.message.wGdeWl	apt-get

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
653	apt-get

/tmp/install
/tmp/install
1⤵
PID:644
- /usr/bin/apt-get
  apt-get install -yqq minisign curl build-essential git
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:653
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:665

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads