0c82c10fa85c6085ba9966ef77fa5b81e4edb2e434348795939fe5725938dbe9 | Triage™

Analysis

max time kernel
4s
max time network
6s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
extension/dist/scripts/connectionReport.sh
Size 3KB
Sample260717-pmxzfabs4j
SHA256 0c82c10fa85c6085ba9966ef77fa5b81e4edb2e434348795939fe5725938dbe9
MD5 e63a6b9fe2e06e153be6ad315e7a64cf
SHA1 461f36d036b4e32dec3e6d9c7b84188639509855
SHA512 41bf050e5c40ca9f850efb560444cab644685fa8dcc1599bf73e7a1ac77d6c51fd1fe1ec9eb54f65ed718801a072e9ceeecdd78de983b3eb5b89b85df90acb8f
TLSH
T170710D96B8405CB1100BC479A5A36020BB36430F15116C2D7C2EE879AF357E8A3EE7EA
MD5 SHA1 SHA512 TLSH

Score

6^/10

antivm discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

System Checks

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps

Process Discovery 1 TTPs 1 IoCs

Adversaries may try to discover information about running processes.

Process Discovery

pid	Process
751	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/27/cmdline	ps
File opened for reading	/proc/42/status	ps
File opened for reading	/proc/76/cmdline	ps
File opened for reading	/proc/106/stat	ps
File opened for reading	/proc/106/cmdline	ps
File opened for reading	/proc/134/cmdline	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/302/status	ps
File opened for reading	/proc/576/status	ps
File opened for reading	/proc/588/stat	ps
File opened for reading	/proc/748/cmdline	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/109/stat	ps
File opened for reading	/proc/143/status	ps
File opened for reading	/proc/156/stat	ps
File opened for reading	/proc/280/stat	ps
File opened for reading	/proc/283/stat	ps
File opened for reading	/proc/325/status	ps
File opened for reading	/proc/1/stat	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/23/stat	ps
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/563/stat	ps
File opened for reading	/proc/579/stat	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/29/cmdline	ps
File opened for reading	/proc/305/stat	ps
File opened for reading	/proc/318/status	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/318/cmdline	ps
File opened for reading	/proc/648/status	ps
File opened for reading	/proc/653/cmdline	ps
File opened for reading	/proc/748/stat	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/43/status	ps
File opened for reading	/proc/289/cmdline	ps
File opened for reading	/proc/309/stat	ps
File opened for reading	/proc/579/cmdline	ps
File opened for reading	/proc/748/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/24/status	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/109/cmdline	ps
File opened for reading	/proc/302/stat	ps
File opened for reading	/proc/653/stat	ps
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/41/stat	ps
File opened for reading	/proc/109/status	ps
File opened for reading	/proc/309/status	ps
File opened for reading	/proc/588/status	ps

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

System Network Configuration Discovery

pid	Process
653	connectionReport.sh
739	ip

/tmp/extension/dist/scripts/connectionReport.sh
/tmp/extension/dist/scripts/connectionReport.sh
1⤵
- System Network Configuration Discovery
PID:653
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%S.%3NZ"
  2⤵
  PID:658
- /usr/bin/head
  head -n 1
  2⤵
  PID:662
- /usr/bin/node
  node --version
  2⤵
  PID:661
- /usr/bin/head
  head -n 1
  2⤵
  PID:676
- /usr/bin/curl
  curl --version
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:675
- /usr/bin/head
  head -n 1
  2⤵
  PID:679
- /usr/bin/wget
  wget --version
  2⤵
  PID:678
- /usr/bin/head
  head -n 1
  2⤵
  PID:682
- /usr/bin/base64
  base64 --version
  2⤵
  PID:681
- /usr/bin/head
  head -n 1
  2⤵
  PID:685
- /bin/grep
  grep --version
  2⤵
  PID:684
- /usr/bin/env
  env
  2⤵
  PID:686
- /usr/bin/sort
  sort
  2⤵
  PID:688
- /bin/grep
  grep -qi KEY
  2⤵
  PID:690
- /bin/grep
  grep -qi KEY
  2⤵
  PID:692
- /bin/grep
  grep -qi KEY
  2⤵
  PID:694
- /bin/grep
  grep -qi KEY
  2⤵
  PID:696
- /bin/grep
  grep -qi KEY
  2⤵
  PID:698
- /bin/grep
  grep -qi KEY
  2⤵
  PID:700
- /bin/cat
  cat /etc/os-release
  2⤵
  PID:701
- /bin/uname
  uname -a
  2⤵
  PID:702
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%S.%3NZ"
  2⤵
  PID:704
- /usr/bin/curl
  curl -I --connect-timeout 10 --max-time 10 https://cursor.blob.core.windows.net/remote-releases/connectioncheck.txt
  2⤵
  - Checks CPU configuration
  PID:705
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%S.%3NZ"
  2⤵
  PID:736
- /bin/cat
  cat /etc/ssh/ssh_config
  2⤵
  PID:737
- /sbin/ip
  ip addr
  2⤵
  - System Network Configuration Discovery
  PID:739
- /bin/cat
  cat /etc/resolv.conf
  2⤵
  PID:743
- /usr/bin/id
  id
  2⤵
  PID:744
- /usr/bin/whoami
  whoami
  2⤵
  PID:747
- /bin/grep
  grep -i ssh
  2⤵
  PID:752
- /bin/ps
  ps aux
  2⤵
  - Reads CPU attributes
  - Process Discovery
  - Reads runtime system information
  PID:751
- /bin/date
  date -u "+%Y-%m-%dT%H:%M:%S.%3NZ"
  2⤵
  PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

System Checks

Credential Access

Discovery

Process Discovery

System Information Discovery

System Network Configuration Discovery

Virtualization/Sandbox Evasion

System Checks

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads