6c30b75a75b28a96fd913a037c8581b580080b6ee9b8169a3c0feb1af7fe8caf

Analysis

max time kernel
8s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
20/07/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rustup-init.sh
Size 28KB
Sample260720-w151jacz31
SHA256 6c30b75a75b28a96fd913a037c8581b580080b6ee9b8169a3c0feb1af7fe8caf
MD5 f5b23855b2cbe6b44a3f82433e979992
SHA1 f8acbf60ac32fcd84ce45e7555a4411b0d9dcbea
SHA512 cd9fd64eabc989f19a6a16e9cd2caabe935082e2715b9308150f86d3839c99eb9a7e42a7ef6730c6d956d870638ee89a04dd9e7e14fe243cc165967b7f2918da
SSDEEP 768:cVNy65kdiab+ltqwuqvw2g5G41HAz7vyoahx:cS6c0Ygjab
TLSH
T11AD2F913698113741A10D5E98ED76027A70D820786647D1C7E8CF368BF4693D93FABEE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
773	chmod

Checks CPU configuration 1 TTPs 11 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 22 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/exe	head
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
722	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.t33BrBloGc/rustup-init	curl

/tmp/rustup-init.sh
/tmp/rustup-init.sh
1⤵
PID:657
- /bin/grep
  grep /snap/
  2⤵
  PID:662
- /bin/uname
  uname -s
  2⤵
  PID:666
- /bin/uname
  uname -m
  2⤵
  PID:669
- /bin/uname
  uname -o
  2⤵
  PID:671
- /bin/grep
  grep -q musl
  2⤵
  PID:675
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:674
- /usr/bin/head
  head -c 5 /proc/self/exe
  2⤵
  - Reads runtime system information
  PID:688
- /bin/grep
  grep -E -q "neon|simd"
  2⤵
  PID:693
- /bin/grep
  grep "^Features" /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:695
- /bin/mktemp
  mktemp -d
  2⤵
  PID:697
- /bin/mkdir
  mkdir -p /tmp/tmp.t33BrBloGc
  2⤵
  - Reads runtime system information
  PID:699
- /bin/grep
  grep /snap/
  2⤵
  PID:704
- /bin/grep
  grep -q "\"--help all\""
  2⤵
  PID:706
- /usr/bin/curl
  curl --help
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:705
- /bin/grep
  grep -q -- --retry
  2⤵
  PID:709
- /usr/bin/curl
  curl --help
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:708
- /bin/grep
  grep -q "\"--help all\""
  2⤵
  PID:712
- /usr/bin/curl
  curl --help
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:711
- /usr/bin/curl
  curl --help
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:713
- /bin/grep
  grep -q -- --continue-at
  2⤵
  PID:714
- /bin/grep
  grep -q " OpenSSL/"
  2⤵
  PID:716
- /usr/bin/curl
  curl -V
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:715
- /bin/grep
  grep -q "\"--help all\""
  2⤵
  PID:718
- /usr/bin/curl
  curl --help
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:717
- /bin/grep
  grep -q -- --tlsv1.2
  2⤵
  PID:720
- /usr/bin/curl
  curl --help
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:719
- /bin/grep
  grep -q -- --ciphers
  2⤵
  - System Network Configuration Discovery
  PID:722
- /usr/bin/curl
  curl --help
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:721
- /bin/grep
  grep -q -- --proto
  2⤵
  PID:724
- /usr/bin/curl
  curl --help
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:723
- /usr/bin/curl
  curl --retry 3 -C - --proto "=https" --tlsv1.2 --ciphers TLS_AES_128_GCM_SHA256:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_256_GCM_SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384 --silent --show-error --fail --location https://static.rust-lang.org/rustup/dist/armv7-unknown-linux-gnueabihf/rustup-init --output /tmp/tmp.t33BrBloGc/rustup-init
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:726
- /bin/chmod
  chmod u+x /tmp/tmp.t33BrBloGc/rustup-init
  2⤵
  - File and Directory Permissions Modification
  PID:773
- /bin/rm
  rm /tmp/tmp.t33BrBloGc/rustup-init
  2⤵
  PID:774
- /bin/rmdir
  rmdir /tmp/tmp.t33BrBloGc
  2⤵
  PID:775

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rustup-init

Path /tmp/tmp.t33BrBloGc/rustup-init
Size 14.3MB
SHA256 124e02253af9128f9e27ea1ac929cbb73cf44cf35469d0f594a1b62f7b71fea1
MD5 6c66f99d772fc8522706535cc66195b1
SHA1 80b9a0d933047c3dcb82edd59333cd443da4cd18
SHA512 915d774b42f842615efe1482b4782d840a2ade3e402c8fb91ed9491a6f04602cc19672ecf0d8a5485a1795c3c70ec2428405d5e17bd936e1637e8a5982f664ec
SSDEEP 196608:Uf6KfAQ507vRSapoPvG26Q9iy3/12au2z0RF4T/XoqjS:uA8gvRSapoPn6Q9xga78F4T/XoqjS
TLSH
T1DEE67D97B841A6A2CDD81FB9F8BD819833E382F8C3D660179B0587781BCF619CE39554
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads