d3ad02c775a6b2a78974b242dd7742a3612cd8be6b58a977516053d9f9897a41

Analysis

max time kernel
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
21/07/2026, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.sh
Size 42KB
Sample260721-pltkmabm41
SHA256 d3ad02c775a6b2a78974b242dd7742a3612cd8be6b58a977516053d9f9897a41
MD5 e19a809b9d8b2ed4c6302eb8e830aee5
SHA1 64085d5e22951154210a59951cccb6850386ebf9
SHA512 ee7a2eb6a6af213b84e56bcec18f6e6f31fa74f75466447c4fcf0baca86abb9709f4220bb088b3a0abeec2afc1cd946ef5e92a585bcad5e615559bf4924707aa
SSDEEP 768:C35D63W3HGw72amWt7KpP978WHKaCTC9cPM8O250p7NlmGB:C5D63W3HGw72amD7lx9cPM8O2GoGB
TLSH
T1A713B74695E98E713E18463CBE879816324E191319BD7C60F1EEA4883F3A365F0B365F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	node

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	node

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	node

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/meminfo	node
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/fd	apt-cache
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg

Writes file to tmp directory 5 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/pi-installer-checks.650	install.sh
File opened for modification	/tmp/fileutl.message.0jGmie	apt-cache
File opened for modification	/tmp/fileutl.message.FWEVef	apt-cache
File opened for modification	/tmp/fileutl.message.6bxntl	apt-cache
File opened for modification	/tmp/fileutl.message.hDLvit	apt-cache

/tmp/install.sh
/tmp/install.sh
1⤵
- Writes file to tmp directory
PID:650
- /bin/sleep
  sleep 0.075
  2⤵
  PID:665
- /bin/sleep
  sleep 0.075
  2⤵
  PID:679
- /bin/sleep
  sleep 0.075
  2⤵
  PID:686
- /usr/bin/node
  node --version
  2⤵
  PID:658
- /bin/sleep
  sleep 0.075
  2⤵
  PID:689
- /bin/sleep
  sleep 0.075
  2⤵
  PID:693
- /usr/bin/node
  node -e "const [maj,min,patch] = process.versions.node.split(\".\").map(Number); process.exit(maj > 22 || (maj === 22 && (min > 19 || (min === 19 && patch >= 0))) ? 0 : 1)"
  2⤵
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:690
- /bin/sleep
  sleep 0.075
  2⤵
  PID:695
- /bin/sleep
  sleep 0.075
  2⤵
  PID:699
- /bin/sleep
  sleep 0.075
  2⤵
  PID:703
- /bin/sleep
  sleep 0.075
  2⤵
  PID:706
- /bin/sleep
  sleep 0.075
  2⤵
  PID:708
- /bin/sleep
  sleep 0.075
  2⤵
  PID:710
- /bin/sleep
  sleep 0.075
  2⤵
  PID:713
- /bin/sleep
  sleep 0.25
  2⤵
  PID:715
- /bin/sleep
  sleep 0.08
  2⤵
  PID:720
- /bin/sleep
  sleep 0.08
  2⤵
  PID:727
- /bin/sleep
  sleep 0.08
  2⤵
  PID:733
- /bin/sleep
  sleep 0.10
  2⤵
  PID:739
- /bin/sleep
  sleep 0.45
  2⤵
  PID:745
- /bin/sleep
  sleep 0.12
  2⤵
  PID:760
- /bin/sleep
  sleep 0.12
  2⤵
  PID:772
- /bin/sleep
  sleep 0.45
  2⤵
  PID:776
- /bin/rm
  rm -f /tmp/pi-installer-checks.650
  2⤵
  PID:777
- /bin/uname
  uname -s
  2⤵
  PID:779
- /usr/bin/awk
  awk "/Candidate:/ { print \$2; exit }"
  2⤵
  - Reads runtime system information
  PID:782
- /usr/bin/apt-cache
  apt-cache policy nodejs
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:781
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:783
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pi-installer-checks.650

Path /tmp/pi-installer-checks.650
Size 61B
SHA256 7a403b9584a5da04900d9cf7434105ae7ba5581ab7775c8bc014222f487d8d54
MD5 52cc46b814a52fa0211496aeddeb73a9
SHA1 c8e7a229ccc3ae5b627085e4f57a30fa3a9027cd
SHA512 dba03a4e3e3cd4bce6c46240149198b7bfff701b57e4ceeb2b57875350d6606ad08f0f1ac2d4f60d4dddbc36dcb1e1b5f6c1fdd198bebc88d1830317a0dc4639
TLSH
T1BEA0025586C2F69A659295B778134041F6A285107C10D100D03306E65062D1546CD03B
MD5 SHA1 SHA512 TLSH

Submit Download

pi-installer-checks.650

Path /tmp/pi-installer-checks.650
Size 62B
SHA256 8455ef1a388bf330a2192d222d97ab79920566e25e65cb23c81357eeb2dae94c
MD5 06a7046c8f009ed3b33de660ea9909a0
SHA1 5bb00a6aaded55924b420302152b6c6c54b00e09
SHA512 b299407071606ed2c5f8614fc047bed7832078eccc2400fa363c5de65e7f49676555343a3be9658c147ec6b1502a1571614a87a71eaf5873a13b25e8c89dfd5a
TLSH
T14CA0025586C2F69A659295B778134045F6A285107C10D100D03306E65062D1546CD03B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads