f0e0723e1f32656b762cf3771226294542df62456e9cda688d23db3cc4e74032

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
24/07/2026, 08:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sources/usr/bin/droidian-perf.sh
Size 2KB
Sample260724-j1fdnavfre
SHA256 f0e0723e1f32656b762cf3771226294542df62456e9cda688d23db3cc4e74032
MD5 d867d92314170cab6c5d10a868d5b062
SHA1 70983ae06b43ae28f3f851ad889da99888348eba
SHA512 1b3dc3ac553bac5882fff27aa623172ae8d9b601fceee9ef19c3355b4a01d0dc764570f86e02e6e5a3f183d5350fa4fe97587ef44fc33b0e0c8164d61b2578c5
TLSH
T1E941C0E2963787212A8D7561694ED82198B0D8CBF7D43464BF9F15906F0AA08C7F4E37
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	awk
File opened for reading	/proc/cpuinfo	awk

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/scaling_available_frequencies	cat
File opened for reading	/sys/devices/system/cpu/cpu0/cpufreq/scaling_governor	droidian-perf.sh

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mount

/tmp/sources/usr/bin/droidian-perf.sh
/tmp/sources/usr/bin/droidian-perf.sh
1⤵
- Reads CPU attributes
PID:652
- /usr/bin/awk
  awk "\$1 == \"processor\" {print \$3; exit}" /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:660
- /usr/bin/awk
  awk "\$1 == \"processor\" {print \$3}" /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:674
- /usr/bin/tail
  tail -1
  2⤵
  PID:675
- /usr/bin/awk
  awk "{print \$NF}"
  2⤵
  - Reads runtime system information
  PID:682
- /bin/cat
  cat /sys/devices/system/cpu/cpu0/cpufreq/scaling_available_frequencies
  2⤵
  - Reads CPU attributes
  PID:681
- /bin/mkdir
  mkdir -p /sys/fs/cgroup/schedtune
  2⤵
  - Reads runtime system information
  PID:685
- /bin/mount
  mount -t cgroup -o schedtune stune /sys/fs/cgroup/schedtune
  2⤵
  - Reads runtime system information
  PID:686

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads