754eeba13b1609ac86c4f18805e20aff19dd0609bc8270deb95430700ad8eba3

Analysis

max time kernel
5s
max time network
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30/07/2026, 09:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
klyc-pmm/examples/quickstart.sh
Size 2KB
Sample260730-k8yewayvax
SHA256 754eeba13b1609ac86c4f18805e20aff19dd0609bc8270deb95430700ad8eba3
MD5 8c2c1f09839ab9bdb602023429a920e6
SHA1 658f837117fdc819a5e01955cf4661aff78f776d
SHA512 90d6a2fbd1fbe2d118713b5d77563c7d9f36cf2de4bdffe5bde11a9cd9eb38a19e0de8eec70df30484ff27fd5cc331e273cf2bbc77db45cc4a2d23d57d24d528
TLSH
T1C241B7BD78547932380111EC492292083647F21F45A458A7F7EBA41F3F60AED355D6B9
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 11 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	find

System Network Configuration Discovery 1 TTPs 13 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
711	bash
712	bash
714	bash
715	bash
722	curl
778	bash
709	dirname
710	bash
713	bash
716	bash
719	grep
677	grep
686	bash

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.U9k1ur	bash

/tmp/klyc-pmm/examples/quickstart.sh
/tmp/klyc-pmm/examples/quickstart.sh
1⤵
PID:657
- /usr/bin/dirname
  dirname /tmp/klyc-pmm/examples/quickstart.sh
  2⤵
  PID:668
- /usr/bin/tr
  tr -d "\""
  2⤵
  PID:681
- /bin/grep
  grep "readonly VERSION" /tmp/klyc-pmm/scripts/pmm_watch.sh
  2⤵
  - System Network Configuration Discovery
  PID:677
- /usr/bin/head
  head -1
  2⤵
  PID:678
- /bin/grep
  grep -oP "\"([^\"]+)\""
  2⤵
  PID:679
- /bin/bash
  bash /tmp/klyc-pmm/scripts/pmm_watch.sh self-test
  2⤵
  - System Network Configuration Discovery
  PID:686
- - /usr/bin/cut
    cut -d: -f6
    3⤵
    PID:691
- - /usr/bin/id
    id -un
    3⤵
    - Reads runtime system information
    PID:695
- - /usr/bin/getent
    getent passwd root
    3⤵
    PID:690
- - /bin/mkdir
    mkdir -p /root/.klyc-pmm
    3⤵
    - Reads runtime system information
    PID:697
- - /bin/grep
    grep -oP "\\d+\\.\\d+"
    3⤵
    PID:701
- - /usr/bin/head
    head -1
    3⤵
    PID:700
- - /bin/bash
    bash --version
    3⤵
    PID:699
- - /usr/bin/head
    head -1
    3⤵
    PID:705
- - /usr/bin/curl
    curl --version
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:704
- - /bin/grep
    grep -oP "\\d+\\.\\d+"
    3⤵
    PID:706
- - /usr/bin/dirname
    dirname /tmp/klyc-pmm/scripts/pmm_watch.sh
    3⤵
    - System Network Configuration Discovery
    PID:709
- - /bin/bash
    bash -n /tmp/klyc-pmm/scripts/pmm_watch.sh
    3⤵
    - System Network Configuration Discovery
    PID:710
- - /bin/bash
    bash -n /tmp/klyc-pmm/scripts/pmm_boot.sh
    3⤵
    - System Network Configuration Discovery
    PID:711
- - /bin/bash
    bash -n /tmp/klyc-pmm/scripts/pmm_recover.sh
    3⤵
    - System Network Configuration Discovery
    PID:712
- - /bin/bash
    bash -n /tmp/klyc-pmm/scripts/pmm_distill.sh
    3⤵
    - System Network Configuration Discovery
    PID:713
- - /bin/bash
    bash -n /tmp/klyc-pmm/scripts/pmm_backup_files.sh
    3⤵
    - System Network Configuration Discovery
    PID:714
- - /bin/bash
    bash -n /tmp/klyc-pmm/scripts/update.sh
    3⤵
    - System Network Configuration Discovery
    PID:715
- - /bin/bash
    bash -n /tmp/klyc-pmm/scripts/oneclick.sh
    3⤵
    - System Network Configuration Discovery
    PID:716
- - /bin/bash
    bash -n /tmp/klyc-pmm/scripts/install-daemon.sh
    3⤵
    PID:717
- - /usr/bin/head
    head -1
    3⤵
    PID:720
- - /usr/bin/awk
    awk "-F\"" "{print \$2}"
    3⤵
    - Reads runtime system information
    PID:721
- - /bin/grep
    grep "readonly VERSION" /tmp/klyc-pmm/scripts/pmm_watch.sh
    3⤵
    - System Network Configuration Discovery
    PID:719
- - /bin/grep
    grep -qE "^[23]"
    3⤵
    PID:723
- - /usr/bin/curl
    curl -sS --ssl-reqd --connect-timeout 5 --max-time 5 -o /dev/null -w "%{http_code}" "https://kunlunyaochi.com/?route=status"
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    - System Network Configuration Discovery
    PID:722
- - /usr/bin/head
    head -1
    3⤵
    PID:775
- - /usr/bin/find
    find /root -maxdepth 4 -name MEMORY.md -type f
    3⤵
    - Reads runtime system information
    PID:774
- /bin/sed
  sed "s/^/ /"
  2⤵
  - Reads runtime system information
  PID:687
- /bin/grep
  grep -q 退出码
  2⤵
  PID:779
- /bin/bash
  bash /tmp/klyc-pmm/scripts/pmm_watch.sh --help
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:778
- - /usr/bin/cut
    cut -d: -f6
    3⤵
    PID:784
- - /usr/bin/id
    id -un
    3⤵
    - Reads runtime system information
    PID:786
- - /usr/bin/getent
    getent passwd root
    3⤵
    PID:783
- - /bin/mkdir
    mkdir -p /root/.klyc-pmm
    3⤵
    - Reads runtime system information
    PID:789
- - /bin/cat
    cat
    3⤵
    PID:793

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.U9k1ur

Path /tmp/sh-thd.U9k1ur
Size 2KB
SHA256 526ae7cbaba2993982470b9adbb0c44e64efc13dad92eb92f44e661c77f75d6c
MD5 e2aac3d89dbb5b514d9f814193fd5eec
SHA1 24048937c1f41a1fa9b30b47b95b6a2afbdf116a
SHA512 180101605b06f1736a2ef7789f7a7e18c4d3088f0a21b99c13ab478a4b1320b2deb7554c20a288c55fe5ae93fc226552e66125961404232fd6937165edb174d8
TLSH
T1BF41626D957B7B40DA77CDA0EAF495691318A09DC0C6D807B4EFA2880FA89C9CC54815
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads