284054591fdb903fcbf594d0aabb2a1041b92a54106dd3f960324c7c24360da6

Analysis

max time kernel
10s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
04/08/2026, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
armcameradriver.sh
Size 20.6MB
Sample260804-y3a92sdp4w
SHA256 284054591fdb903fcbf594d0aabb2a1041b92a54106dd3f960324c7c24360da6
MD5 ab3abce4f8274e3d2a678f5510c837a0
SHA1 146d13515ce25e3aa88e2d63625a60db9b51eabf
SHA512 601f79a2a07d4236b944c021f2d3f9d811fa0dc52f7de76a7f7f1224436ae4108e5583643c92a0781d7a139be2782be5589ef13772977afc42cfce4d41d4a462
SSDEEP 49152:MdWsOrv9igTpfiXqBjfBtRNNpJCC/uap436w3R/tkQV45gIUR+09vaD16VyNWpXE:J
TLSH
T15E27C0B39363BEAA2FA60C81814939516C4C6CA72330C094FFCC759B58AD574BD7E8B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
719	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/var/tmp/camapp	738	armcameradriver.sh

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd/0	open

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/camupdate	armcameradriver.sh

/tmp/armcameradriver.sh
/tmp/armcameradriver.sh
1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:655
- /bin/rm
  rm /root/Library/LaunchAgents/com.camdriver.update.plist
  2⤵
  PID:660
- /bin/sed
  sed -n 29p /tmp/armcameradriver.sh
  2⤵
  - Reads runtime system information
  PID:664
- /usr/bin/base64
  base64 --decode
  2⤵
  PID:665
- /bin/chmod
  chmod +x /var/tmp/camapp
  2⤵
  - File and Directory Permissions Modification
  PID:719
- /bin/sed
  sed -n 27p /tmp/armcameradriver.sh
  2⤵
  - Reads runtime system information
  PID:721
- /usr/bin/base64
  base64 --decode
  2⤵
  PID:722
- /bin/open
  open CamDriverUpdate.app
  2⤵
  - Reads runtime system information
  PID:736
- /var/tmp/camapp
  /var/tmp/camapp
  2⤵
  PID:738

/usr/local/sbin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:737

/usr/local/bin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:737

/usr/sbin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:737

/usr/bin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:737

/sbin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:737

/bin/CamDriverUpdate.app
CamDriverUpdate.app
1⤵
PID:737

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

camupdate

Path /tmp/camupdate
Size 1.3MB
SHA256 69f8d14bff8e8eb4eadcf2fa6920554eadda37d39c700a424c7a55ba69a3fe23
MD5 167f54aeade8b981946ed608042cff6a
SHA1 7b8e26a9a520f5c90c8c90cf45bcd233f276eb8d
SHA512 190f91c37c0a6017b37d7b7e795f0dcd9fe195527d0a5bdba17ee22ff900c060115ebb8304a66c403655301d51f4503865ca3945278fd9e88c5bf24fcb29abef
SSDEEP 24576:isEHBxU6SKelzGLYlxHWYBnsqMna6R0VUR7yDxQKN6YpfAhXx520YJ9Pa:isEhxFfclxHWMbqc6mtH6qYB52h6
TLSH
T17E5533E16C2878BD146D68F5E138265ABC67F212A79BE7CB0239A5493FD4C80C87C14F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

camapp

Path /var/tmp/camapp
Size 14.2MB
SHA256 70b56fa0ee9fa30fb42bdb1dc931f1ca867a4b8da07370b1d6f3f555c8a84cb4
MD5 c69a900680f0da5371fa6e265bcc48b0
SHA1 4dc9e03bc95db104859c02229e54752072aac203
SHA512 943badbcd21afc49713459ad864a64ddb1acae4a3ba0d865b10c8a83132eabf75b34fa5305bfa03bc01cd9d1af78f5e344e9f25b98f3d7f96d59c457572b530f
SSDEEP 196608:nadLDeOZiNiwQTFL3ww8QVXfFI4vVEMBVefODxVqD:n0DpENiwQpcBCzETmi
TLSH
T1A8E6AE85BC3D7922E6C661B36F264384313DBC845F82CB166714FB3D9DB27548B22B62
MD5 SHA1 SHA512 SSDEEP TLSH