e765fb43b12b49a516524054ed1c9caac6acfbde4225781dd9f559e1cc2f2cbe

Analysis

max time kernel
16s
max time network
11s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/08/2026, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
uv-installer.sh
Size 64KB
Sample260807-wy26vsaq21
SHA256 e765fb43b12b49a516524054ed1c9caac6acfbde4225781dd9f559e1cc2f2cbe
MD5 90716bcd43bc8e565b3dbb0cc3d7a72c
SHA1 da3cc534260ba53827f4ca6bf743606da37dcc74
SHA512 3bc81d2173f159a4217f80a63b9e2843155861250d1a2ab7dea096a0e088dd86bdbe897cff97733f1a576fe038b329a216459602e10682a7ed3cb4a07ff2135b
SSDEEP 768:tmAlWLwl5LaqnoPGklUs61k165Sdipb+ytHHifyHEMvv6kgvst3OZ:swTZdk167xhXC
TLSH
T1B753D9027A0189F62B6845F80F9B5552D304425F4A503C3CF79EBB186F21AAB53F6BDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
814	chmod
817	chmod

Creates/modifies environment variables 1 TTPs 2 IoCs

Creating/modifying environment variables is a common persistence mechanism.

persistence privilege_escalation defense_evasion

Path Interception by PATH Environment Variable

T1574.007

description	ioc	Process
File opened for modification	/root/.profile	uv-installer.sh
File opened for modification	/root/.bashrc	uv-installer.sh

Write file to user bin folder 2 IoCs

persistence

description	ioc	Process
File opened for modification	/root/.local/bin/env	uv-installer.sh
File opened for modification	/root/.local/bin/env.fish	uv-installer.sh

Modifies Bash startup script 2 TTPs 2 IoCs

persistence

Boot or Logon Autostart Execution

T1547

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.profile	uv-installer.sh
File opened for modification	/root/.bashrc	uv-installer.sh

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/self/exe	head
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
769	tar

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.iGqZvo83mK/input.tar.gz	curl
File opened for modification	/tmp/tmp.iGqZvo83mK/uvx	tar
File opened for modification	/tmp/tmp.iGqZvo83mK/uv	tar

/tmp/uv-installer.sh
/tmp/uv-installer.sh
1⤵
- Creates/modifies environment variables
- Write file to user bin folder
- Modifies Bash startup script
PID:642
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:647
- /usr/bin/id
  id -un
  2⤵
  - Reads runtime system information
  PID:648
- /usr/bin/getent
  getent passwd root
  2⤵
  PID:645
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:657
- /usr/bin/id
  id -un
  2⤵
  - Reads runtime system information
  PID:658
- /usr/bin/getent
  getent passwd root
  2⤵
  PID:656
- /bin/grep
  grep /snap/
  2⤵
  PID:670
- /bin/uname
  uname -s
  2⤵
  PID:673
- /bin/uname
  uname -m
  2⤵
  PID:674
- /bin/uname
  uname -o
  2⤵
  PID:676
- /bin/grep
  grep -q musl
  2⤵
  PID:679
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:678
- /usr/bin/head
  head -c 5 /proc/self/exe
  2⤵
  - Reads runtime system information
  PID:685
- /bin/grep
  grep -E -q "neon|simd"
  2⤵
  PID:689
- /bin/grep
  grep "^Features" /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:690
- /usr/bin/ldd
  ldd --version
  2⤵
  PID:694
- /usr/bin/awk
  awk "-F " "{ if (FNR<=1) print \$NF }"
  2⤵
  - Reads runtime system information
  PID:695
- /usr/bin/awk
  awk -F. "{ print \$1 }"
  2⤵
  - Reads runtime system information
  PID:698
- /usr/bin/awk
  awk -F. "{ print \$2 }"
  2⤵
  - Reads runtime system information
  PID:701
- /bin/sed
  sed "s/\"CARGO_DIST_BINS\"/\"uv\",\"uvx\"/"
  2⤵
  - Reads runtime system information
  PID:705
- /bin/sed
  sed "s/\"CARGO_DIST_DYLIBS\"//"
  2⤵
  - Reads runtime system information
  PID:708
- /bin/sed
  sed "s/\"CARGO_DIST_STATICLIBS\"//"
  2⤵
  - Reads runtime system information
  PID:711
- /bin/mktemp
  mktemp -d
  2⤵
  PID:713
- /bin/mkdir
  mkdir -p /tmp/tmp.iGqZvo83mK
  2⤵
  - Reads runtime system information
  PID:714
- /bin/grep
  grep /snap/
  2⤵
  PID:717
- /usr/bin/curl
  curl -sSfL https://github.com/astral-sh/uv/releases/download/0.8.13/uv-armv7-unknown-linux-gnueabihf.tar.gz -o /tmp/tmp.iGqZvo83mK/input.tar.gz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - Writes file to tmp directory
  PID:718
- /bin/tar
  tar xf /tmp/tmp.iGqZvo83mK/input.tar.gz --strip-components 1 -C /tmp/tmp.iGqZvo83mK
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:769
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:770
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:770
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:770
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:770
- - /sbin/gzip
    gzip -d
    3⤵
    PID:770
- - /bin/gzip
    gzip -d
    3⤵
    PID:770
- /bin/sed
  sed "s,AXO_INSTALL_PREFIX,/root/.local/bin,"
  2⤵
  - Reads runtime system information
  PID:803
- /bin/sed
  sed "s'\"binary_aliases\":{}'\"binary_aliases\":{}'"
  2⤵
  - Reads runtime system information
  PID:806
- /bin/sed
  sed "s'\"install_layout\":\"unspecified\"'\"install_layout\":\"flat\"'"
  2⤵
  - Reads runtime system information
  PID:810
- /bin/mkdir
  mkdir -p /root/.local/bin
  2⤵
  - Reads runtime system information
  PID:811
- /bin/mkdir
  mkdir -p /root/.local/bin
  2⤵
  - Reads runtime system information
  PID:812
- /bin/mv
  mv /tmp/tmp.iGqZvo83mK/uv /root/.local/bin
  2⤵
  - Reads runtime system information
  PID:813
- /bin/chmod
  chmod +x /root/.local/bin/uv
  2⤵
  - File and Directory Permissions Modification
  PID:814
- /bin/mv
  mv /tmp/tmp.iGqZvo83mK/uvx /root/.local/bin
  2⤵
  - Reads runtime system information
  PID:816
- /bin/chmod
  chmod +x /root/.local/bin/uvx
  2⤵
  - File and Directory Permissions Modification
  PID:817
- /bin/cat
  cat
  2⤵
  PID:820
- /bin/grep
  grep -F ". \"/root/.local/bin/env\"" /root/.profile
  2⤵
  PID:821
- /bin/grep
  grep -F "source \"/root/.local/bin/env\"" /root/.profile
  2⤵
  PID:822
- /bin/grep
  grep -F ". \"/root/.local/bin/env\"" /root/.profile
  2⤵
  PID:825
- /bin/grep
  grep -F ". \"/root/.local/bin/env\"" /root/.bashrc
  2⤵
  PID:828
- /bin/grep
  grep -F "source \"/root/.local/bin/env\"" /root/.bashrc
  2⤵
  PID:829
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  - Reads runtime system information
  PID:836
- /bin/grep
  grep -F ". \"/root/.local/bin/env\"" /root/.zshrc
  2⤵
  PID:838
- /bin/grep
  grep -F "source \"/root/.local/bin/env\"" /root/.zshrc
  2⤵
  PID:839
- /bin/mkdir
  mkdir -p /root/.config/fish/conf.d
  2⤵
  - Reads runtime system information
  PID:840
- /usr/bin/awk
  awk "{ print \$1 }"
  2⤵
  - Reads runtime system information
  PID:844
- /bin/cat
  cat
  2⤵
  PID:846
- /bin/grep
  grep -F ". \"/root/.local/bin/env.fish\"" /root/.config/fish/conf.d/uv.env.fish
  2⤵
  PID:847
- /bin/grep
  grep -F "source \"/root/.local/bin/env.fish\"" /root/.config/fish/conf.d/uv.env.fish
  2⤵
  PID:848
- /bin/rm
  rm -rf /tmp/tmp.iGqZvo83mK
  2⤵
  PID:852
- /bin/mkdir
  mkdir -p /root/.config/uv
  2⤵
  - Reads runtime system information
  PID:853

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

T1574.007

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uv.env.fish

Path /root/.config/fish/conf.d/uv.env.fish
Size 36B
SHA256 cb1a75a48d194bcacf766823bc35d65ca86430ad5dcd62e81d74caafbda19457
MD5 58f42446e9eb027e6009587352c27875
SHA1 ec859e53af00cebdde03167a705f4783b5f21029
SHA512 4059d3c57119b53c19a861ac3eb68922b63bb9ef762cc54d82ba3c574c408f0d8e73bd9b7e72e395b372dea376164c7cfb2bb88d801752f01727ff9907ffc093
MD5 SHA1 SHA512

Submit Download

uv-receipt.json

Path /root/.config/uv/uv-receipt.json
Size 311B
SHA256 62cb87129214541d64b76ef98a05181668335e6de72741fc723764abbf17131e
MD5 915ac101e17056d86a864db31cd64e5b
SHA1 bb8779153bad55dacb33b6a0a81e791c95184a8e
SHA512 d640d52e79d3cad083b4a2f12ffc22520b521e49269868e3d75c28f820606a7ba28441410f1295e6f4dcfb47ebac09f045172f3f1f03aed83c485faea109029f
TLSH
T123E072088024F8B349014F882D833E8786AC4076DEE0880EC6BB0EA48F372AE121180E
MD5 SHA1 SHA512 TLSH

Submit Download

env

Path /root/.local/bin/env
Size 328B
SHA256 6d440ed04591b8dc4247548a7d8b6d4f66e1815834be66f108c5d173a114bbe5
MD5 6e92ccdeff77cef7ae82ec1aedcbfeba
SHA1 bac6b9d9cf5a7e18b5264debae28091c8a857f31
SHA512 f51d1af84598e2341b5a39a4a50da7565378f685257cc8ef14c47711ee00e7a5367b42b06de28b384c31618465432df1f76ea8aac47b744f0dd1506e059b7044
TLSH
T11FE07D6023630711D8E902EE8B0330325102C02B4D4144273A5D97ADDF0073832B71FC
MD5 SHA1 SHA512 TLSH

Submit Download

.zshrc

Path /root/.zshrc
Size 26B
SHA256 34437085d4e196cdf91869da6d8623b7403cb5d3a71a5d268fc67e1262b95896
MD5 5a4cddb258b19d06abf471338ed71165
SHA1 c3164d766b739e2981df9bf5b009abf61db75f71
SHA512 755fc83d1bccfbe02f3b4615bfd1056a3d37e23dd45f225b69cf66130a7ffbf81d1724d7c2a1742c5d14e58d7d68dbcfec26c9ce4a7a9facd252382925a080eb
MD5 SHA1 SHA512

Submit Download

.zshrc

Path /root/.zshrc
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

input.tar.gz

Path /tmp/tmp.iGqZvo83mK/input.tar.gz
Size 17.5MB
SHA256 730d8ef57f221ecc572d47b227ecbd8261be08157efb351311f7bc1f6c1c944a
MD5 87517e83303792a27d5ff49537ebd4b8
SHA1 ba6130a10b8e2d3a2770593946d5554fd1e8de4f
SHA512 eab2d765e146ae65440fc5b7feea18c6f0b41ab018a021aaac7a4b4c7899fbc1a210b6bf665bfecdf93f889849ba3d726009ebf0f8108b652571b23bed11bd06
SSDEEP 393216:CHEZSQddTXt7q3yQCaoNPl0xh9BIdBpX9Mea9JgYDAaCaUuWQlRR17FvCnO8+cSk:CHEjHTd74waoNN0tm49iYjdWyn5F8sS
TLSH
T1C3073384427DEABD953FF5AF8F211C4A3A6DE9A9BC8385E419675F06310714007BACBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /tmp/tmp.iGqZvo83mK/uv
Size 37.6MB
SHA256 b319128542d730334ab5eba0be9977c6791164f1710cadd7a8f3dc964d55ee64
MD5 4a4c039859c0381eef2ae200de84aeaa
SHA1 71415a68fe628f7913e2a158e5b7574300eae6f7
SHA512 2ccfaf4164a1cf612fec692c5507620246350c62acd4750ddd52010ce676107492cda19df6972e8102f00ddfdce35efa3f4c7dc7bce2e784307aba0967f19d51
SSDEEP 196608:tmZd5gg40V+Onw/fWDdLBMHwKGtISxFapy/hxERAziXBc20mAbHZaoQS0JbthFT+:tmxeOCoCSTt/h3zR0jhfjdgTDidzUF
TLSH
T1FE875C7FB542A952C8D466FAF87EC188334743F8C3DA7017AA01C7692EDF8590E39A54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uvx

Path /tmp/tmp.iGqZvo83mK/uvx
Size 326KB
SHA256 9e19e4217be08f19dd50aadd655dce2b5628ca77986eff44b92ce65942dd55c8
MD5 3f38841004b5019cc848f7bdc0ecd07c
SHA1 f43c4f779ad7da9f821eaa1bea1db0734fdae0f1
SHA512 63159cad21478e2dd106229fb86faabb12a963ca6cbd4e190a71c5231ef4f1f970fd6f0cc011fb62aef074acb8afc19e39bf19abb9f9d9fc668011aa93ae5f13
SSDEEP 6144:shui+i0DAn+M/rZQcDfN4sqBbvwBzSguWTVrwAPHpRVnSjuoD/+oX2:rE+ID14/wB+glVrwAPJHolD+om
TLSH
T1C264299AB942C992C4D425BAF66EC2DC334753BDC3DA311A9E11CA347ACF98D0D39B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads