Analysis
- max time kernel
1s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
18/08/2026, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-mipsbe-20260513-en
debian-9-mips
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
4 signatures
150 seconds
General
- Target 93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
- Size 1KB
- Sample260818-epekrsdr3w
- SHA256 93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
- MD5 94b2ed5fd20ce8398e62756e2b8c6303
- SHA1 6cd683aae5096741660d8617421b029c8290a8bf
- SHA512 4cde6f82fe0f078ebaad8da56cf7066db2b1254c7740b67c7b4909c3b8f210f153834f087954be6ef6eb32be4724e6cb9a2901c6e635c7f2a8c11341ee695f53
- TLSH T14B21D0C5F8A8DEB1BDB8717A806A120115DB695F1477B13110F2C8641B0C59DD5BEB33
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/fs/kdbus/0-system/bus systemctl File opened for reading /sys/fs/kdbus/0-system/bus systemctl -
description ioc Process File opened for reading /proc/43/status pgrep File opened for reading /proc/640/stat ss File opened for reading /proc/13/fd ss File opened for reading /proc/19/attr/current ss File opened for reading /proc/638/stat ss File opened for reading /proc/683/fd ss File opened for reading /proc/23/fd ss File opened for reading /proc/328/fd ss File opened for reading /proc/570/fd ss File opened for reading /proc/1/fd ss File opened for reading /proc/288/attr/current ss File opened for reading /proc/2/fd ss File opened for reading /proc/585/stat ss File opened for reading /proc/102/attr/current ss File opened for reading /proc/20/fd ss File opened for reading /proc/318/stat ss File opened for reading /proc/638/cmdline pgrep File opened for reading /proc/646/cmdline pgrep File opened for reading /proc/296/stat ss File opened for reading /proc/635/stat ss File opened for reading /proc/660/cmdline pgrep File opened for reading /proc/680/status pgrep File opened for reading /proc/25/status pgrep File opened for reading /proc/1/attr/current ss File opened for reading /proc/13/attr/current ss File opened for reading /proc/646/attr/current ss File opened for reading /proc/650/stat ss File opened for reading /proc/301/fd ss File opened for reading /proc/585/stat ss File opened for reading /proc/635/fd ss File opened for reading /proc/297/status pgrep File opened for reading /proc/42/fd ss File opened for reading /proc/111/fd ss File opened for reading /proc/1/attr/current ss File opened for reading /proc/21/attr/current ss File opened for reading /proc/80/fd ss File opened for reading /proc/43/attr/current ss File opened for reading /proc/172/attr/current ss File opened for reading /proc/cmdline systemctl File opened for reading /proc/296/cmdline pgrep File opened for reading /proc/16/fd ss File opened for reading /proc/326/fd ss File opened for reading /proc/645/attr/current ss File opened for reading /proc/9/cmdline pgrep File opened for reading /proc/6/attr/current ss File opened for reading /proc/17/fd ss File opened for reading /proc/18/attr/current ss File opened for reading /proc/588/stat ss File opened for reading /proc/196/fd ss File opened for reading /proc/18/attr/current ss File opened for reading /proc/158/status pgrep File opened for reading /proc/585/cmdline pgrep File opened for reading /proc/25/attr/current ss File opened for reading /proc/296/attr/current ss File opened for reading /proc/5/cmdline pgrep File opened for reading /proc/41/status pgrep File opened for reading /proc/287/cmdline pgrep File opened for reading /proc/301/cmdline pgrep File opened for reading /proc/27/fd ss File opened for reading /proc/570/fd ss File opened for reading /proc/4/attr/current ss File opened for reading /proc/80/attr/current ss File opened for reading /proc/326/stat ss File opened for reading /proc/644/attr/current ss
Processes
-
/tmp/93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b/tmp/93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b1⤵PID:647
-
/bin/grepgrep -q :4432⤵PID:654
-
-
/bin/ssss -tlnp2⤵
- Reads runtime system information
PID:653
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"2⤵PID:674
-
-
/bin/systemctlsystemctl start cnc.service2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:677
-
-
/bin/ssss -tlnp2⤵
- Reads runtime system information
PID:683
-
-
/bin/grepgrep -q :802⤵PID:684
-
-
/usr/bin/pgreppgrep -f auto_pwner_v142⤵
- Reads CPU attributes
- Reads runtime system information
PID:686
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"2⤵PID:688
-
-
/bin/systemctlsystemctl start botpwner.service2⤵
- Enumerates kernel/hardware configuration
PID:690
-