98f8f885d56af980363c650c8451946bed9e4e41dc967c8bbb2178f00433ffda

Analysis

max time kernel
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/09/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_98f8f885d56af980363c650c8451946bed9e4e41dc967c8bbb2178f00433ffda.bin
Size 1KB
Sample260910-aramdacj7z
SHA256 98f8f885d56af980363c650c8451946bed9e4e41dc967c8bbb2178f00433ffda
MD5 bb33469dbb235b772d49eee269fa438e
SHA1 aabd273ec096989f872a6b971b2574bd417a003e
SHA512 79dbf5da05f9a34669266a3824106f008db0476c573b9f0045ebedd9e0dce0e98685bbc3c9b085f50f037a8394531f7dbb29d92b8857996fcaf2c74e9ca71ead
TLSH
T155418BA658D3B9B838D9A99CB263821815C0F65C18FB0B8CBD4C6D36F355448F2393EC
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 23 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/41/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/105/status	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/630/status	pkill
File opened for reading	/proc/168/cmdline	pkill
File opened for reading	/proc/579/status	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/586/cmdline	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/639/status	pkill
File opened for reading	/proc/289/status	pkill
File opened for reading	/proc/105/status	pkill
File opened for reading	/proc/288/status	pkill
File opened for reading	/proc/300/status	pkill
File opened for reading	/proc/29/status	pkill
File opened for reading	/proc/145/cmdline	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/304/cmdline	pkill
File opened for reading	/proc/579/status	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/98/status	pkill
File opened for reading	/proc/155/cmdline	pkill
File opened for reading	/proc/586/cmdline	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/135/cmdline	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/288/status	pkill
File opened for reading	/proc/323/status	pkill
File opened for reading	/proc/564/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/300/cmdline	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/588/status	pkill
File opened for reading	/proc/226/status	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/107/status	pkill
File opened for reading	/proc/646/cmdline	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/135/status	pkill
File opened for reading	/proc/684/cmdline	pkill
File opened for reading	/proc/639/status	pkill
File opened for reading	/proc/134/cmdline	pkill
File opened for reading	/proc/564/cmdline	pkill
File opened for reading	/proc/145/status	pkill
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/290/cmdline	pkill
File opened for reading	/proc/8/status	pkill

/tmp/jaffacakes118_98f8f885d56af980363c650c8451946bed9e4e41dc967c8bbb2178f00433ffda.bin
/tmp/jaffacakes118_98f8f885d56af980363c650c8451946bed9e4e41dc967c8bbb2178f00433ffda.bin
1⤵
PID:642
- /usr/bin/pkill
  pkill -f monitorx
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:644
- /bin/rm
  rm -rf /tmp/cbee9376_monitorx
  2⤵
  PID:651
- /usr/bin/pkill
  pkill -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:654
- /usr/bin/pkill
  pkill -f watcher
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:665
- /usr/bin/pkill
  pkill -f /tmp/a
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:668
- /usr/bin/pkill
  pkill -f health.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:672
- /bin/rm
  rm -rf /tmp/.XIN-unix
  2⤵
  PID:674
- /usr/bin/pkill
  pkill -f .XIN-unix
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:675
- /usr/bin/pkill
  pkill -9 vim
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:676
- /bin/rm
  rm -rf /tmp/vim
  2⤵
  PID:678
- /bin/rm
  rm -rf /var/www/futureoftaste
  2⤵
  PID:679
- /bin/rm
  rm -rf /etc/id.services.conf
  2⤵
  PID:680
- /usr/bin/pkill
  pkill -f /etc/32678
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:681
- /usr/bin/pkill
  pkill -f /tmp/runnv/lived.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:682
- /bin/rm
  rm -rf /tmp/runnv
  2⤵
  PID:683
- /usr/bin/pkill
  pkill -f 49nbZB84CgbenDUfv4hxbHJSqgbmSmTsdiJqFyeNF6E4Hbvj8CeF6j1KbFLoWzcvEsZMqZXEedrPZKpYgAbAKrUgLFNzSDz
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:684
- /bin/rm
  rm -rf /tmp/xmrig.tar.gz
  2⤵
  PID:685
- /usr/bin/pkill
  pkill -f pool.hashvault.pro
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:686
- /bin/rm
  rm -rf /tmp/kamd64
  2⤵
  PID:687
- /bin/rm
  rm -rf /tmp/p.sh
  2⤵
  PID:688
- /usr/bin/pkill
  pkill -f /tmp/kamd64
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:689
- /usr/bin/pkill
  pkill -f /tmp/p.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:690
- /usr/bin/pkill
  pkill -f ./ddd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:691
- /usr/bin/pkill
  pkill -f kinsing
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:692
- /bin/rm
  rm -rf /etc/data/kinsing
  2⤵
  PID:693
- /bin/rm
  rm -rf /.local/share/.05bf0e9b
  2⤵
  PID:694
- /bin/rm
  rm -rf /tmp/dockerd
  2⤵
  PID:695
- /bin/rm
  rm -rf /tmp/docker-daemon
  2⤵
  PID:696
- /bin/rm
  rm -rf /tmp/update
  2⤵
  PID:697
- /usr/bin/pkill
  pkill -9 dockerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:698
- /usr/bin/pkill
  pkill -9 /tmp/docker-daemon
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:699
- /usr/bin/pkill
  pkill -9 /tmp/update
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:700
- /bin/rm
  rm -rf /etc/rondo/rondo
  2⤵
  PID:701
- /bin/rm
  rm -rf /etc/profile.d/d.sh
  2⤵
  PID:702
- /bin/rm
  rm -rf /tmp/jaffacakes118_98f8f885d56af980363c650c8451946bed9e4e41dc967c8bbb2178f00433ffda.bin /tmp/systemd-private-a3acf44339d3490b99c995b0459dbd52-systemd-timedated.service-lreIbA
  2⤵
  PID:703
- /usr/bin/pkill
  pkill -f "zpool|c3pool|nanopool|supportxmr|hashvault|p2pool|skypool|xmrpool|herominers|antpool|monerohash|zergpool|mining-dutch|solopool"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:704
- /usr/bin/pkill
  pkill -f fkkkf
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:705
- /bin/rm
  rm -rf /tmp/fkkkf
  2⤵
  PID:706
- /usr/bin/pkill
  pkill -f .dnsupd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:707
- /usr/bin/pkill
  pkill -f n0de
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:708
- /bin/rm
  rm -rf /var/tmp/.font/n0de
  2⤵
  PID:711
- /usr/bin/pkill
  pkill -f alive.sh
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads