9cdac4f71d150b0a837e750f79a4b015430de04473232578a17bd8d443f02706

Analysis

max time kernel
5s
max time network
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/09/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.sh
Size 384B
Sample260910-prgs1sck5v
SHA256 9cdac4f71d150b0a837e750f79a4b015430de04473232578a17bd8d443f02706
MD5 1f8325769c3d38662a44cf988dd56c8f
SHA1 9eeb8cadb9249159ac1561623ed80cb2bf95b990
SHA512 32ea46a9859dcd1bc02345e2601058b706d8d09790df8ffbf038fb16d42a3d391ef56f9ecdba7de48a78f6af0362b4971c79157873cafe60374329c0746ea335
TLSH
T139E061EF7455DA1871B305E482081BAC043F841CBD205C3FD15B1DD3210B766C964325
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

/tmp/run.sh
/tmp/run.sh
1⤵
PID:655

/usr/local/sbin/bash
bash /tmp/run.sh
1⤵
PID:655

/usr/local/bin/bash
bash /tmp/run.sh
1⤵
PID:655

/usr/sbin/bash
bash /tmp/run.sh
1⤵
PID:655

/usr/bin/bash
bash /tmp/run.sh
1⤵
PID:655

/sbin/bash
bash /tmp/run.sh
1⤵
PID:655

/bin/bash
bash /tmp/run.sh
1⤵
PID:655
- /usr/bin/curl
  curl -fsL https://spotx-official.github.io/SpotX-Bash/spotx.sh
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:662
- /bin/bash
  bash /dev/fd/63
  2⤵
  PID:684
- - /usr/bin/tr
    tr "[:upper:]" "[:lower:]"
    3⤵
    PID:687
- - /bin/uname
    uname
    3⤵
    PID:686
- - /usr/bin/rev
    rev
    3⤵
    PID:694
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:696
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:695
- - /usr/bin/rev
    rev
    3⤵
    PID:699
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:701
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:700
- - /usr/bin/curl
    curl -q -sL https://github.com/SpotX-Official/SpotX-Bash/blob/main/README.md
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:703
- - /usr/bin/perl
    perl -ne "/(\\d+\\.\\d+\\.\\d+\\.\\d+\\.g[0-9a-f]+)/ && !defined(\$matched) && do { \$matched = \$1; print \"\$1\"; }"
    3⤵
    PID:704
- - /usr/bin/perl
    perl -ne "/(.*)\\./ && print \"\$1\""
    3⤵
    PID:720
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:726
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:727
- - /usr/bin/rev
    rev
    3⤵
    PID:725

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads