51bdb350c251410a9a616024569e914b06a72af0c0dc76cdd1b593803bd8234e

Analysis

max time kernel
12s
max time network
14s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
24/09/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test_endpoints.sh
Size 277B
Sample260924-akbabshb86
SHA256 51bdb350c251410a9a616024569e914b06a72af0c0dc76cdd1b593803bd8234e
MD5 d7f4627e92b29dd72742ccb6491a03f0
SHA1 37c55f93328e72879e16bdfff50c0021ac7e3f94
SHA512 a1c65adc8500a8e58e13a52c614fb29ffd21be3870067bf3d1f52702e3acc786147dbf211403f7ed7cdd9b2cba0b845c7344b641fe6a5c7c61095ac946cc5da0
TLSH
T1B2D02B99151041302C8E8AB8FBC10425446415474ED97DD1B0F128D2EF512EC2AC3010
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

/tmp/test_endpoints.sh
/tmp/test_endpoints.sh
1⤵
PID:643
- /usr/bin/curl
  curl -i -X POST http://rataaa.com/postbox/settings.php -F "T=1" -F "cc=1" -F "heartbeat=240" -F "door_wait=5" -F "username=admin"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:648
- /usr/bin/curl
  curl -i -X GET "http://rataaa.com/postbox/settings.php?mac=11:22:33:44:55:66"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:746

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads