174ccf4594b0a323898a32911f81586381cb96af5a0ee31f7df44f6c7f0c41b0

Analysis

max time kernel
150s
max time network
153s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
30/09/2026, 12:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bot.arm7n
Size 990KB
Sample260930-pjba9sty5r
SHA256 174ccf4594b0a323898a32911f81586381cb96af5a0ee31f7df44f6c7f0c41b0
MD5 801c7122f83eaacf4a0b04bd799c6821
SHA1 f26dd20b4074bebbe345b916facb39ef726632b3
SHA512 e64eb4ae93f11732af0a67e61fb233f65688ab7030ed7c234ab8fdbd35fdae9ef2ca130b5eb5d3c14d3621735d890d8b577736e7603d718b6c4fc19731003c8d
SSDEEP 24576:+WmNVQHYP+SmAC+MqR9p4Wrii7j657yD/hGnmN:KdM4DmUj657yDAmN
TLSH
T1AB254C55F890DF63C9C46B7AFA5E82A833234778C3D7720699148B343B97A1F0B3A645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
882	sh
884	chmod

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_name	bot.arm7n
File opened for reading	/sys/class/dmi/id/sys_vendor	bot.arm7n
File opened for reading	/sys/class/dmi/id/bios_vendor	bot.arm7n
File opened for reading	/sys/class/dmi/id/board_vendor	bot.arm7n

Enumerates running processes
Discovers information about currently running processes on the system

Reads MAC address of network interface 2 TTPs 2 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/lo/address	bot.arm7n
File opened for reading	/sys/class/net/eth0/address	bot.arm7n

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	bot.arm7n

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	bot.arm7n

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/memory.max	bot.arm7n
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	bot.arm7n
File opened for reading	/sys/class/net	bot.arm7n

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/19/ctty	pkill
File opened for reading	/proc/36/ctty	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/345/cmdline	pkill
File opened for reading	/proc/19/ctty	pkill
File opened for reading	/proc/57/cgroup	pkill
File opened for reading	/proc/676/ctty	pkill
File opened for reading	/proc/56/status	pkill
File opened for reading	/proc/73/ctty	pkill
File opened for reading	/proc/33/cmdline	pkill
File opened for reading	/proc/29/cmdline	pkill
File opened for reading	/proc/12/cgroup	pkill
File opened for reading	/proc/12/stat	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/949/status	pkill
File opened for reading	/proc/676/cgroup	pkill
File opened for reading	/proc/348/cmdline	pkill
File opened for reading	/proc/35/cgroup	pkill
File opened for reading	/proc/193/status	pkill
File opened for reading	/proc/643/cgroup	pkill
File opened for reading	/proc/30/ctty	pkill
File opened for reading	/proc/218/stat	pkill
File opened for reading	/proc/313/cgroup	pkill
File opened for reading	/proc/218/status	pkill
File opened for reading	/proc/381/ctty	pkill
File opened for reading	/proc/969/ctty	pkill
File opened for reading	/proc/348/cgroup	pkill
File opened for reading	/proc/814/cmdline	pkill
File opened for reading	/proc/915/cgroup	pkill
File opened for reading	/proc/1/cgroup	pkill
File opened for reading	/proc/142/stat	pkill
File opened for reading	/proc/15/stat	pkill
File opened for reading	/proc/29/cgroup	pkill
File opened for reading	/proc/57/cmdline	pkill
File opened for reading	/proc/24/ctty	pkill
File opened for reading	/proc/142/ctty	pkill
File opened for reading	/proc/18/ctty	pkill
File opened for reading	/proc/624/cmdline	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/676/ctty	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/15/cgroup	pkill
File opened for reading	/proc/642/ctty	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/31/cgroup	pkill
File opened for reading	/proc/321/stat	pkill
File opened for reading	/proc/943/status	pkill
File opened for reading	/proc/25/stat	pkill
File opened for reading	/proc/7/ctty	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/885/cgroup	pkill
File opened for reading	/proc/345/cgroup	pkill
File opened for reading	/proc/26/stat	pkill
File opened for reading	/proc/36/status	pkill
File opened for reading	/proc/345/ctty	pkill
File opened for reading	/proc/676/cgroup	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/319/status	pkill
File opened for reading	/proc/193/ctty	pkill
File opened for reading	/proc/14/cmdline	pkill
File opened for reading	/proc/4/cmdline	pkill

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.zl	bot.arm7n

/tmp/bot.arm7n
/tmp/bot.arm7n
1⤵
- Checks hardware identifiers (DMI)
- Reads MAC address of network interface
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:779
- /bin/sh
  sh -c -- "cp /proc/self/exe /var/.z 2>/dev/null && chmod +x /var/.z 2>/dev/null"
  2⤵
  - File and Directory Permissions Modification
  PID:882
- - /usr/bin/cp
    cp /proc/self/exe /var/.z
    3⤵
    PID:883
- - /usr/bin/chmod
    chmod +x /var/.z
    3⤵
    - File and Directory Permissions Modification
    PID:884
- /bin/sh
  sh -c -- "pkill -9 -x kavsvc 2>/dev/null &"
  2⤵
  PID:886
- /bin/sh
  sh -c -- "pkill -9 -x kavf4 2>/dev/null &"
  2⤵
  PID:888
- /bin/sh
  sh -c -- "pkill -9 -x kavguard 2>/dev/null &"
  2⤵
  PID:890
- /bin/sh
  sh -c -- "pkill -9 -x avp 2>/dev/null &"
  2⤵
  PID:892
- /bin/sh
  sh -c -- "pkill -9 -x avp5 2>/dev/null &"
  2⤵
  PID:894
- /bin/sh
  sh -c -- "pkill -9 -x avp6 2>/dev/null &"
  2⤵
  PID:896
- /bin/sh
  sh -c -- "pkill -9 -x msvsc 2>/dev/null &"
  2⤵
  PID:898
- /bin/sh
  sh -c -- "pkill -9 -x msasc 2>/dev/null &"
  2⤵
  PID:900
- /bin/sh
  sh -c -- "pkill -9 -x msmpeng 2>/dev/null &"
  2⤵
  PID:902
- /bin/sh
  sh -c -- "pkill -9 -x msseces 2>/dev/null &"
  2⤵
  PID:904
- /bin/sh
  sh -c -- "pkill -9 -x msseces.exe 2>/dev/null &"
  2⤵
  PID:906
- /bin/sh
  sh -c -- "pkill -9 -x avast 2>/dev/null &"
  2⤵
  PID:908
- /bin/sh
  sh -c -- "pkill -9 -x avast5 2>/dev/null &"
  2⤵
  PID:910
- /bin/sh
  sh -c -- "pkill -9 -x avast6 2>/dev/null &"
  2⤵
  PID:912
- /bin/sh
  sh -c -- "pkill -9 -x avastsvc 2>/dev/null &"
  2⤵
  PID:914
- /bin/sh
  sh -c -- "pkill -9 -x ash 2>/dev/null &"
  2⤵
  PID:916
- /bin/sh
  sh -c -- "pkill -9 -x ashmaisv 2>/dev/null &"
  2⤵
  PID:918
- /bin/sh
  sh -c -- "pkill -9 -x avgnt 2>/dev/null &"
  2⤵
  PID:920
- /bin/sh
  sh -c -- "pkill -9 -x avgnt.exe 2>/dev/null &"
  2⤵
  PID:922
- /bin/sh
  sh -c -- "pkill -9 -x avgnt2 2>/dev/null &"
  2⤵
  PID:924
- /bin/sh
  sh -c -- "pkill -9 -x avgnt3 2>/dev/null &"
  2⤵
  PID:926
- /bin/sh
  sh -c -- "pkill -9 -x clamd 2>/dev/null &"
  2⤵
  PID:928
- /bin/sh
  sh -c -- "pkill -9 -x clamdscan 2>/dev/null &"
  2⤵
  PID:930
- /bin/sh
  sh -c -- "pkill -9 -x clamonacc 2>/dev/null &"
  2⤵
  PID:932
- /bin/sh
  sh -c -- "pkill -9 -x f-prot 2>/dev/null &"
  2⤵
  PID:934
- /bin/sh
  sh -c -- "pkill -9 -x f-prot64 2>/dev/null &"
  2⤵
  PID:936
- /bin/sh
  sh -c -- "pkill -9 -x f-sport 2>/dev/null &"
  2⤵
  PID:938
- /bin/sh
  sh -c -- "pkill -9 -x f-sport64 2>/dev/null &"
  2⤵
  PID:940
- /bin/sh
  sh -c -- "pkill -9 -x smon 2>/dev/null &"
  2⤵
  PID:942
- /bin/sh
  sh -c -- "pkill -9 -x smon2 2>/dev/null &"
  2⤵
  PID:944
- /bin/sh
  sh -c -- "pkill -9 -x smon3 2>/dev/null &"
  2⤵
  PID:946
- /bin/sh
  sh -c -- "pkill -9 -x mcs 2>/dev/null &"
  2⤵
  PID:948
- /bin/sh
  sh -c -- "pkill -9 -x mcs2 2>/dev/null &"
  2⤵
  PID:950
- /bin/sh
  sh -c -- "pkill -9 -x mcs3 2>/dev/null &"
  2⤵
  PID:952
- /bin/sh
  sh -c -- "pkill -9 -x navpsv32 2>/dev/null &"
  2⤵
  PID:954
- /bin/sh
  sh -c -- "pkill -9 -x navpsv64 2>/dev/null &"
  2⤵
  PID:956
- /bin/sh
  sh -c -- "pkill -9 -x navw32 2>/dev/null &"
  2⤵
  PID:958
- /bin/sh
  sh -c -- "pkill -9 -x navw64 2>/dev/null &"
  2⤵
  PID:960
- /bin/sh
  sh -c -- "pkill -9 -x avp.exe 2>/dev/null &"
  2⤵
  PID:962
- /bin/sh
  sh -c -- "pkill -9 -x avpsvc.exe 2>/dev/null &"
  2⤵
  PID:964
- /bin/sh
  sh -c -- "pkill -9 -x avpcc.exe 2>/dev/null &"
  2⤵
  PID:966
- /bin/sh
  sh -c -- "pkill -9 -x avpm.exe 2>/dev/null &"
  2⤵
  PID:968
- /bin/sh
  sh -c -- "pkill -9 -x avp9.exe 2>/dev/null &"
  2⤵
  PID:970
- /bin/sh
  sh -c -- "pkill -9 -x avp10.exe 2>/dev/null &"
  2⤵
  PID:972
- /bin/sh
  sh -c -- "pkill -9 -x avp11.exe 2>/dev/null &"
  2⤵
  PID:974
- /bin/sh
  sh -c -- "pkill -9 -x avp12.exe 2>/dev/null &"
  2⤵
  PID:976
- /bin/sh
  sh -c -- "pkill -9 -x avp13.exe 2>/dev/null &"
  2⤵
  PID:978
- /bin/sh
  sh -c -- "pkill -9 -x avp14.exe 2>/dev/null &"
  2⤵
  PID:980
- /bin/sh
  sh -c -- "pkill -9 -x avp15.exe 2>/dev/null &"
  2⤵
  PID:982
- /bin/sh
  sh -c -- "pkill -9 -x avp16.exe 2>/dev/null &"
  2⤵
  PID:984
- /bin/sh
  sh -c -- "pkill -9 -x avp17.exe 2>/dev/null &"
  2⤵
  PID:986
- /bin/sh
  sh -c -- "pkill -9 -x avp18.exe 2>/dev/null &"
  2⤵
  PID:988
- /bin/sh
  sh -c -- "pkill -9 -x avp19.exe 2>/dev/null &"
  2⤵
  PID:990
- /bin/sh
  sh -c -- "pkill -9 -x avp20.exe 2>/dev/null &"
  2⤵
  PID:992
- /bin/sh
  sh -c -- "pkill -9 -x avp21.exe 2>/dev/null &"
  2⤵
  PID:994
- /bin/sh
  sh -c -- "pkill -9 -x avp22.exe 2>/dev/null &"
  2⤵
  PID:996
- /bin/sh
  sh -c -- "pkill -9 -x avp23.exe 2>/dev/null &"
  2⤵
  PID:998
- /bin/sh
  sh -c -- "pkill -9 -x avp24.exe 2>/dev/null &"
  2⤵
  PID:1000

/usr/bin/pkill
pkill -9 -x kavsvc
1⤵
PID:887

/usr/bin/pkill
pkill -9 -x kavf4
1⤵
- Reads runtime system information
PID:889

/usr/bin/pkill
pkill -9 -x kavguard
1⤵
- Reads runtime system information
PID:891

/usr/bin/pkill
pkill -9 -x avp
1⤵
- Reads runtime system information
PID:893

/usr/bin/pkill
pkill -9 -x avp5
1⤵
PID:895

/usr/bin/pkill
pkill -9 -x avp6
1⤵
PID:897

/usr/bin/pkill
pkill -9 -x msvsc
1⤵
- Reads runtime system information
PID:899

/usr/bin/pkill
pkill -9 -x msasc
1⤵
- Reads runtime system information
PID:901

/usr/bin/pkill
pkill -9 -x msmpeng
1⤵
- Reads runtime system information
PID:903

/usr/bin/pkill
pkill -9 -x msseces
1⤵
- Reads runtime system information
PID:905

/usr/bin/pkill
pkill -9 -x msseces.exe
1⤵
PID:907

/usr/bin/pkill
pkill -9 -x avast
1⤵
- Reads runtime system information
PID:909

/usr/bin/pkill
pkill -9 -x avast5
1⤵
PID:911

/usr/bin/pkill
pkill -9 -x avast6
1⤵
- Reads runtime system information
PID:913

/usr/bin/pkill
pkill -9 -x avastsvc
1⤵
- Reads runtime system information
PID:915

/usr/bin/pkill
pkill -9 -x ash
1⤵
- Reads runtime system information
PID:917

/usr/bin/pkill
pkill -9 -x ashmaisv
1⤵
PID:919

/usr/bin/pkill
pkill -9 -x avgnt
1⤵
- Reads runtime system information
PID:921

/usr/bin/pkill
pkill -9 -x avgnt.exe
1⤵
- Reads runtime system information
PID:923

/usr/bin/pkill
pkill -9 -x avgnt2
1⤵
PID:925

/usr/bin/pkill
pkill -9 -x avgnt3
1⤵
PID:927

/usr/bin/pkill
pkill -9 -x clamd
1⤵
- Reads runtime system information
PID:929

/usr/bin/pkill
pkill -9 -x clamdscan
1⤵
- Reads runtime system information
PID:931

/usr/bin/pkill
pkill -9 -x clamonacc
1⤵
- Reads runtime system information
PID:933

/usr/bin/pkill
pkill -9 -x f-prot
1⤵
- Reads runtime system information
PID:935

/usr/bin/pkill
pkill -9 -x f-prot64
1⤵
- Reads runtime system information
PID:937

/usr/bin/pkill
pkill -9 -x f-sport
1⤵
- Reads runtime system information
PID:939

/usr/bin/pkill
pkill -9 -x f-sport64
1⤵
- Reads runtime system information
PID:941

/usr/bin/pkill
pkill -9 -x smon
1⤵
PID:943

/usr/bin/pkill
pkill -9 -x smon2
1⤵
- Reads runtime system information
PID:945

/usr/bin/pkill
pkill -9 -x smon3
1⤵
- Reads runtime system information
PID:947

/usr/bin/pkill
pkill -9 -x mcs
1⤵
- Reads runtime system information
PID:949

/usr/bin/pkill
pkill -9 -x mcs2
1⤵
PID:951

/usr/bin/pkill
pkill -9 -x mcs3
1⤵
- Reads runtime system information
PID:953

/usr/bin/pkill
pkill -9 -x navpsv32
1⤵
PID:955

/usr/bin/pkill
pkill -9 -x navpsv64
1⤵
- Reads runtime system information
PID:957

/usr/bin/pkill
pkill -9 -x navw32
1⤵
- Reads runtime system information
PID:959

/usr/bin/pkill
pkill -9 -x navw64
1⤵
- Reads runtime system information
PID:961

/usr/bin/pkill
pkill -9 -x avp.exe
1⤵
- Reads runtime system information
PID:963

/usr/bin/pkill
pkill -9 -x avpsvc.exe
1⤵
PID:965

/usr/bin/pkill
pkill -9 -x avpcc.exe
1⤵
- Reads runtime system information
PID:967

/usr/bin/pkill
pkill -9 -x avpm.exe
1⤵
- Reads runtime system information
PID:969

/usr/bin/pkill
pkill -9 -x avp9.exe
1⤵
- Reads runtime system information
PID:971

/usr/bin/pkill
pkill -9 -x avp10.exe
1⤵
- Reads runtime system information
PID:973

/usr/bin/pkill
pkill -9 -x avp11.exe
1⤵
PID:975

/usr/bin/pkill
pkill -9 -x avp12.exe
1⤵
- Reads runtime system information
PID:977

/usr/bin/pkill
pkill -9 -x avp13.exe
1⤵
PID:979

/usr/bin/pkill
pkill -9 -x avp14.exe
1⤵
- Reads runtime system information
PID:981

/usr/bin/pkill
pkill -9 -x avp15.exe
1⤵
PID:983

/usr/bin/pkill
pkill -9 -x avp16.exe
1⤵
PID:985

/usr/bin/pkill
pkill -9 -x avp17.exe
1⤵
PID:987

/usr/bin/pkill
pkill -9 -x avp18.exe
1⤵
PID:989

/usr/bin/pkill
pkill -9 -x avp19.exe
1⤵
PID:991

/usr/bin/pkill
pkill -9 -x avp20.exe
1⤵
PID:993

/usr/bin/pkill
pkill -9 -x avp21.exe
1⤵
PID:995

/usr/bin/pkill
pkill -9 -x avp22.exe
1⤵
PID:997

/usr/bin/pkill
pkill -9 -x avp23.exe
1⤵
PID:999

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads