895f9d2388853e8389b759cb4ca35368a2c398bd57feb7d18473b1caf06cd09a

Analysis

max time kernel
0s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
14/10/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lxtest.sh
Size 2KB
Sample261014-vta15shb39
SHA256 895f9d2388853e8389b759cb4ca35368a2c398bd57feb7d18473b1caf06cd09a
MD5 17dee6c5bdc0a39420c2fc913ef526c0
SHA1 f8fc2b6a760faadc2b18ce26b68c7103285fced9
SHA512 0b351589c2ef5b548d6c468086f5129d05decd45dbee52628c2072302755430dd3cb3314dcb28919d85c40ac41b9f98a3d5af789854aafd2cffcc7e0a487ee65
TLSH
T1625150FAF6749B31305940AC5C4F3542FE828127CB623D5278D3B8287BAC115B0B0732
MD5 SHA1 SHA512 TLSH

Score

6^/10

antivm defense_evasion discovery

Malware Config

Signatures

Checks SCSI settings 1 TTPs 1 IoCs

Checks list of SCSI devices which may be used to detect VMware or VirtualBox.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/scsi/scsi	grep

Checks hardware identifiers (DMI) 1 TTPs 4 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/sys/class/dmi/id/product_name	systemd-detect-virt
File opened for reading	/sys/class/dmi/id/sys_vendor	systemd-detect-virt
File opened for reading	/sys/class/dmi/id/board_vendor	systemd-detect-virt
File opened for reading	/sys/class/dmi/id/bios_vendor	systemd-detect-virt

Reads MAC address of network interface 2 TTPs 2 IoCs

Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

defense_evasion discovery

System Network Connections Discovery

T1049

Wi-Fi Discovery

T1016.002

description	ioc	Process
File opened for reading	/sys/class/net/eth0/address	cat
File opened for reading	/sys/class/net/lo/address	cat

Reads list of loaded kernel modules 1 TTPs 1 IoCs

Reads the list of currently loaded kernel modules, possibly to detect virtual environments.

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/modules	grep

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	grep
File opened for reading	/proc/cpuinfo	grep

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/bus/pci/devices	lxtest.sh
File opened for reading	/sys/class/net	lxtest.sh
File opened for reading	/sys/hypervisor/type	systemd-detect-virt

Reads runtime system information 8 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/device-tree/hypervisor/compatible	systemd-detect-virt
File opened for reading	/proc/device-tree	systemd-detect-virt
File opened for reading	/proc/1/cgroup	grep
File opened for reading	/proc/sys/kernel/osrelease	grep
File opened for reading	/proc/filesystems	systemd-detect-virt
File opened for reading	/proc/self/stat	systemd-detect-virt
File opened for reading	/proc/1/environ	systemd-detect-virt
File opened for reading	/proc/cmdline	systemd-detect-virt

/tmp/lxtest.sh
/tmp/lxtest.sh
1⤵
- Enumerates kernel/hardware configuration
PID:653
- /bin/grep
  grep -qi hypervisor /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:655
- /bin/grep
  grep -qiE "qemu virtual cpu|core processor \\(" /proc/cpuinfo
  2⤵
  - Checks CPU configuration
  PID:659
- /bin/grep
  grep -qiE "vbox|vmw_|xen-|virtio_|hv_" /proc/modules
  2⤵
  - Reads list of loaded kernel modules
  PID:661
- /bin/grep
  grep -qiE "vbox|vmware|qemu|virtio" /proc/scsi/scsi
  2⤵
  - Checks SCSI settings
  PID:665
- /bin/grep
  grep -qiE "docker|lxc|kubepods|containerd" /proc/1/cgroup
  2⤵
  - Reads runtime system information
  PID:668
- /bin/grep
  grep -qiE "microsoft|wsl" /proc/sys/kernel/osrelease
  2⤵
  - Reads runtime system information
  PID:672
- /bin/cat
  cat /sys/class/net/eth0/address
  2⤵
  - Reads MAC address of network interface
  PID:677
- /usr/bin/tr
  tr A-Z a-z
  2⤵
  PID:680
- /bin/cat
  cat /sys/class/net/lo/address
  2⤵
  - Reads MAC address of network interface
  PID:685
- /usr/bin/tr
  tr A-Z a-z
  2⤵
  PID:688
- /usr/bin/whoami
  whoami
  2⤵
  PID:690
- /usr/bin/tr
  tr A-Z a-z
  2⤵
  PID:693
- /bin/hostname
  hostname
  2⤵
  PID:697
- /usr/bin/tr
  tr A-Z a-z
  2⤵
  PID:699
- /usr/bin/systemd-detect-virt
  systemd-detect-virt
  2⤵
  - Checks hardware identifiers (DMI)
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:700