270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d

Analysis

max time kernel
8s
max time network
7s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
17/10/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
Size 25KB
Sample261017-s2barshz7w
SHA256 270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
MD5 9a1c07a71e9898629fd26b79a817562d
SHA1 71bb5fa801f946053cbca4a5e068aae8113e0207
SHA512 91bbf6ab7882f8351c606974d8985053520d6340be728f9f7c58af7c6d8de83ba851eb07856fcbea85c47300d347c893be9f405101033bf879cc2025ea343324
SSDEEP 384:SlB1MPGCDACQLuaometrrKVfX3z+moss6B8fQeXZUTHsXu7S2boZr32eLp5zVZI:+xCMCQDoPr9rOuqjqItwTzbI
TLSH
T1C4B2F76F7F4013B51C88C2A0D74F62C5F306406B9B78A964B56E21097B3256923FFAF6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery persistence

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
771	chmod

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/local/bin/backpack	install

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	install
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

/tmp/270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
/tmp/270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
1⤵
PID:644

/usr/local/sbin/bash
bash /tmp/270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
1⤵
PID:644

/usr/local/bin/bash
bash /tmp/270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
1⤵
PID:644

/usr/sbin/bash
bash /tmp/270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
1⤵
PID:644

/usr/bin/bash
bash /tmp/270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
1⤵
PID:644

/sbin/bash
bash /tmp/270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
1⤵
PID:644

/bin/bash
bash /tmp/270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
1⤵
PID:644
- /usr/bin/dirname
  dirname /tmp/270be80ff0599fc63f03e952b66f4721552c1965b448f5269d62645bacb9e20d
  2⤵
  PID:656
- /bin/uname
  uname -m
  2⤵
  PID:661
- /bin/uname
  uname -m
  2⤵
  PID:666
- /bin/mkdir
  mkdir -p /etc/backpack /root/BackPack/backups
  2⤵
  - Reads runtime system information
  PID:669
- /usr/bin/curl
  curl -fSL --connect-timeout 15 https://github.com/AminMGMT/BackPack/releases/latest/download/backpack_linux_armv7.tar.gz -o /root/BackPack/backpack_linux_armv7.tar.gz
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:675
- /usr/bin/curl
  curl -fSL --connect-timeout 15 https://github.com/AminMGMT/BackPack/releases/latest/download/SHA256SUMS -o /root/BackPack/SHA256SUMS
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:727
- /bin/grep
  grep -E "[[:space:]]\\*?backpack_linux_armv7.tar.gz\$" /root/BackPack/SHA256SUMS
  2⤵
  PID:761
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:762
- /usr/bin/head
  head -1
  2⤵
  PID:763
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:766
- /usr/bin/sha256sum
  sha256sum /root/BackPack/backpack_linux_armv7.tar.gz
  2⤵
  PID:765
- /bin/tar
  tar -xzf /root/BackPack/backpack_linux_armv7.tar.gz -C /root/BackPack backpack
  2⤵
  - Reads runtime system information
  PID:767
- - /usr/local/sbin/gzip
    gzip -d
    3⤵
    PID:768
- - /usr/local/bin/gzip
    gzip -d
    3⤵
    PID:768
- - /usr/sbin/gzip
    gzip -d
    3⤵
    PID:768
- - /usr/bin/gzip
    gzip -d
    3⤵
    PID:768
- - /sbin/gzip
    gzip -d
    3⤵
    PID:768
- - /bin/gzip
    gzip -d
    3⤵
    PID:768
- /usr/bin/install
  install -m 0755 /root/BackPack/backpack /usr/local/bin/backpack
  2⤵
  - Write file to user bin folder
  - Reads runtime system information
  PID:769
- /bin/rm
  rm -f /root/BackPack/backpack
  2⤵
  PID:770
- /bin/chmod
  chmod +x /usr/local/bin/backpack
  2⤵
  - File and Directory Permissions Modification
  PID:771

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install_path

Path /etc/backpack/install_path
Size 15B
SHA256 72e9178b0a693aa97895cc9616fde0ad25f5daa8d74276b7af1e8e57c4325d0c
MD5 eac17d780bfef2ed4907613cf18004e2
SHA1 3bbcd1b46dbb8c6e4c3896f3854f49246a0bcf68
SHA512 d16d2f2ee3eb3583f20eb31e8dd3f564fd459feaed87ca05e58253f83607149a9a8b5938dc8de50fa53e78dbd6f32b98ba29ca76b5fcca162b5fbcf44ad8b77d
MD5 SHA1 SHA512

Submit Download

SHA256SUMS

Path /root/BackPack/SHA256SUMS
Size 656B
SHA256 9adb4c8b9e60b9b654bba61d958e9eeab15838d71a56ca47abb365214fd26716
MD5 3940bc27398c4ac68da74b0d21e813a4
SHA1 85c66dfd0c74136da65d9ca03d15b6a2d868d6cb
SHA512 eaa34a0c776b45be49178a028a382e1caa048613263cd88be145ffd91fba0662f971e386f9443e323d07dabed0f822219b1b7d8f2fe11260b0320beb5837e466
TLSH
T1F5F09E09CA1BF4FAF936580EC1312782C2BE6157B0125ABECF7C36CA00D19095AD19F3
MD5 SHA1 SHA512 TLSH

Submit Download

backpack

Path /root/BackPack/backpack
Size 20.4MB
SHA256 311a76a9592086c7c13e4ab11be58251202698b139b8cec9690d47a9cdbce10a
MD5 0b1e5a8e26cf01c8565151d5485f4db5
SHA1 fb19a6b44440e141bb753152f8b442e2a78b08ed
SHA512 e1ba8e24f51b6d16c848dfa5c3aebd27ff097b1221316d62ab02831974acb2e8c8eb681da337f24ef1a9a494cf39d7ef24529391f45884ba1a71478dc22b6f73
SSDEEP 98304:GTf9lQwlr9uYZd8/NBqGIu7fOZojuVAggJG9xlNnNYrC3gLt4k5BaP1+/7EG:GflcNBvb2Z8iU8lh6+wLtPaP1+/oG
TLSH
T17B274D97B9924952C8E4397BF8BE80C433630EB98787565A6D08ED783FBE5DD0938314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backpack_linux_armv7.tar.gz

Path /root/BackPack/backpack_linux_armv7.tar.gz
Size 7.9MB
SHA256 add4de9951d0ec2d4dfd92f8837f84c9c70f8607b106231b9c54eb9632c4504c
MD5 dafcf7a02164fd3e32ef96e6d46fb381
SHA1 c9fbda80d09aea5e1d809a1d4b291d36d6a70509
SHA512 c941ffa6ad200da0aac20e7a96b49b42da7aaead1b661f788f76605d04ea7641cddd7defb2e8aec4c48066dad433dc0a767158a5fc842f5b313e96e7e87f6b16
SSDEEP 196608:C9Ia4LJ6eaXiH53YdfqA83ItqgmKUP7Eb7JFaiEUE:CeaigegiHVKBu/7KxEUE
TLSH
T1B58633D1F7BABAB058189591EF74C787A13509A0C3E70781A8897643DEC16AE73CCDC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backpack

Path /usr/local/bin/backpack
Size 20.4MB
SHA256 aeb60f00d7865b54f0ce7b060e8e94791f81c0b701af559e1267e29561b0b9b1
MD5 1c3faf75274702d0f82a430e6c7b8969
SHA1 db4908d086de574ea8b28073e33c63f869a87c05
SHA512 556c6514cdc22f888dd76b35f570533cd95f71eeaafafcd24a549685a51890bced0c90906f7401799efc2f7cfee26ead2b4c470e4bb56dfd144c2bc3847f4510
SSDEEP 98304:GTf9lQwlr9uYZd8/NBqGIu7fOZojuVAggJx9xlNnNYrC3gLt4k5BaP1+/7EG:GflcNBvb2Z8iUTlh6+wLtPaP1+/oG
TLSH
T152274D97B9924952C8E4397BF8BE80C433630EB98787565A6D08ED783FBE5DD0938314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads