7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109

Analysis

max time kernel
122s
max time network
140s
platform
debian-12_armhf
resource
debian12-armhf-20260127-en
resource tags

arch:armhfimage:debian12-armhf-20260127-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
01/11/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109
Size 229KB
Sample261101-2fmlcaz13m
SHA256 7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109
MD5 838ddc9416bcfd9fa028e5e4b229e053
SHA1 fdd8c339fce76df7e995606bd00282f454f5e66e
SHA512 140668fa772b76af8388f892cc74d14d37fc91197864c9b123cda49483db9f5520c6dc328f4033535c980236e9df807b2e6ad2f6237186a9131704b56b4db025
SSDEEP 6144:XAUxYspQZDff/avM7s7f/OyC2EoIuy0nmW2hVDZI0/16O7Nc:XtxwZrf/aEg7XOyQoxnmW2hVD60/16Oq
TLSH
T12E341902A8528A53C5C21B79BB5F46593733AB34D3DB3302DA28AFB42F476DE0E39511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm discovery

Malware Config

Signatures

Traces itself 1 IoCs

Traces itself to prevent debugging attempts

pid	Process
786	7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	134.195.4.2

Enumerates active TCP sockets 1 TTPs 1 IoCs

Gets active TCP sockets from /proc virtual filesystem.

discovery

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/proc/net/tcp	7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/bin/bash	786	7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109

Reads system network configuration 1 TTPs 1 IoCs

Uses contents of /proc filesystem to enumerate network settings.

discovery

Internet Connection Discovery

T1016.001

description	ioc	Process
File opened for reading	/proc/net/tcp	7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109

Reads runtime system information 3 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/self/status	7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109
File opened for reading	/proc/sys/kernel/osrelease	7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109
File opened for reading	/proc/stat	7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109

/tmp/7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109
/tmp/7aeff74188a4db284001218af61dbee05549fa76cc4ba227f9e9d83c5f519109
1⤵
- Traces itself
- Enumerates active TCP sockets
- Changes its process name
- Checks CPU configuration
- Reads system network configuration
- Reads runtime system information
PID:786
- /bin/sh
  sh -c "iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
  2⤵
  PID:793
- /bin/sh
  sh -c "/bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
  2⤵
  PID:796
- - /bin/busybox
    /bin/busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
    3⤵
    PID:799
- /bin/sh
  sh -c "/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
  2⤵
  PID:802
- - /bin/iptables
    /bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
    3⤵
    PID:805
- /bin/sh
  sh -c "/usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
  2⤵
  PID:806
- - /usr/bin/iptables
    /usr/bin/iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
    3⤵
    PID:808
- /bin/sh
  sh -c "busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT"
  2⤵
  PID:809
- - /usr/bin/busybox
    busybox iptables -A INPUT -p tcp --dport 26721 -j ACCEPT
    3⤵
    PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads