Analysis
-
max time kernel
19120s -
max time network
189s -
platform
linux_amd64 -
resource
ubuntu-amd64 -
submitted
28-06-2021 22:59
Static task
static1
Behavioral task
behavioral1
Sample
3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.bin
Resource
ubuntu-amd64
linux_amd64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.bin
Resource
debian9-mipsel
linux_mipsel
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.bin
Resource
debian9-mipsbe
linux_mips
0 signatures
0 seconds
General
-
Target
3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.bin
-
Size
102KB
-
MD5
96a157e4c0bef22e0cea1299f88d4745
-
SHA1
446771415864f4916df33aad1aa7e42fa104adee
-
SHA256
3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d
-
SHA512
697071bac6f86ea1b0421306dbc87e926973f061b8eff4608f9a98ada622fe2bdcd45a180591792dd14de54a0b87301ae02f0a3a222e93eb412b340ccc990377
Score
6/10
Malware Config
Signatures
-
Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/696/status /proc/696/status pkill /proc/9/status /proc/9/status pkill /proc/11/status /proc/11/status pkill /proc/191/cmdline /proc/191/cmdline pkill /proc/97/cmdline /proc/97/cmdline pkill /proc/155/status /proc/155/status pkill /proc/343/cmdline /proc/343/cmdline pkill /proc/345/status /proc/345/status pkill /proc/369/status /proc/369/status pkill /proc/2/status /proc/2/status pkill /proc/9/cmdline /proc/9/cmdline pkill /proc/28/status /proc/28/status pkill /proc/416/cmdline /proc/416/cmdline pkill /proc/688/status /proc/688/status pkill /proc/19/cmdline /proc/19/cmdline pkill /proc/114/status /proc/114/status pkill /proc/156/cmdline /proc/156/cmdline pkill /proc/349/status /proc/349/status pkill /proc/12/cmdline /proc/12/cmdline pkill /proc/14/cmdline /proc/14/cmdline pkill /proc/16/status /proc/16/status pkill /proc/79/status /proc/79/status pkill /proc/155/cmdline /proc/155/cmdline pkill /proc/250/status /proc/250/status pkill /proc/13/status /proc/13/status pkill /proc/21/cmdline /proc/21/cmdline pkill /proc/32/cmdline /proc/32/cmdline pkill /proc/160/status /proc/160/status pkill /proc/191/status /proc/191/status pkill /proc/416/status /proc/416/status pkill /proc/20/cmdline /proc/20/cmdline pkill /proc/151/cmdline /proc/151/cmdline pkill /proc/157/status /proc/157/status pkill /proc/34/cmdline /proc/34/cmdline pkill /proc/84/cmdline /proc/84/cmdline pkill /proc/165/status /proc/165/status pkill /proc/169/status /proc/169/status pkill /proc/302/cmdline /proc/302/cmdline pkill /proc/18/status /proc/18/status pkill /proc/30/status /proc/30/status pkill /proc/33/cmdline /proc/33/cmdline pkill /proc/154/cmdline /proc/154/cmdline pkill /proc/165/cmdline /proc/165/cmdline pkill /proc/169/cmdline /proc/169/cmdline pkill /proc/352/cmdline /proc/352/cmdline pkill /proc/7/status /proc/7/status pkill /proc/22/cmdline /proc/22/cmdline pkill /proc/151/status /proc/151/status pkill /proc/250/cmdline /proc/250/cmdline pkill /proc/162/cmdline /proc/162/cmdline pkill /proc/10/status /proc/10/status pkill /proc/22/status /proc/22/status pkill /proc/26/status /proc/26/status pkill /proc/190/status /proc/190/status pkill /proc/249/status /proc/249/status pkill /proc/8/cmdline /proc/8/cmdline pkill /proc/23/cmdline /proc/23/cmdline pkill /proc/33/status /proc/33/status pkill /proc/3/cmdline /proc/3/cmdline pkill /proc/21/status /proc/21/status pkill /proc/154/status /proc/154/status pkill /proc/300/status /proc/300/status pkill /proc/300/cmdline /proc/300/cmdline pkill /proc/344/status /proc/344/status pkill
Processes
-
./3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.bin./3d375d0ead2b63168de86ca2649360d9dcff75b3e0ffa2cf1e50816ec92b3b7d.bin1⤵PID:688
-
"" "" ""2⤵PID:689
-
/bin/unameuname -a3⤵PID:690
-
-
/bin/hostnamehostname3⤵PID:691
-
-
-
"" "" ""2⤵PID:692
-
/bin/unameuname -a3⤵PID:693
-
-
/bin/hostnamehostname3⤵PID:694
-
-
-
"" "" "pkill -9 vmx-*"2⤵PID:695
-
/usr/bin/pkillpkill -9 "vmx-*"3⤵
- Reads CPU attributes
- Reads runtime system information
PID:696
-
-
-
"" "" ""2⤵PID:697
-
/usr/bin/awkawk -F "\"*,\"*" "{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}"3⤵PID:699
-
-