Analysis
-
max time kernel
0s -
max time network
124s -
platform
linux_amd64 -
resource
ubuntu-amd64 -
submitted
30-06-2021 16:31
Static task
static1
Behavioral task
behavioral1
Sample
796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4.bin
Resource
ubuntu-amd64
linux_amd64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4.bin
Resource
debian9-mipsel
linux_mipsel
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4.bin
Resource
debian9-mipsbe
linux_mips
0 signatures
0 seconds
General
-
Target
796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4.bin
-
Size
102KB
-
MD5
ab3229656f73505a3c53f7d2e95efd0e
-
SHA1
45404b862e70a7a1b4db6c73d374b8ac19ddf772
-
SHA256
796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4
-
SHA512
6d7fd3cd593f2c15c899a159282f48c9d3a274a4d9d1e05ed42fa1b99debf193eb828cf07b2deaa2b65fb8d91488c4c546c1d97d60f01ea1ddcd63e19e8ac3d9
Score
6/10
Malware Config
Signatures
-
Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process /sys/devices/system/cpu/online /sys/devices/system/cpu/online pkill -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process /proc/250/cmdline /proc/250/cmdline pkill /proc/300/status /proc/300/status pkill /proc/12/status /proc/12/status pkill /proc/32/status /proc/32/status pkill /proc/33/status /proc/33/status pkill /proc/302/status /proc/302/status pkill /proc/370/cmdline /proc/370/cmdline pkill /proc/34/cmdline /proc/34/cmdline pkill /proc/155/status /proc/155/status pkill /proc/159/cmdline /proc/159/cmdline pkill /proc/82/cmdline /proc/82/cmdline pkill /proc/249/status /proc/249/status pkill /proc/369/cmdline /proc/369/cmdline pkill /proc/11/cmdline /proc/11/cmdline pkill /proc/20/status /proc/20/status pkill /proc/80/cmdline /proc/80/cmdline pkill /proc/166/status /proc/166/status pkill /proc/349/cmdline /proc/349/cmdline pkill /proc/416/status /proc/416/status pkill /proc/18/cmdline /proc/18/cmdline pkill /proc/23/status /proc/23/status pkill /proc/159/status /proc/159/status pkill /proc/77/cmdline /proc/77/cmdline pkill /proc/152/status /proc/152/status pkill /proc/191/cmdline /proc/191/cmdline pkill /proc/237/status /proc/237/status pkill /proc/387/cmdline /proc/387/cmdline pkill /proc/13/cmdline /proc/13/cmdline pkill /proc/17/cmdline /proc/17/cmdline pkill /proc/18/status /proc/18/status pkill /proc/479/cmdline /proc/479/cmdline pkill /proc/165/status /proc/165/status pkill /proc/28/cmdline /proc/28/cmdline pkill /proc/157/status /proc/157/status pkill /proc/191/status /proc/191/status pkill /proc/369/status /proc/369/status pkill /proc/443/status /proc/443/status pkill /proc/16/status /proc/16/status pkill /proc/19/status /proc/19/status pkill /proc/19/cmdline /proc/19/cmdline pkill /proc/561/status /proc/561/status pkill /proc/152/cmdline /proc/152/cmdline pkill /proc/154/status /proc/154/status pkill /proc/562/cmdline /proc/562/cmdline pkill /proc/570/cmdline /proc/570/cmdline pkill /proc/2/cmdline /proc/2/cmdline pkill /proc/77/status /proc/77/status pkill /proc/84/cmdline /proc/84/cmdline pkill /proc/10/cmdline /proc/10/cmdline pkill /proc/35/cmdline /proc/35/cmdline pkill /proc/160/status /proc/160/status pkill /proc/352/status /proc/352/status pkill /proc/416/cmdline /proc/416/cmdline pkill /proc/479/status /proc/479/status pkill /proc/13/status /proc/13/status pkill /proc/23/cmdline /proc/23/cmdline pkill /proc/78/cmdline /proc/78/cmdline pkill /proc/477/status /proc/477/status pkill /proc/1/cmdline /proc/1/cmdline pkill /proc/8/cmdline /proc/8/cmdline pkill /proc/20/cmdline /proc/20/cmdline pkill /proc/78/status /proc/78/status pkill /proc/164/status /proc/164/status pkill /proc/352/cmdline /proc/352/cmdline pkill
Processes
-
./796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4.bin./796800face046765bd79f267c56a6c93ee2800b76d7f38ad96e5acb92599fcd4.bin1⤵PID:562
-
"" "" ""2⤵PID:563
-
/bin/unameuname -a3⤵PID:564
-
-
/bin/hostnamehostname3⤵PID:565
-
-
-
"" "" ""2⤵PID:566
-
/bin/unameuname -a3⤵PID:567
-
-
/bin/hostnamehostname3⤵PID:568
-
-
-
"" "" "pkill -9 vmx-*"2⤵PID:569
-
/usr/bin/pkillpkill -9 "vmx-*"3⤵
- Reads CPU attributes
- Reads runtime system information
PID:570
-
-
-
"" "" ""2⤵PID:571
-
/usr/bin/awkawk -F "\"*,\"*" "{system(\"esxcli vm process kill --type=force --world-id=\" \$1)}"3⤵PID:573
-
-