Overview

overview

6

Static

static

19827af318...254e2c

linux_amd64

6

Analysis

  • max time kernel
    0s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • submitted
    13-06-2022 18:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    19827af3181c12ee7a89cee51f254e2c

  • Size

    2.6MB

  • MD5

    19827af3181c12ee7a89cee51f254e2c

  • SHA1

    7c3016dfdfd536e96ef9a7e1a51de01bc0390772

  • SHA256

    f13e48658426307d9d1434b50fa0493f566ed1f31d6e88bb4ac2ae12ec31ef1f

  • SHA512

    1d5915c8e7b8c24a77b17599bea32645ff5e12b7c37f17f2058199be2bf159eb5433f5193d65fdd8aa3a1eba7c4694921e9a0b1a25eb7ef44b2c8eb16d0f3fe9

Score
6/10

Malware Config

Signatures

  • Reads CPU attributes 1 TTPs 12 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • ./19827af3181c12ee7a89cee51f254e2c
    ./19827af3181c12ee7a89cee51f254e2c
    1⤵
      PID:576
    • /bin/bash
      bash -c "ps aux | grep -v grep | grep -v '202.28.229.174' | grep -v '192.157.86' | grep -v '192.227.90' | grep -v iosk | grep -v g4mm4 | grep 'curl' | awk '{print \$2}' | xargs -i kill -9 {}; ps aux | grep -v grep | grep -v '202.28.229.174' | grep -v '192.157.86' | grep -v iosk | grep -v g4mm4 | grep 'wget' | awk '{print \$2}' | xargs -i kill -9 {}; ps aux | grep -v '202.28.229.174' | grep -v grep | grep -v '192.157.86' | grep -v iosk | grep -v g4mm4 | grep 'urlopen' | awk '{print \$2}' | xargs -i kill -9 {}"
      1⤵
        PID:581
        • /bin/ps
          ps aux
          2⤵
          • Reads CPU attributes
          • Reads runtime system information
          PID:582
        • /bin/grep
          grep -v grep
          2⤵
            PID:583
          • /bin/grep
            grep -v 202.28.229.174
            2⤵
              PID:584
            • /bin/grep
              grep -v 192.157.86
              2⤵
                PID:585
              • /bin/grep
                grep -v 192.227.90
                2⤵
                  PID:586
                • /bin/grep
                  grep -v iosk
                  2⤵
                    PID:587
                  • /bin/grep
                    grep -v g4mm4
                    2⤵
                      PID:588
                    • /bin/grep
                      grep curl
                      2⤵
                        PID:589
                      • /usr/bin/awk
                        awk "{print \$2}"
                        2⤵
                          PID:590
                        • /usr/bin/xargs
                          xargs -i kill -9 "{}"
                          2⤵
                            PID:591
                          • /bin/ps
                            ps aux
                            2⤵
                            • Reads CPU attributes
                            • Reads runtime system information
                            PID:592
                          • /bin/grep
                            grep -v grep
                            2⤵
                              PID:593
                            • /bin/grep
                              grep -v 202.28.229.174
                              2⤵
                                PID:594
                              • /bin/grep
                                grep -v 192.157.86
                                2⤵
                                  PID:595
                                • /bin/grep
                                  grep -v iosk
                                  2⤵
                                    PID:600
                                  • /bin/grep
                                    grep -v g4mm4
                                    2⤵
                                      PID:601
                                    • /bin/grep
                                      grep wget
                                      2⤵
                                        PID:602
                                      • /usr/bin/awk
                                        awk "{print \$2}"
                                        2⤵
                                          PID:603
                                        • /usr/bin/xargs
                                          xargs -i kill -9 "{}"
                                          2⤵
                                            PID:604
                                          • /bin/ps
                                            ps aux
                                            2⤵
                                            • Reads CPU attributes
                                            • Reads runtime system information
                                            PID:605
                                          • /bin/grep
                                            grep -v 202.28.229.174
                                            2⤵
                                              PID:606
                                            • /bin/grep
                                              grep -v grep
                                              2⤵
                                                PID:607
                                              • /bin/grep
                                                grep -v 192.157.86
                                                2⤵
                                                  PID:608
                                                • /bin/grep
                                                  grep -v iosk
                                                  2⤵
                                                    PID:609
                                                  • /bin/grep
                                                    grep -v g4mm4
                                                    2⤵
                                                      PID:610
                                                    • /bin/grep
                                                      grep urlopen
                                                      2⤵
                                                        PID:611
                                                      • /usr/bin/awk
                                                        awk "{print \$2}"
                                                        2⤵
                                                          PID:612
                                                        • /usr/bin/xargs
                                                          xargs -i kill -9 "{}"
                                                          2⤵
                                                            PID:613
                                                        • /bin/bash
                                                          bash -c "ps aux | grep -v grep | grep -v '202.28.229.174' | grep -v '192.157.86' | grep -v '192.227.90' | grep -v iosk | grep -v g4mm4 | grep 'curl' | awk '{print \$2}' | xargs -i kill -9 {}; ps aux | grep -v grep | grep -v '202.28.229.174' | grep -v '192.157.86' | grep -v iosk | grep -v g4mm4 | grep 'wget' | awk '{print \$2}' | xargs -i kill -9 {}; ps aux | grep -v '202.28.229.174' | grep -v grep | grep -v '192.157.86' | grep -v iosk | grep -v g4mm4 | grep 'urlopen' | awk '{print \$2}' | xargs -i kill -9 {}"
                                                          1⤵
                                                            PID:614
                                                            • /bin/ps
                                                              ps aux
                                                              2⤵
                                                              • Reads CPU attributes
                                                              • Reads runtime system information
                                                              PID:615
                                                            • /bin/grep
                                                              grep -v grep
                                                              2⤵
                                                                PID:616
                                                              • /bin/grep
                                                                grep -v 202.28.229.174
                                                                2⤵
                                                                  PID:617
                                                                • /bin/grep
                                                                  grep -v 192.157.86
                                                                  2⤵
                                                                    PID:618
                                                                  • /bin/grep
                                                                    grep -v 192.227.90
                                                                    2⤵
                                                                      PID:619
                                                                    • /bin/grep
                                                                      grep -v iosk
                                                                      2⤵
                                                                        PID:620
                                                                      • /bin/grep
                                                                        grep -v g4mm4
                                                                        2⤵
                                                                          PID:621
                                                                        • /bin/grep
                                                                          grep curl
                                                                          2⤵
                                                                            PID:622
                                                                          • /usr/bin/awk
                                                                            awk "{print \$2}"
                                                                            2⤵
                                                                              PID:623
                                                                            • /usr/bin/xargs
                                                                              xargs -i kill -9 "{}"
                                                                              2⤵
                                                                                PID:624
                                                                              • /bin/ps
                                                                                ps aux
                                                                                2⤵
                                                                                • Reads CPU attributes
                                                                                • Reads runtime system information
                                                                                PID:625
                                                                              • /bin/grep
                                                                                grep -v grep
                                                                                2⤵
                                                                                  PID:626
                                                                                • /bin/grep
                                                                                  grep -v 202.28.229.174
                                                                                  2⤵
                                                                                    PID:627
                                                                                  • /bin/grep
                                                                                    grep -v 192.157.86
                                                                                    2⤵
                                                                                      PID:628
                                                                                    • /bin/grep
                                                                                      grep -v iosk
                                                                                      2⤵
                                                                                        PID:629
                                                                                      • /bin/grep
                                                                                        grep -v g4mm4
                                                                                        2⤵
                                                                                          PID:630
                                                                                        • /bin/grep
                                                                                          grep wget
                                                                                          2⤵
                                                                                            PID:631
                                                                                          • /usr/bin/awk
                                                                                            awk "{print \$2}"
                                                                                            2⤵
                                                                                              PID:632
                                                                                            • /usr/bin/xargs
                                                                                              xargs -i kill -9 "{}"
                                                                                              2⤵
                                                                                                PID:633
                                                                                              • /bin/ps
                                                                                                ps aux
                                                                                                2⤵
                                                                                                • Reads CPU attributes
                                                                                                • Reads runtime system information
                                                                                                PID:634
                                                                                              • /bin/grep
                                                                                                grep -v 202.28.229.174
                                                                                                2⤵
                                                                                                  PID:635
                                                                                                • /bin/grep
                                                                                                  grep -v grep
                                                                                                  2⤵
                                                                                                    PID:636
                                                                                                  • /bin/grep
                                                                                                    grep -v 192.157.86
                                                                                                    2⤵
                                                                                                      PID:637
                                                                                                    • /bin/grep
                                                                                                      grep -v iosk
                                                                                                      2⤵
                                                                                                        PID:638
                                                                                                      • /bin/grep
                                                                                                        grep -v g4mm4
                                                                                                        2⤵
                                                                                                          PID:639
                                                                                                        • /bin/grep
                                                                                                          grep urlopen
                                                                                                          2⤵
                                                                                                            PID:640
                                                                                                          • /usr/bin/awk
                                                                                                            awk "{print \$2}"
                                                                                                            2⤵
                                                                                                              PID:641
                                                                                                            • /usr/bin/xargs
                                                                                                              xargs -i kill -9 "{}"
                                                                                                              2⤵
                                                                                                                PID:642
                                                                                                            • /bin/bash
                                                                                                              bash -c "ps aux | grep -v grep | grep -v '202.28.229.174' | grep -v '192.157.86' | grep -v '192.227.90' | grep -v iosk | grep -v g4mm4 | grep 'curl' | awk '{print \$2}' | xargs -i kill -9 {}; ps aux | grep -v grep | grep -v '202.28.229.174' | grep -v '192.157.86' | grep -v iosk | grep -v g4mm4 | grep 'wget' | awk '{print \$2}' | xargs -i kill -9 {}; ps aux | grep -v '202.28.229.174' | grep -v grep | grep -v '192.157.86' | grep -v iosk | grep -v g4mm4 | grep 'urlopen' | awk '{print \$2}' | xargs -i kill -9 {}"
                                                                                                              1⤵
                                                                                                                PID:643
                                                                                                                • /bin/ps
                                                                                                                  ps aux
                                                                                                                  2⤵
                                                                                                                  • Reads CPU attributes
                                                                                                                  • Reads runtime system information
                                                                                                                  PID:644
                                                                                                                • /bin/grep
                                                                                                                  grep -v grep
                                                                                                                  2⤵
                                                                                                                    PID:645
                                                                                                                  • /bin/grep
                                                                                                                    grep -v 202.28.229.174
                                                                                                                    2⤵
                                                                                                                      PID:646
                                                                                                                    • /bin/grep
                                                                                                                      grep -v 192.157.86
                                                                                                                      2⤵
                                                                                                                        PID:647
                                                                                                                      • /bin/grep
                                                                                                                        grep -v 192.227.90
                                                                                                                        2⤵
                                                                                                                          PID:648
                                                                                                                        • /bin/grep
                                                                                                                          grep -v iosk
                                                                                                                          2⤵
                                                                                                                            PID:649
                                                                                                                          • /bin/grep
                                                                                                                            grep -v g4mm4
                                                                                                                            2⤵
                                                                                                                              PID:650
                                                                                                                            • /bin/grep
                                                                                                                              grep curl
                                                                                                                              2⤵
                                                                                                                                PID:651
                                                                                                                              • /usr/bin/awk
                                                                                                                                awk "{print \$2}"
                                                                                                                                2⤵
                                                                                                                                  PID:652
                                                                                                                                • /usr/bin/xargs
                                                                                                                                  xargs -i kill -9 "{}"
                                                                                                                                  2⤵
                                                                                                                                    PID:653
                                                                                                                                  • /bin/ps
                                                                                                                                    ps aux
                                                                                                                                    2⤵
                                                                                                                                    • Reads CPU attributes
                                                                                                                                    • Reads runtime system information
                                                                                                                                    PID:654
                                                                                                                                  • /bin/grep
                                                                                                                                    grep -v grep
                                                                                                                                    2⤵
                                                                                                                                      PID:655
                                                                                                                                    • /bin/grep
                                                                                                                                      grep -v 202.28.229.174
                                                                                                                                      2⤵
                                                                                                                                        PID:656
                                                                                                                                      • /bin/grep
                                                                                                                                        grep -v 192.157.86
                                                                                                                                        2⤵
                                                                                                                                          PID:657
                                                                                                                                        • /bin/grep
                                                                                                                                          grep -v iosk
                                                                                                                                          2⤵
                                                                                                                                            PID:658
                                                                                                                                          • /bin/grep
                                                                                                                                            grep -v g4mm4
                                                                                                                                            2⤵
                                                                                                                                              PID:659
                                                                                                                                            • /bin/grep
                                                                                                                                              grep wget
                                                                                                                                              2⤵
                                                                                                                                                PID:660
                                                                                                                                              • /usr/bin/awk
                                                                                                                                                awk "{print \$2}"
                                                                                                                                                2⤵
                                                                                                                                                  PID:661
                                                                                                                                                • /usr/bin/xargs
                                                                                                                                                  xargs -i kill -9 "{}"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:662
                                                                                                                                                  • /bin/ps
                                                                                                                                                    ps aux
                                                                                                                                                    2⤵
                                                                                                                                                    • Reads CPU attributes
                                                                                                                                                    • Reads runtime system information
                                                                                                                                                    PID:663
                                                                                                                                                  • /bin/grep
                                                                                                                                                    grep -v 202.28.229.174
                                                                                                                                                    2⤵
                                                                                                                                                      PID:664
                                                                                                                                                    • /bin/grep
                                                                                                                                                      grep -v grep
                                                                                                                                                      2⤵
                                                                                                                                                        PID:665
                                                                                                                                                      • /bin/grep
                                                                                                                                                        grep -v 192.157.86
                                                                                                                                                        2⤵
                                                                                                                                                          PID:666
                                                                                                                                                        • /bin/grep
                                                                                                                                                          grep -v iosk
                                                                                                                                                          2⤵
                                                                                                                                                            PID:667
                                                                                                                                                          • /bin/grep
                                                                                                                                                            grep -v g4mm4
                                                                                                                                                            2⤵
                                                                                                                                                              PID:668
                                                                                                                                                            • /bin/grep
                                                                                                                                                              grep urlopen
                                                                                                                                                              2⤵
                                                                                                                                                                PID:669
                                                                                                                                                              • /usr/bin/awk
                                                                                                                                                                awk "{print \$2}"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:670
                                                                                                                                                                • /usr/bin/xargs
                                                                                                                                                                  xargs -i kill -9 "{}"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:671
                                                                                                                                                                • /bin/bash
                                                                                                                                                                  bash -c "ps aux | grep -v grep | grep -v '202.28.229.174' | grep -v '192.157.86' | grep -v '192.227.90' | grep -v iosk | grep -v g4mm4 | grep 'curl' | awk '{print \$2}' | xargs -i kill -9 {}; ps aux | grep -v grep | grep -v '202.28.229.174' | grep -v '192.157.86' | grep -v iosk | grep -v g4mm4 | grep 'wget' | awk '{print \$2}' | xargs -i kill -9 {}; ps aux | grep -v '202.28.229.174' | grep -v grep | grep -v '192.157.86' | grep -v iosk | grep -v g4mm4 | grep 'urlopen' | awk '{print \$2}' | xargs -i kill -9 {}"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:672
                                                                                                                                                                    • /bin/ps
                                                                                                                                                                      ps aux
                                                                                                                                                                      2⤵
                                                                                                                                                                      • Reads CPU attributes
                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                      PID:673
                                                                                                                                                                    • /bin/grep
                                                                                                                                                                      grep -v grep
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:674
                                                                                                                                                                      • /bin/grep
                                                                                                                                                                        grep -v 202.28.229.174
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:675
                                                                                                                                                                        • /bin/grep
                                                                                                                                                                          grep -v 192.157.86
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:676
                                                                                                                                                                          • /bin/grep
                                                                                                                                                                            grep -v 192.227.90
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:677
                                                                                                                                                                            • /bin/grep
                                                                                                                                                                              grep -v iosk
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:678
                                                                                                                                                                              • /bin/grep
                                                                                                                                                                                grep -v g4mm4
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:679
                                                                                                                                                                                • /bin/grep
                                                                                                                                                                                  grep curl
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:680
                                                                                                                                                                                  • /usr/bin/xargs
                                                                                                                                                                                    xargs -i kill -9 "{}"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:682
                                                                                                                                                                                    • /usr/bin/awk
                                                                                                                                                                                      awk "{print \$2}"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:681
                                                                                                                                                                                      • /bin/ps
                                                                                                                                                                                        ps aux
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                        PID:683
                                                                                                                                                                                      • /bin/grep
                                                                                                                                                                                        grep -v grep
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:684
                                                                                                                                                                                        • /bin/grep
                                                                                                                                                                                          grep -v 202.28.229.174
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:685
                                                                                                                                                                                          • /bin/grep
                                                                                                                                                                                            grep -v 192.157.86
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:686
                                                                                                                                                                                            • /bin/grep
                                                                                                                                                                                              grep -v iosk
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:687
                                                                                                                                                                                              • /bin/grep
                                                                                                                                                                                                grep -v g4mm4
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:688
                                                                                                                                                                                                • /bin/grep
                                                                                                                                                                                                  grep wget
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:689
                                                                                                                                                                                                  • /usr/bin/awk
                                                                                                                                                                                                    awk "{print \$2}"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:690
                                                                                                                                                                                                    • /usr/bin/xargs
                                                                                                                                                                                                      xargs -i kill -9 "{}"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:691
                                                                                                                                                                                                      • /bin/ps
                                                                                                                                                                                                        ps aux
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Reads CPU attributes
                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                        PID:692
                                                                                                                                                                                                      • /bin/grep
                                                                                                                                                                                                        grep -v 202.28.229.174
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:693
                                                                                                                                                                                                        • /bin/grep
                                                                                                                                                                                                          grep -v grep
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:694
                                                                                                                                                                                                          • /bin/grep
                                                                                                                                                                                                            grep -v 192.157.86
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:695
                                                                                                                                                                                                            • /bin/grep
                                                                                                                                                                                                              grep -v iosk
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:696
                                                                                                                                                                                                              • /bin/grep
                                                                                                                                                                                                                grep -v g4mm4
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:697
                                                                                                                                                                                                                • /bin/grep
                                                                                                                                                                                                                  grep urlopen
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:698
                                                                                                                                                                                                                  • /usr/bin/awk
                                                                                                                                                                                                                    awk "{print \$2}"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:699
                                                                                                                                                                                                                    • /usr/bin/xargs
                                                                                                                                                                                                                      xargs -i kill -9 "{}"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:700

                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                    Downloads