170e3e987e99867d8b4115b4a2d9dea074acb56383744d469a28c5611adeba22

Analysis

max time kernel
0s
max time network
157s
platform
debian-9_mipsel
resource
debian9-mipsel-20221111-en
resource tags

arch:mipselimage:debian9-mipsel-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/12/2022, 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/a/a
Size

2KB
MD5

8c6ef74d130a7ae226c5e7ce7e6e3a75
SHA1

69ea2b646de672a12e8f59137ed0a8403a1427c2
SHA256

834a8f8462a021c50f346fdd91f86c64cb8aa5abbae0802b15137191013be492
SHA512

131e734db073374193ac7cc1b9f5b9e2aa2eff11b654b1196743cca1d4b0f468dab9ed6713cdc8b33c067c335088dcc94439063ed6e7ed3cd29a189bc1ce5280

Score

9^/10

antivm

Malware Config

Signatures

Attempts to identify hypervisor via CPU configuration 1 TTPs 2 IoCs

Checks CPU information for indicators that the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
/proc/cpuinfo	/proc/cpuinfo	grep
/proc/cpuinfo	/proc/cpuinfo	grep

Reads CPU attributes 1 TTPs 13 IoCs

System Information Discovery

T1082

description	ioc	Process
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	sysctl
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	pkill
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps
/sys/devices/system/cpu/online	/sys/devices/system/cpu/online	ps

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc
/sys/devices/system/node	/sys/devices/system/node

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/sys/kernel/osrelease	/proc/sys/kernel/osrelease	ps
/proc/17/status	/proc/17/status	pkill
/proc/281/cmdline	/proc/281/cmdline	pkill
/proc/74/cmdline	/proc/74/cmdline	pkill
/proc/11/stat	/proc/11/stat	ps
/proc/105/status	/proc/105/status	pkill
/proc/37/cmdline	/proc/37/cmdline	pkill
/proc/300/cmdline	/proc/300/cmdline	pkill
/proc/81/status	/proc/81/status	ps
/proc/2/status	/proc/2/status	ps
/proc/81/status	/proc/81/status	pkill
/proc/15/cmdline	/proc/15/cmdline	pkill
/proc/37/cmdline	/proc/37/cmdline	ps
/proc/138/stat	/proc/138/stat	ps
/proc/tty/drivers	/proc/tty/drivers	ps
/proc/6/status	/proc/6/status	pkill
/proc/12/stat	/proc/12/stat	ps
/proc/321/cmdline	/proc/321/cmdline	pkill
/proc/7/status	/proc/7/status	ps
/proc/2/stat	/proc/2/stat	ps
/proc/36/stat	/proc/36/stat	ps
/proc/18/cmdline	/proc/18/cmdline	ps
/proc/218/status	/proc/218/status	pkill
/proc/8/cmdline	/proc/8/cmdline	pkill
/proc/105/cmdline	/proc/105/cmdline	ps
/proc/321/cmdline	/proc/321/cmdline	ps
/proc/22/status	/proc/22/status	pkill
/proc/14/stat	/proc/14/stat	ps
/proc/206/stat	/proc/206/stat	ps
/proc/73/status	/proc/73/status	pkill
/proc/321/status	/proc/321/status	ps
/proc/115/status	/proc/115/status	ps
/proc/385/fd	/proc/385/fd	ssh
/proc/23/cmdline	/proc/23/cmdline	ps
/proc/2/cmdline	/proc/2/cmdline	pkill
/proc/81/status	/proc/81/status	pkill
/proc/37/status	/proc/37/status	ps
/proc/5/stat	/proc/5/stat	ps
/proc/13/cmdline	/proc/13/cmdline	ps
/proc/300/status	/proc/300/status	ps
/proc/357/stat	/proc/357/stat	ps
/proc/145/status	/proc/145/status	pkill
/proc/16/cmdline	/proc/16/cmdline	pkill
/proc/115/status	/proc/115/status	ps
/proc/218/status	/proc/218/status	ps
/proc/6/status	/proc/6/status	pkill
/proc/251/cmdline	/proc/251/cmdline	pkill
/proc/76/status	/proc/76/status	ps
/proc/12/stat	/proc/12/stat	ps
/proc/3/cmdline	/proc/3/cmdline	ps
/proc/300/stat	/proc/300/stat	ps
/proc/9/cmdline	/proc/9/cmdline	pkill
/proc/17/status	/proc/17/status	ps
/proc/75/status	/proc/75/status	ps
/proc/81/cmdline	/proc/81/cmdline	ps
/proc/10/cmdline	/proc/10/cmdline	pkill
/proc/145/status	/proc/145/status	pkill
/proc/20/stat	/proc/20/stat	ps
/proc/19/cmdline	/proc/19/cmdline	pkill
/proc/24/cmdline	/proc/24/cmdline	ps
/proc/70/stat	/proc/70/stat	ps
/proc/76/status	/proc/76/status	pkill
/proc/6/cmdline	/proc/6/cmdline	ps
/proc/37/cmdline	/proc/37/cmdline	ps

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/.rsync/a/a	/tmp/.rsync/a/a	a

/tmp/.rsync/a/a
/tmp/.rsync/a/a
1⤵
- Writes file to tmp directory
PID:323
- /usr/bin/crontab
  crontab -r
  2⤵
  PID:324
- /bin/cat
  cat dir.dir
  2⤵
  PID:325
- ./init0
  ./init0
  2⤵
  PID:326
- /bin/sleep
  sleep 5
  2⤵
  PID:327
- /usr/bin/id
  id -u
  2⤵
  PID:332
- /sbin/modprobe
  modprobe msr "allow_writes=on"
  2⤵
  PID:333
- /bin/grep
  grep -E "AMD Ryzen|AMD EPYC" /proc/cpuinfo
  2⤵
  - Attempts to identify hypervisor via CPU configuration
  PID:334
- /bin/grep
  grep Intel /proc/cpuinfo
  2⤵
  - Attempts to identify hypervisor via CPU configuration
  PID:335
- /usr/bin/nproc
  nproc
  2⤵
  PID:336
- /sbin/sysctl
  sysctl -w "vm.nr_hugepages=1"
  2⤵
  - Reads CPU attributes
  PID:337
- /usr/bin/find
  find "/sys/devices/system/node/node*" -maxdepth 0 -type d
  2⤵
  PID:338
- /bin/chmod
  chmod u+x upd
  2⤵
  PID:339
- /bin/chmod
  chmod 777 a dir.dir init0 kswapd0 run stop tors upd
  2⤵
  PID:340
- ./upd
  ./upd
  2⤵
  PID:341
- - ./run
    ./run
    3⤵
    PID:342
  - - ./stop
      ./stop
      4⤵
      PID:343
    - - /usr/bin/chattr
        
        chattr -ia "~/.xmrig.json"
        5⤵
        
        PID:344
    - - /bin/rm
        
        rm -rf "~/.xmrig.json"
        5⤵
        
        PID:345
    - - /usr/bin/pkill
        
        pkill -9 cron
        5⤵
        Reads CPU attributes
        Reads runtime system information
        
        PID:346
    - - /usr/bin/pkill
        
        pkill -9 kswapd0
        5⤵
        Reads CPU attributes
        Reads runtime system information
        
        PID:353
    - - /usr/bin/pkill
        
        pkill -9 ld-linux
        5⤵
        Reads CPU attributes
        Reads runtime system information
        
        PID:359
    - - /usr/bin/pkill
        
        pkill -9 Donald
        5⤵
        Reads CPU attributes
        Reads runtime system information
        
        PID:365
    - - /usr/bin/pkill
        
        pkill -9 xmr
        5⤵
        Reads CPU attributes
        
        PID:371
    - - /usr/bin/pkill
        
        pkill -9 xm64
        5⤵
        Reads CPU attributes
        Reads runtime system information
        
        PID:377
    - - /bin/rm
        
        rm -rf .proc
        5⤵
        
        PID:383
  - - ./tors/start.sh
      ./tors/start.sh 1
      4⤵
      PID:386
  - - /bin/sleep
      sleep 10
      4⤵
      PID:387
  - - /bin/cat
      cat dir.dir
      4⤵
      PID:388
  - - /usr/bin/nohup
      nohup ./kswapd0
      4⤵
      PID:389
  - - ./kswapd0
      ./kswapd0
      4⤵
      PID:389
  - - /bin/sh
      /bin/sh ./kswapd0
      4⤵
      PID:389

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:349

/bin/grep
grep cron
1⤵
PID:350

/bin/grep
grep -v grep
1⤵
PID:351

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:352

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:355

/bin/grep
grep kswapd0
1⤵
PID:356

/bin/grep
grep -v grep
1⤵
PID:357

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:358

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:361

/bin/grep
grep ld-linux
1⤵
PID:362

/bin/grep
grep -v grep
1⤵
PID:363

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:364

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:367

/bin/grep
grep -v grep
1⤵
PID:369

/bin/grep
grep Donald
1⤵
PID:368

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:370

/bin/grep
grep xmr
1⤵
PID:374

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:373

/bin/grep
grep -v grep
1⤵
PID:375

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:376

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:379

/bin/grep
grep xm64
1⤵
PID:380

/bin/grep
grep -v grep
1⤵
PID:381

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:382

/usr/bin/ssh
ssh -q -o "BatchMode=yes" -o "ConnectTimeout=5" 45.9.148.228 "echo 2>&1"
1⤵
- Reads runtime system information
PID:385

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads