4be5eb2191071fdf496ff4df7a570d03dc9114190df1614c0a18465a48a8079d

Analysis

max time kernel
4800s
max time network
105s
platform
debian-9_armhf
resource
debian9-armhf-20221111-en
resource tags

arch:armhfimage:debian9-armhf-20221111-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
06-01-2023 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/c/go
Size

398B
MD5

1553384ee57751af771a9389b7393b93
SHA1

e33a67fde9cf13c077da652fbdec07957fff2372
SHA256

98dffdabf9caf512c8c9090e8c9b77a04d6ce31bbd13afe4f09668a4f2eacc2f
SHA512

d406796ebae8bf724f7c18371ba6d86ef491ad0745dd64d0eaaffee9daca3954d9429c8c4e87c404338b839b47a30a6791ef25663239e4a5f0ea5113fa9b6b49

Score

5^/10

Malware Config

Signatures

Writes file to tmp directory 9 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/t*	/tmp/t*	rm
/tmp/	/tmp/	go
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm
/tmp/.rsync/c/go	/tmp/.rsync/c/go	go
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm

/tmp/.rsync/c/go
/tmp/.rsync/c/go
1⤵
- Writes file to tmp directory
PID:360
- /bin/uname
  uname -m
  2⤵
  PID:363
- /usr/bin/touch
  touch v
  2⤵
  PID:367
- /bin/rm
  rm -rf p
  2⤵
  PID:368
- /bin/rm
  rm -rf ip
  2⤵
  PID:369
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:370
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:371
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:372
- /bin/sleep
  sleep 25s
  2⤵
  PID:373
- /usr/bin/timeout
  timeout 24h ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:479
- - ./tsm
    ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:480
- /bin/sleep
  sleep 3
  2⤵
  PID:481
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:482
- /bin/rm
  rm -rf ip
  2⤵
  PID:483
- /bin/rm
  rm -rf p
  2⤵
  PID:484
- /bin/rm
  rm -rf .out
  2⤵
  PID:485
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:486
- /usr/bin/touch
  touch v
  2⤵
  PID:487
- /bin/rm
  rm -rf p
  2⤵
  PID:488
- /bin/rm
  rm -rf ip
  2⤵
  PID:489
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:490
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:491
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:492
- /bin/sleep
  sleep 2s
  2⤵
  PID:493
- /usr/bin/timeout
  timeout 24h ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:494
- - ./tsm
    ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:495
- /bin/sleep
  sleep 3
  2⤵
  PID:496
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:499
- /bin/rm
  rm -rf ip
  2⤵
  PID:500
- /bin/rm
  rm -rf p
  2⤵
  PID:501
- /bin/rm
  rm -rf .out
  2⤵
  PID:502
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:503
- /usr/bin/touch
  touch v
  2⤵
  PID:504
- /bin/rm
  rm -rf p
  2⤵
  PID:505
- /bin/rm
  rm -rf ip
  2⤵
  PID:506
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:507
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:508
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:509
- /bin/sleep
  sleep 12s
  2⤵
  PID:510
- /usr/bin/timeout
  timeout 24h ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:513
- - ./tsm
    ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:514
- /bin/sleep
  sleep 3
  2⤵
  PID:515
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:516
- /bin/rm
  rm -rf ip
  2⤵
  PID:517
- /bin/rm
  rm -rf p
  2⤵
  PID:518
- /bin/rm
  rm -rf .out
  2⤵
  PID:519
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:520
- /usr/bin/touch
  touch v
  2⤵
  PID:521
- /bin/rm
  rm -rf p
  2⤵
  PID:522
- /bin/rm
  rm -rf ip
  2⤵
  PID:523
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:524
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:525
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:526
- /bin/sleep
  sleep 11s
  2⤵
  PID:527
- /usr/bin/timeout
  timeout 24h ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:530
- - ./tsm
    ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:531
- /bin/sleep
  sleep 3
  2⤵
  PID:532
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:535
- /bin/rm
  rm -rf ip
  2⤵
  PID:536
- /bin/rm
  rm -rf p
  2⤵
  PID:537
- /bin/rm
  rm -rf .out
  2⤵
  PID:538
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:539
- /usr/bin/touch
  touch v
  2⤵
  PID:540
- /bin/rm
  rm -rf p
  2⤵
  PID:541
- /bin/rm
  rm -rf ip
  2⤵
  PID:542
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:543
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:544
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:545
- /bin/sleep
  sleep 14s
  2⤵
  PID:546
- /usr/bin/timeout
  timeout 24h ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:549
- - ./tsm
    ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:550
- /bin/sleep
  sleep 3
  2⤵
  PID:551
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:552
- /bin/rm
  rm -rf ip
  2⤵
  PID:553
- /bin/rm
  rm -rf p
  2⤵
  PID:554
- /bin/rm
  rm -rf .out
  2⤵
  PID:555
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:556
- /usr/bin/touch
  touch v
  2⤵
  PID:557
- /bin/rm
  rm -rf p
  2⤵
  PID:558
- /bin/rm
  rm -rf ip
  2⤵
  PID:559
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:560
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:561
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:562
- /bin/sleep
  sleep 27s
  2⤵
  PID:563
- /usr/bin/timeout
  timeout 24h ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:570
- - ./tsm
    ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:571
- /bin/sleep
  sleep 3
  2⤵
  PID:572
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:573
- /bin/rm
  rm -rf ip
  2⤵
  PID:574
- /bin/rm
  rm -rf p
  2⤵
  PID:575
- /bin/rm
  rm -rf .out
  2⤵
  PID:576
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:577
- /usr/bin/touch
  touch v
  2⤵
  PID:578
- /bin/rm
  rm -rf p
  2⤵
  PID:579
- /bin/rm
  rm -rf ip
  2⤵
  PID:580
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:581
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:582
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:583
- /bin/sleep
  sleep 30s
  2⤵
  PID:584
- /usr/bin/timeout
  timeout 24h ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:591
- - ./tsm
    ./tsm -t 75 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:592
- /bin/sleep
  sleep 3
  2⤵
  PID:593
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:594
- /bin/rm
  rm -rf ip
  2⤵
  PID:595
- /bin/rm
  rm -rf p
  2⤵
  PID:596
- /bin/rm
  rm -rf .out
  2⤵
  PID:597
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:598
- /usr/bin/touch
  touch v
  2⤵
  PID:599
- /bin/rm
  rm -rf p
  2⤵
  PID:600
- /bin/rm
  rm -rf ip
  2⤵
  PID:601
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:602
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:603
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:604

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads