4be5eb2191071fdf496ff4df7a570d03dc9114190df1614c0a18465a48a8079d

Analysis

max time kernel
0s
max time network
103s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
06/01/2023, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/c/run
Size

489B
MD5

97a962fb5bd427e09547ecaaf850e034
SHA1

3040ea8bc3226af1fc201c4fefcca17b62184bbe
SHA256

5a1797ae845e8c80c771ece9174b93ad5d5a74e593fe3b508ba105830db5fd92
SHA512

2ed6bad217478913a053fbcad37c904dddacee424ce39115c15019477870582b0d53da908783047cf9069df0a011387b3fba336385ff392ab0be84cd49d04001

Score

9^/10

antivm

Malware Config

Signatures

Attempts to identify hypervisor via CPU configuration 1 TTPs 1 IoCs

Checks CPU information for indicators that the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
/proc/cpuinfo	/proc/cpuinfo	cat

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/.rsync/c/run	/tmp/.rsync/c/run	run

/tmp/.rsync/c/run
/tmp/.rsync/c/run
1⤵
- Writes file to tmp directory
PID:593
- /bin/uname
  uname -m
  2⤵
  PID:599
- /bin/sleep
  sleep 15
  2⤵
  PID:600
- ./stop
  ./stop
  2⤵
  PID:605
- /bin/sleep
  sleep 3
  2⤵
  PID:606

/bin/cat
cat /proc/cpuinfo
1⤵
- Attempts to identify hypervisor via CPU configuration
PID:595

/bin/grep
grep model
1⤵
PID:596

/bin/grep
grep name
1⤵
PID:597

/usr/bin/wc
wc -l
1⤵
PID:598

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads