4be5eb2191071fdf496ff4df7a570d03dc9114190df1614c0a18465a48a8079d

Analysis

max time kernel
4800s
max time network
125s
platform
debian-9_mipsel
resource
debian9-mipsel-20221111-en
resource tags

arch:mipselimage:debian9-mipsel-20221111-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
06/01/2023, 07:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/c/go
Size

398B
MD5

1553384ee57751af771a9389b7393b93
SHA1

e33a67fde9cf13c077da652fbdec07957fff2372
SHA256

98dffdabf9caf512c8c9090e8c9b77a04d6ce31bbd13afe4f09668a4f2eacc2f
SHA512

d406796ebae8bf724f7c18371ba6d86ef491ad0745dd64d0eaaffee9daca3954d9429c8c4e87c404338b839b47a30a6791ef25663239e4a5f0ea5113fa9b6b49

Score

5^/10

Malware Config

Signatures

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/.rsync/c/go	/tmp/.rsync/c/go	go
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm
/tmp/	/tmp/	go
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm
/tmp/t*	/tmp/t*	rm

/tmp/.rsync/c/go
/tmp/.rsync/c/go
1⤵
- Writes file to tmp directory
PID:327
- /bin/uname
  uname -m
  2⤵
  PID:329
- /usr/bin/touch
  touch v
  2⤵
  PID:331
- /bin/rm
  rm -rf p
  2⤵
  PID:335
- /bin/rm
  rm -rf ip
  2⤵
  PID:336
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:337
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:338
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:339
- /bin/sleep
  sleep 5s
  2⤵
  PID:340
- /usr/bin/timeout
  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:341
- - ./tsm
    ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:342
- /bin/sleep
  sleep 3
  2⤵
  PID:343
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:344
- /bin/rm
  rm -rf ip
  2⤵
  PID:345
- /bin/rm
  rm -rf p
  2⤵
  PID:346
- /bin/rm
  rm -rf .out
  2⤵
  PID:347
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:348
- /usr/bin/touch
  touch v
  2⤵
  PID:349
- /bin/rm
  rm -rf p
  2⤵
  PID:350
- /bin/rm
  rm -rf ip
  2⤵
  PID:351
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:352
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:353
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:354
- /bin/sleep
  sleep 13s
  2⤵
  PID:355
- /usr/bin/timeout
  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:356
- - ./tsm
    ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:357
- /bin/sleep
  sleep 3
  2⤵
  PID:358
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:359
- /bin/rm
  rm -rf ip
  2⤵
  PID:360
- /bin/rm
  rm -rf p
  2⤵
  PID:361
- /bin/rm
  rm -rf .out
  2⤵
  PID:362
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:363
- /usr/bin/touch
  touch v
  2⤵
  PID:364
- /bin/rm
  rm -rf p
  2⤵
  PID:365
- /bin/rm
  rm -rf ip
  2⤵
  PID:366
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:367
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:368
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:369
- /bin/sleep
  sleep 5s
  2⤵
  PID:370
- /usr/bin/timeout
  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:371
- - ./tsm
    ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:372
- /bin/sleep
  sleep 3
  2⤵
  PID:373
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:374
- /bin/rm
  rm -rf ip
  2⤵
  PID:375
- /bin/rm
  rm -rf p
  2⤵
  PID:376
- /bin/rm
  rm -rf .out
  2⤵
  PID:377
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:378
- /usr/bin/touch
  touch v
  2⤵
  PID:379
- /bin/rm
  rm -rf p
  2⤵
  PID:380
- /bin/rm
  rm -rf ip
  2⤵
  PID:381
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:382
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:383
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:384
- /bin/sleep
  sleep 17s
  2⤵
  PID:385
- /usr/bin/timeout
  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:386
- - ./tsm
    ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:387
- /bin/sleep
  sleep 3
  2⤵
  PID:388
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:389
- /bin/rm
  rm -rf ip
  2⤵
  PID:390
- /bin/rm
  rm -rf p
  2⤵
  PID:391
- /bin/rm
  rm -rf .out
  2⤵
  PID:392
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:393
- /usr/bin/touch
  touch v
  2⤵
  PID:394
- /bin/rm
  rm -rf p
  2⤵
  PID:395
- /bin/rm
  rm -rf ip
  2⤵
  PID:396
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:397
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:398
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:399
- /bin/sleep
  sleep 2s
  2⤵
  PID:400
- /usr/bin/timeout
  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:401
- - ./tsm
    ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:402
- /bin/sleep
  sleep 3
  2⤵
  PID:403
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:404
- /bin/rm
  rm -rf ip
  2⤵
  PID:405
- /bin/rm
  rm -rf p
  2⤵
  PID:406
- /bin/rm
  rm -rf .out
  2⤵
  PID:407
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:408
- /usr/bin/touch
  touch v
  2⤵
  PID:409
- /bin/rm
  rm -rf p
  2⤵
  PID:410
- /bin/rm
  rm -rf ip
  2⤵
  PID:411
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:412
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:413
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:414
- /bin/sleep
  sleep 12s
  2⤵
  PID:415
- /usr/bin/timeout
  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:416
- - ./tsm
    ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:417
- /bin/sleep
  sleep 3
  2⤵
  PID:418
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:419
- /bin/rm
  rm -rf ip
  2⤵
  PID:420
- /bin/rm
  rm -rf p
  2⤵
  PID:421
- /bin/rm
  rm -rf .out
  2⤵
  PID:422
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:423
- /usr/bin/touch
  touch v
  2⤵
  PID:424
- /bin/rm
  rm -rf p
  2⤵
  PID:425
- /bin/rm
  rm -rf ip
  2⤵
  PID:426
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:427
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:428
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:429
- /bin/sleep
  sleep 7s
  2⤵
  PID:430
- /usr/bin/timeout
  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:431
- - ./tsm
    ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:432
- /bin/sleep
  sleep 3
  2⤵
  PID:433
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:434
- /bin/rm
  rm -rf ip
  2⤵
  PID:435
- /bin/rm
  rm -rf p
  2⤵
  PID:436
- /bin/rm
  rm -rf .out
  2⤵
  PID:437
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:438
- /usr/bin/touch
  touch v
  2⤵
  PID:439
- /bin/rm
  rm -rf p
  2⤵
  PID:440
- /bin/rm
  rm -rf ip
  2⤵
  PID:441
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:442
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:443
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:444
- /bin/sleep
  sleep 4s
  2⤵
  PID:445
- /usr/bin/timeout
  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:446
- - ./tsm
    ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:447
- /bin/sleep
  sleep 3
  2⤵
  PID:448
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:449
- /bin/rm
  rm -rf ip
  2⤵
  PID:450
- /bin/rm
  rm -rf p
  2⤵
  PID:451
- /bin/rm
  rm -rf .out
  2⤵
  PID:452
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:453
- /usr/bin/touch
  touch v
  2⤵
  PID:454
- /bin/rm
  rm -rf p
  2⤵
  PID:455
- /bin/rm
  rm -rf ip
  2⤵
  PID:456
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:457
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:458
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:459
- /bin/sleep
  sleep 3s
  2⤵
  PID:460
- /usr/bin/timeout
  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:461
- - ./tsm
    ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:462
- /bin/sleep
  sleep 3
  2⤵
  PID:463
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:464
- /bin/rm
  rm -rf ip
  2⤵
  PID:465
- /bin/rm
  rm -rf p
  2⤵
  PID:466
- /bin/rm
  rm -rf .out
  2⤵
  PID:467
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:468
- /usr/bin/touch
  touch v
  2⤵
  PID:469
- /bin/rm
  rm -rf p
  2⤵
  PID:470
- /bin/rm
  rm -rf ip
  2⤵
  PID:471
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:472
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:473
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:474
- /bin/sleep
  sleep 22s
  2⤵
  PID:475
- /usr/bin/timeout
  timeout 24h ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
  2⤵
  PID:502
- - ./tsm
    ./tsm -t 505 -f 1 -s 12 -S 8 -p 0 -d 1 p ip
    3⤵
    PID:503
- /bin/sleep
  sleep 3
  2⤵
  PID:504
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:505
- /bin/rm
  rm -rf ip
  2⤵
  PID:506
- /bin/rm
  rm -rf p
  2⤵
  PID:507
- /bin/rm
  rm -rf .out
  2⤵
  PID:508
- /bin/rm
  rm -rf "/tmp/t*"
  2⤵
  - Writes file to tmp directory
  PID:509
- /usr/bin/touch
  touch v
  2⤵
  PID:510
- /bin/rm
  rm -rf p
  2⤵
  PID:511
- /bin/rm
  rm -rf ip
  2⤵
  PID:512
- /bin/rm
  rm -rf "xtr*"
  2⤵
  PID:513
- /bin/rm
  rm -rf a "a.*"
  2⤵
  PID:514
- /bin/rm
  rm -rf b "b.*"
  2⤵
  PID:515

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads