105e32c8ef13d4d001923c1a43a8849d069fc4adebe48e5e6a9e726eb605ce31

Analysis

max time kernel
11s
platform
debian-9_armhf
resource
debian9-armhf-20240226-en
resource tags

arch:armhfimage:debian9-armhf-20240226-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
07/03/2024, 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/b/a
Size

157B
MD5

17dfec62acb9bc298bb333fbe391f486
SHA1

960fdc0a9c8dd4879c96ec76f69a9dedc6ec9795
SHA256

dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920
SHA512

21d49249ca656d3f6ce7a77876796590ae66d31963a6cdf65bb294ca45372e68686f8f7fd846035ed53f1155962447a8054bf2ea081e02fbb4b3fa1b6e376881

Score

7^/10

Malware Config

Signatures

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	rsync	740	perl

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 19 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/574/stat	ps
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/273/stat	killall
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/637/cmdline	ps
File opened for reading	/proc/110/cmdline	pkill
File opened for reading	/proc/595/stat	killall
File opened for reading	/proc/138/stat	killall
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/168/stat	killall
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/138/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/751/status	ps
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/633/stat	killall
File opened for reading	/proc/273/status	ps
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/316/cmdline	ps
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/19/stat	ps
File opened for reading	/proc/3/status	ps
File opened for reading	/proc/110/status	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/677/cmdline	pkill
File opened for reading	/proc/138/status	ps
File opened for reading	/proc/640/stat	ps
File opened for reading	/proc/109/cmdline	ps
File opened for reading	/proc/595/stat	ps
File opened for reading	/proc/20/stat	ps
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/643/cmdline	ps
File opened for reading	/proc/643/cmdline	ps
File opened for reading	/proc/736/status	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/209/stat	ps
File opened for reading	/proc/311/cmdline	ps
File opened for reading	/proc/640/cmdline	pkill
File opened for reading	/proc/19/status	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/695/cmdline	ps
File opened for reading	/proc/707/stat	ps
File opened for reading	/proc/76/status	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/3/stat	ps
File opened for reading	/proc/311/cmdline	ps
File opened for reading	/proc/142/cmdline	pkill
File opened for reading	/proc/646/status	ps
File opened for reading	/proc/20/cmdline	ps
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/633/stat	killall
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/721/stat	ps
File opened for reading	/proc/150/stat	killall
File opened for reading	/proc/595/cmdline	pkill

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.rsync/b/dir.dir	a
File opened for modification	/tmp/.rsync/b/sync	a
File opened for modification	/tmp/.rsync/b/.out	stop

/tmp/.rsync/b/a
/tmp/.rsync/b/a
1⤵
- Writes file to tmp directory
PID:660
- /bin/cat
  cat dir.dir
  2⤵
  PID:662
- /tmp/.rsync/b/stop
  ./stop
  2⤵
  PID:664
- /bin/chmod
  chmod u+x sync
  2⤵
  PID:665
- /bin/chmod
  chmod u+x stop
  2⤵
  PID:670
- /bin/chmod
  chmod u+x ps
  2⤵
  PID:672
- /bin/chmod
  chmod u+x run
  2⤵
  PID:673
- /tmp/.rsync/b/run
  ./run
  2⤵
  PID:674
- - /usr/bin/nohup
    nohup ./stop
    3⤵
    PID:676
- - /bin/sleep
    sleep 5
    3⤵
    PID:677
- - /tmp/.rsync/b/stop
    ./stop
    3⤵
    - Writes file to tmp directory
    PID:676
  - - /usr/bin/killall
      killall -9 rsync
      4⤵
      Reads runtime system information
      PID:678
  - - /usr/bin/killall
      killall -9 sync
      4⤵
      Reads runtime system information
      PID:679
  - - /usr/bin/killall
      killall -9 perl
      4⤵
      Reads runtime system information
      PID:681
  - - /usr/bin/killall
      killall -9 ps
      4⤵
      PID:682
  - - /usr/bin/killall
      killall -9 pool
      4⤵
      Reads runtime system information
      PID:683
  - - /usr/bin/killall
      killall -9 nginx
      4⤵
      Reads runtime system information
      PID:684
  - - /usr/bin/killall
      killall -9 ecryptfs
      4⤵
      Reads runtime system information
      PID:685
  - - /usr/bin/killall
      killall -9 xmr
      4⤵
      Reads runtime system information
      PID:686
  - - /usr/bin/pkill
      pkill -9 ps
      4⤵
      Reads CPU attributes
      PID:687
  - - /usr/bin/pkill
      pkill -9 pool
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:688
  - - /usr/bin/pkill
      pkill -9 nginx
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:689
  - - /usr/bin/pkill
      pkill -9 ecryptfs
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:690
  - - /usr/bin/pkill
      pkill -9 xmr
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:691
  - - /usr/bin/pkill
      pkill -9 sync
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:692
  - - /usr/bin/pkill
      pkill -9 rsync
      4⤵
      Reads CPU attributes
      PID:766
  - - /usr/bin/pkill
      pkill -9 perl
      4⤵
      Reads CPU attributes
      PID:768
  - - /usr/bin/pkill
      pkill -9 ps
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:770
  - - /bin/rm
      rm -rf .proc .out
      4⤵
      PID:772
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:739
- - /usr/bin/perl
    perl
    3⤵
    - Changes its process name
    PID:740
  - - /usr/local/sbin/uname
      uname -a
      4⤵
      PID:759
  - - /usr/local/bin/uname
      uname -a
      4⤵
      PID:759
  - - /usr/sbin/uname
      uname -a
      4⤵
      PID:759
  - - /usr/bin/uname
      uname -a
      4⤵
      PID:759
  - - /sbin/uname
      uname -a
      4⤵
      PID:759
  - - /bin/uname
      uname -a
      4⤵
      PID:759
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:763
- - /usr/bin/perl
    perl
    3⤵
    PID:764

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:694

/bin/grep
grep ps
1⤵
PID:695

/bin/grep
grep -v grep
1⤵
PID:696

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:697

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:699

/bin/grep
grep sync
1⤵
PID:700

/bin/grep
grep -v grep
1⤵
PID:701

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:702

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:706

/bin/grep
grep nginx
1⤵
PID:707

/bin/grep
grep -v grep
1⤵
PID:708

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:709

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:713

/bin/grep
grep ecryptfs
1⤵
PID:714

/bin/grep
grep -v grep
1⤵
PID:715

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:716

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:719

/bin/grep
grep xmr
1⤵
PID:720

/bin/grep
grep -v grep
1⤵
PID:721

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:722

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:726

/bin/grep
grep perl
1⤵
PID:727

/bin/grep
grep -v grep
1⤵
PID:728

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:729

/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:733

/bin/grep
grep rsync
1⤵
PID:734

/bin/grep
grep -v grep
1⤵
PID:735

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:736

/bin/ps
ps -ef
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:743

/bin/grep
grep rsync
1⤵
PID:744

/usr/bin/awk
awk "{print \$2}"
1⤵
PID:745

/bin/ps
ps -ef
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:749

/bin/grep
grep sync
1⤵
PID:750

/usr/bin/awk
awk "{print \$2}"
1⤵
PID:751

/bin/ps
ps -ef
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:755

/bin/grep
grep ps
1⤵
PID:756

/usr/bin/awk
awk "{print \$2}"
1⤵
PID:757

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.rsync/b/dir.dir

Filesize
14B

MD5
e21fb1889e57316ccbd97f98e1282a54

SHA1
ee8de521fb7ae11f81615ce31a45b5f7a79feee8

SHA256
8e0465a977658aca8fe06bec84742ed7c298db88cba64fc87de85409c6c909e8

SHA512
3ac5bf18363442ea8e4f478b2595a5e13199d80378c82f2ffeacb03cf64cf30c5e82c9a618d2a0f2d9d5386aeb1576e154e654eb20fc6967a43472f3f5047445

Download Submit
/tmp/.rsync/b/sync

Filesize
33B

MD5
a0eea5d0b1c4743cc7b8c798399581e0

SHA1
bf30ba5824c9ec612aa4654eb895e3cb738b4e18

SHA256
7602dd04cbfa214345d0ae0b2ee26ed6475ea4d9053575cb99e29b956f536d0e

SHA512
9e70bc0608f42b83712d5e2911d21e6ab627c830d0ae4b8fa5e0eeea6555bc4cce49d7fafdea28a1888b55b28461cab34153dee3746bc084c1e8a296f849d06f

Download Submit