Analysis

  • max time kernel
    27s
  • platform
    debian-9_mips
  • resource
    debian9-mipsbe-20240226-en
  • resource tags

    arch:mipsimage:debian9-mipsbe-20240226-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
  • submitted
    07-03-2024 18:02

General

  • Target

    .rsync/b/a

  • Size

    157B

  • MD5

    17dfec62acb9bc298bb333fbe391f486

  • SHA1

    960fdc0a9c8dd4879c96ec76f69a9dedc6ec9795

  • SHA256

    dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920

  • SHA512

    21d49249ca656d3f6ce7a77876796590ae66d31963a6cdf65bb294ca45372e68686f8f7fd846035ed53f1155962447a8054bf2ea081e02fbb4b3fa1b6e376881

Score
6/10

Malware Config

Signatures

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 19 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 3 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/.rsync/b/a
    /tmp/.rsync/b/a
    1⤵
    • Writes file to tmp directory
    PID:711
    • /bin/cat
      cat dir.dir
      2⤵
        PID:713
      • /tmp/.rsync/b/stop
        ./stop
        2⤵
          PID:716
        • /bin/chmod
          chmod u+x sync
          2⤵
            PID:718
          • /bin/chmod
            chmod u+x stop
            2⤵
              PID:720
            • /bin/chmod
              chmod u+x ps
              2⤵
                PID:722
              • /bin/chmod
                chmod u+x run
                2⤵
                  PID:723
                • /tmp/.rsync/b/run
                  ./run
                  2⤵
                    PID:724
                    • /usr/bin/nohup
                      nohup ./stop
                      3⤵
                        PID:725
                      • /bin/sleep
                        sleep 5
                        3⤵
                          PID:726
                        • /tmp/.rsync/b/stop
                          ./stop
                          3⤵
                          • Writes file to tmp directory
                          PID:725
                          • /usr/bin/killall
                            killall -9 rsync
                            4⤵
                              PID:728
                            • /usr/bin/killall
                              killall -9 sync
                              4⤵
                              • Reads runtime system information
                              PID:731
                            • /usr/bin/killall
                              killall -9 perl
                              4⤵
                                PID:732
                              • /usr/bin/killall
                                killall -9 ps
                                4⤵
                                • Reads runtime system information
                                PID:733
                              • /usr/bin/killall
                                killall -9 pool
                                4⤵
                                • Reads runtime system information
                                PID:735
                              • /usr/bin/killall
                                killall -9 nginx
                                4⤵
                                  PID:736
                                • /usr/bin/killall
                                  killall -9 ecryptfs
                                  4⤵
                                  • Reads runtime system information
                                  PID:737
                                • /usr/bin/killall
                                  killall -9 xmr
                                  4⤵
                                  • Reads runtime system information
                                  PID:738
                                • /usr/bin/pkill
                                  pkill -9 ps
                                  4⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:740
                                • /usr/bin/pkill
                                  pkill -9 pool
                                  4⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:741
                                • /usr/bin/pkill
                                  pkill -9 nginx
                                  4⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:742
                                • /usr/bin/pkill
                                  pkill -9 ecryptfs
                                  4⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:743
                                • /usr/bin/pkill
                                  pkill -9 xmr
                                  4⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:744
                                • /usr/bin/pkill
                                  pkill -9 sync
                                  4⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:745
                                • /usr/bin/pkill
                                  pkill -9 rsync
                                  4⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:799
                                • /usr/bin/pkill
                                  pkill -9 perl
                                  4⤵
                                  • Reads CPU attributes
                                  PID:800
                                • /usr/bin/pkill
                                  pkill -9 ps
                                  4⤵
                                  • Reads CPU attributes
                                  • Reads runtime system information
                                  PID:801
                                • /bin/rm
                                  rm -rf .proc .out
                                  4⤵
                                    PID:802
                                • /usr/bin/base64
                                  base64 --decode
                                  3⤵
                                    PID:752
                                  • /usr/bin/perl
                                    perl
                                    3⤵
                                      PID:753
                                    • /usr/bin/base64
                                      base64 --decode
                                      3⤵
                                        PID:785
                                      • /usr/bin/perl
                                        perl
                                        3⤵
                                          PID:786
                                    • /bin/ps
                                      ps x
                                      1⤵
                                      • Reads CPU attributes
                                      • Reads runtime system information
                                      PID:747
                                    • /bin/grep
                                      grep ps
                                      1⤵
                                        PID:748
                                      • /bin/grep
                                        grep -v grep
                                        1⤵
                                          PID:749
                                        • /usr/bin/awk
                                          awk "{print \$1}"
                                          1⤵
                                            PID:750
                                          • /bin/ps
                                            ps x
                                            1⤵
                                            • Reads CPU attributes
                                            • Reads runtime system information
                                            PID:755
                                          • /bin/grep
                                            grep sync
                                            1⤵
                                              PID:756
                                            • /bin/grep
                                              grep -v grep
                                              1⤵
                                                PID:757
                                              • /usr/bin/awk
                                                awk "{print \$1}"
                                                1⤵
                                                  PID:758
                                                • /bin/ps
                                                  ps x
                                                  1⤵
                                                  • Reads CPU attributes
                                                  • Reads runtime system information
                                                  PID:760
                                                • /bin/grep
                                                  grep nginx
                                                  1⤵
                                                    PID:761
                                                  • /bin/grep
                                                    grep -v grep
                                                    1⤵
                                                      PID:762
                                                    • /usr/bin/awk
                                                      awk "{print \$1}"
                                                      1⤵
                                                        PID:763
                                                      • /bin/ps
                                                        ps x
                                                        1⤵
                                                        • Reads CPU attributes
                                                        • Reads runtime system information
                                                        PID:765
                                                      • /bin/grep
                                                        grep ecryptfs
                                                        1⤵
                                                          PID:766
                                                        • /bin/grep
                                                          grep -v grep
                                                          1⤵
                                                            PID:767
                                                          • /usr/bin/awk
                                                            awk "{print \$1}"
                                                            1⤵
                                                              PID:768
                                                            • /bin/ps
                                                              ps x
                                                              1⤵
                                                              • Reads CPU attributes
                                                              PID:770
                                                            • /bin/grep
                                                              grep xmr
                                                              1⤵
                                                                PID:771
                                                              • /bin/grep
                                                                grep -v grep
                                                                1⤵
                                                                  PID:772
                                                                • /usr/bin/awk
                                                                  awk "{print \$1}"
                                                                  1⤵
                                                                    PID:773
                                                                  • /bin/ps
                                                                    ps x
                                                                    1⤵
                                                                    • Reads CPU attributes
                                                                    • Reads runtime system information
                                                                    PID:775
                                                                  • /bin/grep
                                                                    grep perl
                                                                    1⤵
                                                                      PID:776
                                                                    • /bin/grep
                                                                      grep -v grep
                                                                      1⤵
                                                                        PID:777
                                                                      • /usr/bin/awk
                                                                        awk "{print \$1}"
                                                                        1⤵
                                                                          PID:778
                                                                        • /bin/ps
                                                                          ps x
                                                                          1⤵
                                                                          • Reads CPU attributes
                                                                          • Reads runtime system information
                                                                          PID:780
                                                                        • /bin/grep
                                                                          grep rsync
                                                                          1⤵
                                                                            PID:781
                                                                          • /bin/grep
                                                                            grep -v grep
                                                                            1⤵
                                                                              PID:782
                                                                            • /usr/bin/awk
                                                                              awk "{print \$1}"
                                                                              1⤵
                                                                                PID:783
                                                                              • /bin/ps
                                                                                ps -ef
                                                                                1⤵
                                                                                • Reads CPU attributes
                                                                                PID:788
                                                                              • /bin/grep
                                                                                grep rsync
                                                                                1⤵
                                                                                  PID:789
                                                                                • /usr/bin/awk
                                                                                  awk "{print \$2}"
                                                                                  1⤵
                                                                                    PID:790
                                                                                  • /bin/ps
                                                                                    ps -ef
                                                                                    1⤵
                                                                                    • Reads CPU attributes
                                                                                    PID:792
                                                                                  • /bin/grep
                                                                                    grep sync
                                                                                    1⤵
                                                                                      PID:793
                                                                                    • /usr/bin/awk
                                                                                      awk "{print \$2}"
                                                                                      1⤵
                                                                                        PID:794
                                                                                      • /bin/ps
                                                                                        ps -ef
                                                                                        1⤵
                                                                                        • Reads CPU attributes
                                                                                        • Reads runtime system information
                                                                                        PID:796
                                                                                      • /bin/grep
                                                                                        grep ps
                                                                                        1⤵
                                                                                          PID:797
                                                                                        • /usr/bin/awk
                                                                                          awk "{print \$2}"
                                                                                          1⤵
                                                                                            PID:798

                                                                                          Network

                                                                                          MITRE ATT&CK Enterprise v15

                                                                                          Replay Monitor

                                                                                          Loading Replay Monitor...

                                                                                          Downloads

                                                                                          • /tmp/.rsync/b/dir.dir

                                                                                            Filesize

                                                                                            14B

                                                                                            MD5

                                                                                            e21fb1889e57316ccbd97f98e1282a54

                                                                                            SHA1

                                                                                            ee8de521fb7ae11f81615ce31a45b5f7a79feee8

                                                                                            SHA256

                                                                                            8e0465a977658aca8fe06bec84742ed7c298db88cba64fc87de85409c6c909e8

                                                                                            SHA512

                                                                                            3ac5bf18363442ea8e4f478b2595a5e13199d80378c82f2ffeacb03cf64cf30c5e82c9a618d2a0f2d9d5386aeb1576e154e654eb20fc6967a43472f3f5047445

                                                                                          • /tmp/.rsync/b/sync

                                                                                            Filesize

                                                                                            33B

                                                                                            MD5

                                                                                            a0eea5d0b1c4743cc7b8c798399581e0

                                                                                            SHA1

                                                                                            bf30ba5824c9ec612aa4654eb895e3cb738b4e18

                                                                                            SHA256

                                                                                            7602dd04cbfa214345d0ae0b2ee26ed6475ea4d9053575cb99e29b956f536d0e

                                                                                            SHA512

                                                                                            9e70bc0608f42b83712d5e2911d21e6ab627c830d0ae4b8fa5e0eeea6555bc4cce49d7fafdea28a1888b55b28461cab34153dee3746bc084c1e8a296f849d06f