Overview
overview
10Static
static
7.rsync/a/a
ubuntu-18.04-amd64
10.rsync/a/a
debian-9-armhf
10.rsync/a/a
debian-9-mips
7.rsync/a/a
debian-9-mipsel
7.rsync/a/init0
ubuntu-18.04-amd64
6.rsync/a/init0
debian-9-armhf
6.rsync/a/init0
debian-9-mips
6.rsync/a/init0
debian-9-mipsel
6.rsync/a/kswapd0
ubuntu-18.04-amd64
10.rsync/a/run
ubuntu-18.04-amd64
3.rsync/a/run
debian-9-armhf
3.rsync/a/run
debian-9-mips
3.rsync/a/run
debian-9-mipsel
3.rsync/a/stop
ubuntu-18.04-amd64
10.rsync/a/stop
debian-9-armhf
10.rsync/a/stop
debian-9-mips
6.rsync/a/stop
debian-9-mipsel
6.rsync/b/a
ubuntu-18.04-amd64
7.rsync/b/a
debian-9-armhf
7.rsync/b/a
debian-9-mips
6.rsync/b/a
debian-9-mipsel
7.rsync/b/run
ubuntu-18.04-amd64
7.rsync/b/run
debian-9-armhf
7.rsync/b/run
debian-9-mips
7.rsync/b/run
debian-9-mipsel
7.rsync/b/stop
ubuntu-18.04-amd64
6.rsync/b/stop
debian-9-armhf
6.rsync/b/stop
debian-9-mips
6.rsync/b/stop
debian-9-mipsel
6.rsync/c/blitz
ubuntu-18.04-amd64
1.rsync/c/blitz
debian-9-armhf
1.rsync/c/blitz
debian-9-mips
1Analysis
-
max time kernel
0s -
max time network
70s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240226-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
07-03-2024 18:02
Behavioral task
behavioral1
Sample
.rsync/a/a
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
.rsync/a/a
Resource
debian9-armhf-20240226-en
debian-9-armhf
Behavioral task
behavioral3
Sample
.rsync/a/a
Resource
debian9-mipsbe-20240226-en
debian-9-mips
Behavioral task
behavioral4
Sample
.rsync/a/a
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
.rsync/a/init0
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
.rsync/a/init0
Resource
debian9-armhf-20240226-en
debian-9-armhf
Behavioral task
behavioral7
Sample
.rsync/a/init0
Resource
debian9-mipsbe-20240226-en
debian-9-mips
Behavioral task
behavioral8
Sample
.rsync/a/init0
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
.rsync/a/kswapd0
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
.rsync/a/run
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
.rsync/a/run
Resource
debian9-armhf-20240226-en
debian-9-armhf
Behavioral task
behavioral12
Sample
.rsync/a/run
Resource
debian9-mipsbe-20240226-en
debian-9-mips
Behavioral task
behavioral13
Sample
.rsync/a/run
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
Behavioral task
behavioral14
Sample
.rsync/a/stop
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
.rsync/a/stop
Resource
debian9-armhf-20240226-en
debian-9-armhf
Behavioral task
behavioral16
Sample
.rsync/a/stop
Resource
debian9-mipsbe-20240226-en
debian-9-mips
Behavioral task
behavioral17
Sample
.rsync/a/stop
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
.rsync/b/a
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
.rsync/b/a
Resource
debian9-armhf-20240226-en
debian-9-armhf
Behavioral task
behavioral20
Sample
.rsync/b/a
Resource
debian9-mipsbe-20240226-en
debian-9-mips
Behavioral task
behavioral21
Sample
.rsync/b/a
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
Behavioral task
behavioral22
Sample
.rsync/b/run
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
Behavioral task
behavioral23
Sample
.rsync/b/run
Resource
debian9-armhf-20240226-en
debian-9-armhf
Behavioral task
behavioral24
Sample
.rsync/b/run
Resource
debian9-mipsbe-20240226-en
debian-9-mips
Behavioral task
behavioral25
Sample
.rsync/b/run
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
Behavioral task
behavioral26
Sample
.rsync/b/stop
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
Behavioral task
behavioral27
Sample
.rsync/b/stop
Resource
debian9-armhf-20240226-en
debian-9-armhf
Behavioral task
behavioral28
Sample
.rsync/b/stop
Resource
debian9-mipsbe-20240226-en
debian-9-mips
Behavioral task
behavioral29
Sample
.rsync/b/stop
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
Behavioral task
behavioral30
Sample
.rsync/c/blitz
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
Behavioral task
behavioral31
Sample
.rsync/c/blitz
Resource
debian9-armhf-20240226-en
debian-9-armhf
Behavioral task
behavioral32
Sample
.rsync/c/blitz
Resource
debian9-mipsbe-20240226-en
debian-9-mips
General
-
Target
.rsync/b/stop
-
Size
1KB
-
MD5
5b64a3f14ef56f67c17f9ecfc78cde9f
-
SHA1
e6892ed68fa1db2ba7b84d3f690ff29eae3dc6c7
-
SHA256
20eca3e02cc4768498aa34f3161394875808b2c174388292f8d17c90f98e2373
-
SHA512
4f711c1d1bf81925125cffa0b68e02e9c5162f6fe38bed241d52dab439b4493246eea80e70e0c92bae978f1c347c51965332183930ea2f0a52bbffdcb36b7487
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 8 IoCs
Processes:
pspspkillpkillpkillpkillpkillpkilldescription ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
killallpkillpkillpskillallkillallkillallkillallpkillpspkillpkillkillallkillallkillalldescription ioc Process File opened for reading /proc/1254/stat killall File opened for reading /proc/425/cmdline pkill File opened for reading /proc/1077/cmdline pkill File opened for reading /proc/1114/status pkill File opened for reading /proc/485/cmdline pkill File opened for reading /proc/425/stat ps File opened for reading /proc/1191/cmdline ps File opened for reading /proc/12/stat killall File opened for reading /proc/18/stat killall File opened for reading /proc/28/stat killall File opened for reading /proc/5/stat killall File opened for reading /proc/1170/status pkill File opened for reading /proc/739/cmdline ps File opened for reading /proc/1196/status ps File opened for reading /proc/421/cmdline pkill File opened for reading /proc/969/cmdline ps File opened for reading /proc/1192/cmdline ps File opened for reading /proc/1279/stat killall File opened for reading /proc/1/stat killall File opened for reading /proc/650/cmdline pkill File opened for reading /proc/14/cmdline pkill File opened for reading /proc/23/status pkill File opened for reading /proc/1127/stat killall File opened for reading /proc/165/stat killall File opened for reading /proc/9/stat killall File opened for reading /proc/1139/cmdline killall File opened for reading /proc/1315/cmdline pkill File opened for reading /proc/80/status pkill File opened for reading /proc/1452/cmdline ps File opened for reading /proc/1254/cmdline ps File opened for reading /proc/21/stat killall File opened for reading /proc/filesystems killall File opened for reading /proc/4/stat killall File opened for reading /proc/1295/cmdline pkill File opened for reading /proc/172/stat ps File opened for reading /proc/1186/cmdline ps File opened for reading /proc/1090/stat killall File opened for reading /proc/168/cmdline pkill File opened for reading /proc/1309/status pkill File opened for reading /proc/21/cmdline pkill File opened for reading /proc/36/cmdline pkill File opened for reading /proc/1114/cmdline ps File opened for reading /proc/177/stat killall File opened for reading /proc/78/status pkill File opened for reading /proc/79/status pkill File opened for reading /proc/1070/cmdline ps File opened for reading /proc/443/status ps File opened for reading /proc/1475/cmdline ps File opened for reading /proc/1179/cmdline killall File opened for reading /proc/1067/status pkill File opened for reading /proc/1144/cmdline pkill File opened for reading /proc/1099/cmdline pkill File opened for reading /proc/314/stat ps File opened for reading /proc/173/cmdline pkill File opened for reading /proc/98/cmdline ps File opened for reading /proc/23/stat killall File opened for reading /proc/1393/stat killall File opened for reading /proc/1179/cmdline pkill File opened for reading /proc/453/status pkill File opened for reading /proc/1131/status pkill File opened for reading /proc/36/cmdline killall File opened for reading /proc/1592/cmdline pkill File opened for reading /proc/163/cmdline ps File opened for reading /proc/965/stat ps -
Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes:
stopdescription ioc Process File opened for modification /tmp/.rsync/b/.out stop
Processes
-
/tmp/.rsync/b/stop/tmp/.rsync/b/stop1⤵
- Writes file to tmp directory
PID:1592 -
/usr/bin/killallkillall -9 rsync2⤵
- Reads runtime system information
PID:1593
-
-
/usr/bin/killallkillall -9 sync2⤵
- Reads runtime system information
PID:1594
-
-
/usr/bin/killallkillall -9 perl2⤵
- Reads runtime system information
PID:1595
-
-
/usr/bin/killallkillall -9 ps2⤵
- Reads runtime system information
PID:1596
-
-
/usr/bin/killallkillall -9 pool2⤵
- Reads runtime system information
PID:1597
-
-
/usr/bin/killallkillall -9 nginx2⤵
- Reads runtime system information
PID:1598
-
-
/usr/bin/killallkillall -9 ecryptfs2⤵
- Reads runtime system information
PID:1599
-
-
/usr/bin/killallkillall -9 xmr2⤵
- Reads runtime system information
PID:1600
-
-
/usr/bin/pkillpkill -9 ps2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1601
-
-
/usr/bin/pkillpkill -9 pool2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1602
-
-
/usr/bin/pkillpkill -9 nginx2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1606
-
-
/usr/bin/pkillpkill -9 ecryptfs2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1607
-
-
/usr/bin/pkillpkill -9 xmr2⤵
- Reads CPU attributes
PID:1608
-
-
/usr/bin/pkillpkill -9 sync2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1609
-
-
/usr/bin/awkawk "{print \$1}"1⤵PID:1614
-
/bin/grepgrep -v grep1⤵PID:1613
-
/bin/grepgrep ps1⤵PID:1612
-
/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1611
-
/usr/bin/awkawk "{print \$1}"1⤵PID:1621
-
/bin/grepgrep -v grep1⤵PID:1620
-
/bin/grepgrep sync1⤵PID:1619
-
/bin/psps x1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1618