Overview

overview

10

Static

static

7

.rsync/a/a

ubuntu-20.04-amd64

10

.rsync/a/init0

ubuntu-20.04-amd64

6

.rsync/a/kswapd0

ubuntu-20.04-amd64

10

.rsync/a/run

ubuntu-20.04-amd64

3

.rsync/a/stop

ubuntu-20.04-amd64

10

.rsync/b/a

ubuntu-20.04-amd64

7

.rsync/b/run

ubuntu-20.04-amd64

7

.rsync/b/stop

ubuntu-20.04-amd64

6

.rsync/c/blitz

ubuntu-20.04-amd64

1

.rsync/c/blitz32

ubuntu-20.04-amd64

3

.rsync/c/blitz64

ubuntu-20.04-amd64

3

.rsync/c/go

ubuntu-20.04-amd64

3

.rsync/c/run

ubuntu-20.04-amd64

6

.rsync/c/start

ubuntu-20.04-amd64

9

.rsync/c/stop

ubuntu-20.04-amd64

6

Analysis

  • max time kernel
    251s
  • max time network
    478s
  • platform
    ubuntu-20.04_amd64
  • resource
    ubuntu2004-amd64-20240221-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
  • submitted
    15/04/2024, 16:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    .rsync/c/run

  • Size

    489B

  • MD5

    97a962fb5bd427e09547ecaaf850e034

  • SHA1

    3040ea8bc3226af1fc201c4fefcca17b62184bbe

  • SHA256

    5a1797ae845e8c80c771ece9174b93ad5d5a74e593fe3b508ba105830db5fd92

  • SHA512

    2ed6bad217478913a053fbcad37c904dddacee424ce39115c15019477870582b0d53da908783047cf9069df0a011387b3fba336385ff392ab0be84cd49d04001

Score
6/10
antivm

Malware Config

Signatures

  • Checks CPU configuration 1 TTPs 1 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm

Processes

  • /tmp/.rsync/c/run
    /tmp/.rsync/c/run
    1⤵
      PID:1466
      • /usr/bin/uname
        uname -m
        2⤵
          PID:1475
        • /usr/bin/sleep
          sleep 15
          2⤵
            PID:1476
          • /tmp/.rsync/c/stop
            ./stop
            2⤵
              PID:2066
            • /usr/bin/sleep
              sleep 3
              2⤵
                PID:2067
              • /usr/bin/sleep
                sleep 233
                2⤵
                  PID:2068
              • /usr/bin/cat
                cat /proc/cpuinfo
                1⤵
                • Checks CPU configuration
                PID:1468
              • /usr/bin/grep
                grep model
                1⤵
                  PID:1469
                • /usr/bin/grep
                  grep name
                  1⤵
                    PID:1470
                  • /usr/bin/wc
                    wc -l
                    1⤵
                      PID:1471
                    • /usr/bin/nohup
                      nohup ./go
                      1⤵
                        PID:2094
                      • /tmp/.rsync/c/go
                        ./go
                        1⤵
                          PID:2094

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads