105e32c8ef13d4d001923c1a43a8849d069fc4adebe48e5e6a9e726eb605ce31

Analysis

max time kernel
1s
max time network
478s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240221-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
15-04-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/b/stop
Size

1KB
MD5

5b64a3f14ef56f67c17f9ecfc78cde9f
SHA1

e6892ed68fa1db2ba7b84d3f690ff29eae3dc6c7
SHA256

20eca3e02cc4768498aa34f3161394875808b2c174388292f8d17c90f98e2373
SHA512

4f711c1d1bf81925125cffa0b68e02e9c5162f6fe38bed241d52dab439b4493246eea80e70e0c92bae978f1c347c51965332183930ea2f0a52bbffdcb36b7487

Score

6^/10

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 8 IoCs

System Information Discovery

T1082

Processes:

pspkillpkillpkillpkillpkillpkillps

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

Processes:

pkillpskillallpkillpkillkillallkillallkillallpkillkillallpkillpskillallpkillkillallkillall

description	ioc	Process
File opened for reading	/proc/1405/status	pkill
File opened for reading	/proc/1400/stat	ps
File opened for reading	/proc/1448/stat	killall
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/969/status	pkill
File opened for reading	/proc/764/status	pkill
File opened for reading	/proc/497/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/1403/stat	killall
File opened for reading	/proc/140/stat	killall
File opened for reading	/proc/177/status	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/1302/status	pkill
File opened for reading	/proc/1080/stat	killall
File opened for reading	/proc/559/stat	killall
File opened for reading	/proc/1000/stat	killall
File opened for reading	/proc/168/stat	killall
File opened for reading	/proc/86/cmdline	pkill
File opened for reading	/proc/915/cmdline	ps
File opened for reading	/proc/1126/stat	ps
File opened for reading	/proc/1487/cmdline	ps
File opened for reading	/proc/1418/stat	ps
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/945/stat	killall
File opened for reading	/proc/92/cmdline	ps
File opened for reading	/proc/1084/status	pkill
File opened for reading	/proc/1003/cmdline	ps
File opened for reading	/proc/1465/stat	ps
File opened for reading	/proc/81/stat	killall
File opened for reading	/proc/394/stat	killall
File opened for reading	/proc/395/cmdline	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/307/status	pkill
File opened for reading	/proc/1102/cmdline	pkill
File opened for reading	/proc/441/stat	killall
File opened for reading	/proc/1000/stat	killall
File opened for reading	/proc/1412/status	ps
File opened for reading	/proc/613/status	ps
File opened for reading	/proc/909/cmdline	ps
File opened for reading	/proc/1042/stat	killall
File opened for reading	/proc/1289/stat	killall
File opened for reading	/proc/10/status	ps
File opened for reading	/proc/84/stat	killall
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/82/stat	ps
File opened for reading	/proc/585/stat	killall
File opened for reading	/proc/1103/stat	killall
File opened for reading	/proc/5/status	pkill
File opened for reading	/proc/91/stat	killall
File opened for reading	/proc/1312/stat	killall
File opened for reading	/proc/1380/status	ps
File opened for reading	/proc/1083/status	pkill
File opened for reading	/proc/1126/cmdline	pkill
File opened for reading	/proc/self/auxv	ps
File opened for reading	/proc/577/status	ps
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/1055/stat	killall
File opened for reading	/proc/87/stat	killall
File opened for reading	/proc/1078/status	pkill
File opened for reading	/proc/897/stat	ps
File opened for reading	/proc/1402/cmdline	pkill
File opened for reading	/proc/585/cmdline	ps
File opened for reading	/proc/1029/stat	killall
File opened for reading	/proc/577/stat	killall

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

Processes:

stop

description	ioc	Process
File opened for modification	/tmp/.rsync/b/.out	stop

/tmp/.rsync/b/stop
/tmp/.rsync/b/stop
1⤵
- Writes file to tmp directory
PID:1465
- /usr/bin/killall
  killall -9 rsync
  2⤵
  - Reads runtime system information
  PID:1466
- /usr/bin/killall
  killall -9 sync
  2⤵
  - Reads runtime system information
  PID:1470
- /usr/bin/killall
  killall -9 perl
  2⤵
  - Reads runtime system information
  PID:1471
- /usr/bin/killall
  killall -9 ps
  2⤵
  - Reads runtime system information
  PID:1472
- /usr/bin/killall
  killall -9 pool
  2⤵
  - Reads runtime system information
  PID:1473
- /usr/bin/killall
  killall -9 nginx
  2⤵
  - Reads runtime system information
  PID:1474
- /usr/bin/killall
  killall -9 ecryptfs
  2⤵
  - Reads runtime system information
  PID:1475
- /usr/bin/killall
  killall -9 xmr
  2⤵
  - Reads runtime system information
  PID:1476
- /usr/bin/pkill
  pkill -9 ps
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1477
- /usr/bin/pkill
  pkill -9 pool
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1478
- /usr/bin/pkill
  pkill -9 nginx
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1479
- /usr/bin/pkill
  pkill -9 ecryptfs
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1480
- /usr/bin/pkill
  pkill -9 xmr
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1481
- /usr/bin/pkill
  pkill -9 sync
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:1484

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:1491

/usr/bin/grep
grep -v grep
1⤵
PID:1490

/usr/bin/grep
grep ps
1⤵
PID:1489

/usr/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1488

/usr/bin/awk
awk "{print \$1}"
1⤵
PID:1500

/usr/bin/grep
grep -v grep
1⤵
PID:1499

/usr/bin/grep
grep sync
1⤵
PID:1498

/usr/bin/ps
ps x
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1497

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads