Overview
overview
6Static
static
1post-install.sh
ubuntu-18.04-amd64
1post-install.sh
debian-9-armhf
1post-install.sh
debian-9-mips
post-install.sh
debian-9-mipsel
post-uninstall.sh
ubuntu-18.04-amd64
1post-uninstall.sh
debian-9-armhf
1post-uninstall.sh
debian-9-mips
post-uninstall.sh
debian-9-mipsel
pre-install.sh
ubuntu-18.04-amd64
1pre-install.sh
debian-9-armhf
1pre-install.sh
debian-9-mips
pre-install.sh
debian-9-mipsel
pre-uninstall.sh
ubuntu-18.04-amd64
1pre-uninstall.sh
debian-9-armhf
1pre-uninstall.sh
debian-9-mips
pre-uninstall.sh
debian-9-mipsel
start-stop.sh
ubuntu-18.04-amd64
1start-stop.sh
debian-9-armhf
1start-stop.sh
debian-9-mips
start-stop.sh
debian-9-mipsel
bin/xCloudClient
ubuntu-18.04-amd64
6monitor.sh
ubuntu-18.04-amd64
1monitor.sh
debian-9-armhf
1monitor.sh
debian-9-mips
monitor.sh
debian-9-mipsel
restart_xcloud.sh
ubuntu-18.04-amd64
1restart_xcloud.sh
debian-9-armhf
1restart_xcloud.sh
debian-9-mips
restart_xcloud.sh
debian-9-mipsel
searchSharePath.sh
ubuntu-18.04-amd64
3searchSharePath.sh
debian-9-armhf
1searchSharePath.sh
debian-9-mips
Analysis
-
max time kernel
0s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
21/05/2024, 06:05
Static task
static1
Behavioral task
behavioral1
Sample
post-install.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
post-install.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral3
Sample
post-install.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
post-install.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral5
Sample
post-uninstall.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral6
Sample
post-uninstall.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral7
Sample
post-uninstall.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral8
Sample
post-uninstall.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral9
Sample
pre-install.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral10
Sample
pre-install.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral11
Sample
pre-install.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral12
Sample
pre-install.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral13
Sample
pre-uninstall.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral14
Sample
pre-uninstall.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral15
Sample
pre-uninstall.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral16
Sample
pre-uninstall.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral17
Sample
start-stop.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral18
Sample
start-stop.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral19
Sample
start-stop.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral20
Sample
start-stop.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral21
Sample
bin/xCloudClient
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral22
Sample
monitor.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral23
Sample
monitor.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral24
Sample
monitor.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral25
Sample
monitor.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral26
Sample
restart_xcloud.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral27
Sample
restart_xcloud.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral28
Sample
restart_xcloud.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral29
Sample
restart_xcloud.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral30
Sample
searchSharePath.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral31
Sample
searchSharePath.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral32
Sample
searchSharePath.sh
Resource
debian9-mipsbe-20240418-en
General
-
Target
searchSharePath.sh
-
Size
2KB
-
MD5
3c7655349d7a5106ea60c4fdd9a230a1
-
SHA1
d2cc131af48c3547835914db640decc01486ca1a
-
SHA256
9835fdde3aa4fca60ec63c2e169d777cfa506c14f37a82ab848235e11bdb8de2
-
SHA512
4905ca4dea4ba7bd9c899b298571882fe283b89421848f5486798f1f5b138ace4ca9418d32fc1fe7efdfcc98bc04302331f49fec5ff37d64be5f151b87ba2097
Malware Config
Signatures
-
Reads runtime system information 6 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir File opened for reading /proc/filesystems mkdir
Processes
-
/tmp/searchSharePath.sh/tmp/searchSharePath.sh1⤵PID:1517
-
/bin/mkdirmkdir -p /volume1/Public/xcloud2⤵
- Reads runtime system information
PID:1518
-
-
/bin/mkdirmkdir -p /volume1/Public/xcloud/music2⤵
- Reads runtime system information
PID:1519
-
-
/bin/mkdirmkdir -p /volume1/Public/xcloud/video2⤵
- Reads runtime system information
PID:1520
-
-
/bin/mkdirmkdir -p /volume1/Public/xcloud/docs2⤵
- Reads runtime system information
PID:1521
-
-
/bin/mkdirmkdir -p /volume1/Public/xcloud/pic2⤵
- Reads runtime system information
PID:1522
-
-
/bin/mkdirmkdir -p /volume1/Public/xcloud/pic/instant2⤵
- Reads runtime system information
PID:1523
-
-
/bin/lnln -s /volume1/Public/xcloud /volume1/Web/xCloud/source2⤵PID:1524
-
-
/bin/echo/bin/echo "/volume0/usr/builtin/etc/samba/smb.conf is no exist!"2⤵PID:1525
-