Analysis
-
max time kernel
0s -
max time network
131s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
23/05/2024, 13:11
Static task
static1
Behavioral task
behavioral1
Sample
cron.sh
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
cron.sh
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
cron.sh
Resource
debian9-mipsbe-20240226-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
cron.sh
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
0 signatures
150 seconds
General
-
Target
cron.sh
-
Size
1KB
-
MD5
84d382582ecd4c28eb11e72228b75d2d
-
SHA1
d8ebe4e23c704d21a0ce974f91e7e74c6fa793a2
-
SHA256
d449ec4359cb09e59731c3bf998c971a601f1fdd2159e70aff6c82153ada6e8b
-
SHA512
544a76c5cd836f6321e448e62c732280ed4db63468b3dae517b0fb4a10abd3b7ea42dd1f75d3822ad7187073d6166e38bc58906553fdc4c9aa03a89217a675cc
Score
6/10
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/36/status ps File opened for reading /proc/1181/stat ps File opened for reading /proc/13/status ps File opened for reading /proc/35/cmdline ps File opened for reading /proc/36/stat ps File opened for reading /proc/137/status ps File opened for reading /proc/159/cmdline ps File opened for reading /proc/162/stat ps File opened for reading /proc/1367/stat ps File opened for reading /proc/15/stat ps File opened for reading /proc/28/status ps File opened for reading /proc/78/status ps File opened for reading /proc/1350/cmdline ps File opened for reading /proc/166/status ps File opened for reading /proc/173/stat ps File opened for reading /proc/730/status ps File opened for reading /proc/9/status ps File opened for reading /proc/34/status ps File opened for reading /proc/158/cmdline ps File opened for reading /proc/713/cmdline ps File opened for reading /proc/1163/status ps File opened for reading /proc/1203/status ps File opened for reading /proc/1244/stat ps File opened for reading /proc/35/stat ps File opened for reading /proc/160/stat ps File opened for reading /proc/416/stat ps File opened for reading /proc/1161/status ps File opened for reading /proc/1199/stat ps File opened for reading /proc/1398/status ps File opened for reading /proc/268/cmdline ps File opened for reading /proc/1083/status ps File opened for reading /proc/1128/stat ps File opened for reading /proc/1089/status ps File opened for reading /proc/1157/stat ps File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/10/stat ps File opened for reading /proc/1076/cmdline ps File opened for reading /proc/436/status ps File opened for reading /proc/1520/status ps File opened for reading /proc/965/status ps File opened for reading /proc/1104/cmdline ps File opened for reading /proc/1152/stat ps File opened for reading /proc/1182/cmdline ps File opened for reading /proc/5/status ps File opened for reading /proc/78/stat ps File opened for reading /proc/693/stat ps File opened for reading /proc/440/stat ps File opened for reading /proc/440/status ps File opened for reading /proc/460/cmdline ps File opened for reading /proc/1004/cmdline ps File opened for reading /proc/1165/stat ps File opened for reading /proc/21/stat ps File opened for reading /proc/161/cmdline ps File opened for reading /proc/166/stat ps File opened for reading /proc/1211/stat ps File opened for reading /proc/1533/stat ps File opened for reading /proc/311/status ps File opened for reading /proc/414/status ps File opened for reading /proc/1128/cmdline ps File opened for reading /proc/1367/status ps File opened for reading /proc/11/stat ps File opened for reading /proc/19/status ps File opened for reading /proc/202/stat ps File opened for reading /proc/1/cmdline ps
Processes
-
/tmp/cron.sh/tmp/cron.sh1⤵PID:1525
-
/usr/bin/whichwhich php2⤵PID:1526
-
-
/bin/sedsed "s/cron\\.sh//g"2⤵PID:1529
-
-
/usr/bin/exprexpr index cron.php /2⤵PID:1530
-
-
/bin/grepgrep -v grep2⤵PID:1533
-
-
/bin/grepgrep /tmp/cron.php2⤵PID:1532
-
-
/bin/psps auxwww2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1531
-
-
/tmp/cron.php/tmp/cron.php1⤵PID:1534