Overview
overview
10Static
static
10.rsync/a/a
ubuntu-18.04-amd64
7.rsync/a/a
debian-9-armhf
7.rsync/a/a
debian-9-mips
7.rsync/a/a
debian-9-mipsel
7.rsync/a/anacron
ubuntu-22.04-amd64
6.rsync/a/cron
ubuntu-22.04-amd64
1.rsync/a/run
ubuntu-18.04-amd64
3.rsync/a/run
debian-9-armhf
3.rsync/a/run
debian-9-mips
3.rsync/a/run
debian-9-mipsel
3.rsync/a/stop
ubuntu-18.04-amd64
6.rsync/a/stop
debian-9-armhf
6.rsync/a/stop
debian-9-mips
6.rsync/a/stop
debian-9-mipsel
6.rsync/c/go
ubuntu-18.04-amd64
3.rsync/c/go
debian-9-armhf
3.rsync/c/go
debian-9-mips
3.rsync/c/go
debian-9-mipsel
3.rsync/c/golan
ubuntu-18.04-amd64
1.rsync/c/golan
debian-9-armhf
1.rsync/c/golan
debian-9-mips
1.rsync/c/golan
debian-9-mipsel
1.rsync/c/l...c.so.6
ubuntu-22.04-amd64
.rsync/c/l...l.so.2
ubuntu-24.04-amd64
1.rsync/c/l...s.so.2
ubuntu-22.04-amd64
1.rsync/c/l...s.so.2
ubuntu-24.04-amd64
1.rsync/c/l...d.so.0
ubuntu-24.04-amd64
.rsync/c/l....23.so
ubuntu-24.04-amd64
1.rsync/c/l...v.so.2
ubuntu-24.04-amd64
1.rsync/c/lib/32/tsm
ubuntu-24.04-amd64
1.rsync/c/l...c.so.6
ubuntu-22.04-amd64
1.rsync/c/l...l.so.2
ubuntu-24.04-amd64
1Analysis
-
max time kernel
17s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
28-06-2024 12:54
Behavioral task
behavioral1
Sample
.rsync/a/a
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
.rsync/a/a
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
.rsync/a/a
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
.rsync/a/a
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral5
Sample
.rsync/a/anacron
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral6
Sample
.rsync/a/cron
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral7
Sample
.rsync/a/run
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral8
Sample
.rsync/a/run
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral9
Sample
.rsync/a/run
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral10
Sample
.rsync/a/run
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral11
Sample
.rsync/a/stop
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral12
Sample
.rsync/a/stop
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral13
Sample
.rsync/a/stop
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral14
Sample
.rsync/a/stop
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral15
Sample
.rsync/c/go
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral16
Sample
.rsync/c/go
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral17
Sample
.rsync/c/go
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral18
Sample
.rsync/c/go
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral19
Sample
.rsync/c/golan
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral20
Sample
.rsync/c/golan
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral21
Sample
.rsync/c/golan
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral22
Sample
.rsync/c/golan
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral23
Sample
.rsync/c/lib/32/libc.so.6
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral24
Sample
.rsync/c/lib/32/libdl.so.2
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral25
Sample
.rsync/c/lib/32/libnss_dns.so.2
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral26
Sample
.rsync/c/lib/32/libnss_files.so.2
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral27
Sample
.rsync/c/lib/32/libpthread.so.0
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral28
Sample
.rsync/c/lib/32/libresolv-2.23.so
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral29
Sample
.rsync/c/lib/32/libresolv.so.2
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral30
Sample
.rsync/c/lib/32/tsm
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral31
Sample
.rsync/c/lib/64/libc.so.6
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral32
Sample
.rsync/c/lib/64/libdl.so.2
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
.rsync/a/a
-
Size
876B
-
MD5
de5869436d84eee7b336fb5c51675290
-
SHA1
4427d10cc48b92208b9d61b45f45b3156e884813
-
SHA256
9d4fef06b12d18385f1c45dd4e37f031c6590b080ea5446ff7a5bac491daea50
-
SHA512
f26bcbdcf7417308bdec3f3f8b6ef453d2b7417b16d015eeddfc447955068b48667554fd9a1b896ee9d44ac3c2cac54137fc455c45f94251f42e5e3a1e7b6230
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
updioc pid process /tmp/.rsync/a/upd 689 upd -
Enumerates running processes
Discovers information about currently running processes on the system
-
Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
catcatdescription ioc process File opened for reading /proc/cpuinfo cat File opened for reading /proc/cpuinfo cat -
Reads CPU attributes 1 TTPs 3 IoCs
Processes:
sysctlpkillpsdescription ioc process File opened for reading /sys/devices/system/cpu/online sysctl File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps -
Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
adescription ioc process File opened for reading /sys/devices/system/node a -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
pkillpskillallsysctldescription ioc process File opened for reading /proc/150/cmdline pkill File opened for reading /proc/22/stat ps File opened for reading /proc/138/status ps File opened for reading /proc/22/status pkill File opened for reading /proc/700/cmdline ps File opened for reading /proc/314/status ps File opened for reading /proc/8/cmdline pkill File opened for reading /proc/301/status ps File opened for reading /proc/6/cmdline pkill File opened for reading /proc/275/cmdline pkill File opened for reading /proc/690/cmdline pkill File opened for reading /proc/29/stat killall File opened for reading /proc/668/cmdline ps File opened for reading /proc/165/cmdline ps File opened for reading /proc/314/stat ps File opened for reading /proc/411/cmdline ps File opened for reading /proc/4/cmdline pkill File opened for reading /proc/460/stat killall File opened for reading /proc/217/stat ps File opened for reading /proc/691/cmdline ps File opened for reading /proc/699/cmdline ps File opened for reading /proc/41/stat killall File opened for reading /proc/29/stat ps File opened for reading /proc/sys/kernel/osrelease sysctl File opened for reading /proc/672/status ps File opened for reading /proc/13/cmdline pkill File opened for reading /proc/147/status pkill File opened for reading /proc/278/cmdline ps File opened for reading /proc/25/cmdline pkill File opened for reading /proc/691/cmdline pkill File opened for reading /proc/filesystems killall File opened for reading /proc/97/stat killall File opened for reading /proc/415/stat killall File opened for reading /proc/701/status ps File opened for reading /proc/41/cmdline pkill File opened for reading /proc/668/status pkill File opened for reading /proc/269/stat killall File opened for reading /proc/28/stat ps File opened for reading /proc/3/cmdline pkill File opened for reading /proc/670/stat killall File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/23/cmdline ps File opened for reading /proc/41/stat ps File opened for reading /proc/13/status pkill File opened for reading /proc/4/cmdline ps File opened for reading /proc/643/cmdline pkill File opened for reading /proc/13/stat killall File opened for reading /proc/696/stat ps File opened for reading /proc/28/cmdline pkill File opened for reading /proc/22/status ps File opened for reading /proc/41/cmdline ps File opened for reading /proc/461/cmdline ps File opened for reading /proc/646/stat ps File opened for reading /proc/672/status pkill File opened for reading /proc/15/stat killall File opened for reading /proc/11/stat ps File opened for reading /proc/13/cmdline ps File opened for reading /proc/669/cmdline ps File opened for reading /proc/15/status pkill File opened for reading /proc/275/status pkill File opened for reading /proc/415/status pkill File opened for reading /proc/147/stat killall File opened for reading /proc/217/cmdline ps File opened for reading /proc/3/status pkill -
Writes file to tmp directory 5 IoCs
Malware often drops required files in the /tmp directory.
Processes:
astoprundescription ioc process File opened for modification /tmp/.rsync/a/upd a File opened for modification /tmp/.rsync/a/.proc stop File opened for modification /tmp/.rsync/a/dir.dir run File opened for modification /tmp/.rsync/a/bash.pid run File opened for modification /tmp/.rsync/a/dir.dir a
Processes
-
/tmp/.rsync/a/a/tmp/.rsync/a/a1⤵
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:671 -
/usr/bin/crontabcrontab -r2⤵PID:673
-
/bin/catcat dir.dir2⤵PID:678
-
/usr/bin/nprocnproc2⤵PID:679
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=1"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:680 -
/usr/bin/findfind "/sys/devices/system/node/node*" -maxdepth 0 -type d2⤵PID:681
-
/sbin/modprobemodprobe msr2⤵PID:682
-
/bin/catcat /proc/cpuinfo2⤵
- Checks CPU configuration
PID:683 -
/bin/grepgrep "AMD Ryzen"2⤵PID:684
-
/bin/catcat /proc/cpuinfo2⤵
- Checks CPU configuration
PID:685 -
/bin/grepgrep Intel2⤵PID:686
-
/bin/chmodchmod u+x upd2⤵PID:687
-
/bin/chmodchmod 777 a anacron cron dir.dir run stop upd2⤵PID:688
-
/tmp/.rsync/a/upd./upd2⤵
- Executes dropped EXE
PID:689
-
/tmp/.rsync/a/run./run1⤵
- Writes file to tmp directory
PID:690 -
/tmp/.rsync/a/stop./stop2⤵
- Writes file to tmp directory
PID:691 -
/usr/bin/pkillpkill -9 cron3⤵
- Reads CPU attributes
- Reads runtime system information
PID:692 -
/usr/bin/killallkillall -9 cron3⤵
- Reads runtime system information
PID:694 -
/bin/psps x3⤵
- Reads CPU attributes
- Reads runtime system information
PID:698 -
/bin/grepgrep cron3⤵PID:699
-
/bin/grepgrep -v grep3⤵PID:700
-
/usr/bin/awkawk "{print \$1}"3⤵PID:701
-
/bin/rmrm -rf .proc3⤵PID:705
-
/bin/sleepsleep 102⤵PID:707
-
/bin/catcat dir.dir2⤵PID:755
-
/bin/unameuname -m2⤵PID:756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
/tmp/.rsync/a/bash.pidFilesize
1B
MD568b329da9893e34099c7d8ad5cb9c940
SHA1adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA25601ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
SHA512be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
-
/tmp/.rsync/a/dir.dirFilesize
14B
MD5b3d878adcf4672bbd1f31cffac10c769
SHA1ce5798837933ece35a7e26a0a3dc06cab19c6275
SHA256ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7
SHA512019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c
-
/tmp/.rsync/a/updFilesize
175B
MD5a136fbe534c2487d3c89bd6a26847bd0
SHA111b9362ba79b67dd5d5baf7cf11e0003f049d6e0
SHA256419a443ff93475ef3abb6e71e5a94e56aea8b7c1f1c4402b3662425815432d46
SHA51285047cf9d22037d2581ae41275107b243c0bb3259b57fe46bd3fd04a1abe75a7fdeace8a9eae1fae31349a00183206b40259ab3957db8f4f16a79e67133485e9