3c0242f1491a5bfa548c73301e172fad00ff6ad82ba6d0084c272ce55861f7d2

Analysis

max time kernel
19s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
01-07-2024 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/c/run
Size

209B
MD5

14d81e980c0ca2f21cfa386dbaeffc11
SHA1

1736595cff66a4e29e749435d7a0a92a67c789b3
SHA256

380244e59ba1b19961645d16da290b1111efc8131ae4da30fc1dde15639f2796
SHA512

1e70258404880648d2a5b5b231e816bc7ed909d7a2d100d87ac85cc29b2b25ab730bef088ded84b3ac4c65705cb18ca5b0ff882446b6fe701756ac52e42c46fe

Score

4^/10

antivm

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

/tmp/.rsync/c/run
/tmp/.rsync/c/run
1⤵
PID:663

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:666

/bin/grep
grep name
2⤵
PID:668

/bin/grep
grep model
2⤵
PID:667

/usr/bin/wc
wc -l
2⤵
PID:669

/bin/sleep
sleep 15
2⤵
PID:675

/tmp/.rsync/c/stop
./stop
2⤵
PID:755

/bin/sleep
sleep 3
2⤵
PID:756

/bin/sleep
sleep 0
2⤵
PID:759

/usr/bin/nohup
nohup ./go
1⤵
PID:760

/tmp/.rsync/c/go
./go
1⤵
PID:760

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads