3c0242f1491a5bfa548c73301e172fad00ff6ad82ba6d0084c272ce55861f7d2

Analysis

max time kernel
19s
platform
debian-9_mips
resource
debian9-mipsbe-20240611-en
resource tags

arch:mipsimage:debian9-mipsbe-20240611-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
01-07-2024 10:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.rsync/c/run
Size

209B
MD5

14d81e980c0ca2f21cfa386dbaeffc11
SHA1

1736595cff66a4e29e749435d7a0a92a67c789b3
SHA256

380244e59ba1b19961645d16da290b1111efc8131ae4da30fc1dde15639f2796
SHA512

1e70258404880648d2a5b5b231e816bc7ed909d7a2d100d87ac85cc29b2b25ab730bef088ded84b3ac4c65705cb18ca5b0ff882446b6fe701756ac52e42c46fe

Score

4^/10

antivm

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

/tmp/.rsync/c/run
/tmp/.rsync/c/run
1⤵
PID:722

/bin/grep
grep name
2⤵
PID:732

/bin/grep
grep model
2⤵
PID:731

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:730

/usr/bin/wc
wc -l
2⤵
PID:733

/bin/sleep
sleep 15
2⤵
PID:735

/tmp/.rsync/c/stop
./stop
2⤵
PID:816

/bin/sleep
sleep 3
2⤵
PID:817

/bin/sleep
sleep 169
2⤵
PID:818

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads