0de9266af49aab24256c289d39e86649d978d5a4c9d0ff2041a22140b88ea688

Analysis

max time kernel
2s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08-11-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.systemd/.run
Size

415B
MD5

4c7b4fb257df508abb56e1202d63fb9c
SHA1

b490c80ca53c03ad04adc3ac024cb58ae2456161
SHA256

19cb430a8f94daf1e4ff121e28814cc3f11493d640e555105c604702980b9117
SHA512

2f44151a628f8b94911db42a5d9a83d2ae7b828ab45854954c0579be898843016595da5cfdbe0d882853c6626f6519de3dfeb79eed196a6b008ef5e14132651d

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/281/cmdline	ps
File opened for reading	/proc/295/cmdline	ps
File opened for reading	/proc/661/stat	ps
File opened for reading	/proc/683/stat	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/606/status	ps
File opened for reading	/proc/3/cmdline	ps
File opened for reading	/proc/342/status	ps
File opened for reading	/proc/598/cmdline	ps
File opened for reading	/proc/683/cmdline	ps
File opened for reading	/proc/14/cmdline	ps
File opened for reading	/proc/144/cmdline	ps
File opened for reading	/proc/679/cmdline	ps
File opened for reading	/proc/26/status	ps
File opened for reading	/proc/29/cmdline	ps
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/314/stat	ps
File opened for reading	/proc/328/stat	ps
File opened for reading	/proc/606/status	ps
File opened for reading	/proc/691/stat	ps
File opened for reading	/proc/12/status	ps
File opened for reading	/proc/155/stat	ps
File opened for reading	/proc/279/stat	ps
File opened for reading	/proc/283/stat	ps
File opened for reading	/proc/694/status	ps
File opened for reading	/proc/686/cmdline	ps
File opened for reading	/proc/686/cmdline	ps
File opened for reading	/proc/706/cmdline	ps
File opened for reading	/proc/41/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/283/stat	ps
File opened for reading	/proc/81/status	ps
File opened for reading	/proc/342/cmdline	ps
File opened for reading	/proc/685/cmdline	ps
File opened for reading	/proc/self/stat	ps
File opened for reading	/proc/316/cmdline	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/281/status	ps
File opened for reading	/proc/155/cmdline	ps
File opened for reading	/proc/601/status	ps
File opened for reading	/proc/113/stat	ps
File opened for reading	/proc/693/cmdline	ps
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/279/status	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/143/stat	ps
File opened for reading	/proc/103/stat	ps
File opened for reading	/proc/598/cmdline	ps
File opened for reading	/proc/229/cmdline	ps
File opened for reading	/proc/280/stat	ps
File opened for reading	/proc/598/status	ps
File opened for reading	/proc/686/cmdline	ps
File opened for reading	/proc/2/cmdline	ps
File opened for reading	/proc/29/stat	ps
File opened for reading	/proc/603/cmdline	ps
File opened for reading	/proc/655/cmdline	ps
File opened for reading	/proc/679/status	ps
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/24/stat	ps
File opened for reading	/proc/26/cmdline	ps
File opened for reading	/proc/21/stat	ps

/tmp/.systemd/.run
/tmp/.systemd/.run
1⤵
PID:685
- /bin/grep
  grep -v R
  2⤵
  PID:691
- /bin/ps
  ps x
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:687
- /bin/grep
  grep "ssh "
  2⤵
  PID:690
- /bin/grep
  grep -v grep
  2⤵
  PID:692
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:693
- /bin/ps
  ps x
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:696
- /bin/grep
  grep "ssh\$"
  2⤵
  PID:697
- /bin/grep
  grep -v R
  2⤵
  PID:698
- /bin/grep
  grep -v grep
  2⤵
  PID:699
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:700
- /bin/grep
  grep " sh\$"
  2⤵
  PID:703
- /bin/ps
  ps x
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:702
- /bin/grep
  grep -v R
  2⤵
  PID:704
- /bin/grep
  grep -v grep
  2⤵
  PID:705
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  - Reads runtime system information
  PID:706
- /bin/uname
  uname -m
  2⤵
  PID:708
- /bin/cp
  cp -f -- .armv7l -bash
  2⤵
  PID:710
- /tmp/.systemd/-bash
  ./-bash
  2⤵
  PID:711

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads