Overview
overview
10Static
static
10样本/Lin...9DC1D8
ubuntu-18.04-amd64
7样本/Lin...B36C5B
ubuntu-24.04-amd64
6样本/Lin...E3B383
ubuntu-24.04-amd64
8样本/Lin...6F5973
ubuntu-22.04-amd64
1样本/Lin...776DB8
ubuntu-18.04-amd64
1样本/Lin...776DB8
debian-9-armhf
1样本/Lin...776DB8
debian-9-mips
1样本/Lin...776DB8
debian-9-mipsel
1样本/Lin...C9A3F7
ubuntu-18.04-amd64
6样本/Lin...C9A3F7
debian-9-armhf
6样本/Lin...C9A3F7
debian-9-mips
6样本/Lin...C9A3F7
debian-9-mipsel
6样本/Lin...FECBE5
ubuntu-22.04-amd64
101AAF1A9F78...31.tar
windows7-x64
11AAF1A9F78...31.tar
windows10-2004-x64
1xrx/chattr
ubuntu-24.04-amd64
1xrx/init.sh
ubuntu-22.04-amd64
6xrx/init0
ubuntu-24.04-amd64
8xrx/scp
ubuntu-18.04-amd64
1xrx/scp
debian-9-armhf
1xrx/scp
debian-9-mips
1xrx/scp
debian-9-mipsel
1xrx/secure
ubuntu-24.04-amd64
7xrx/uninstall.sh
ubuntu-18.04-amd64
6xrx/uninstall.sh
debian-9-armhf
6xrx/uninstall.sh
debian-9-mips
6xrx/uninstall.sh
debian-9-mipsel
6xrx/xrx
ubuntu-18.04-amd64
6Analysis
-
max time kernel
0s -
max time network
130s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
26-11-2024 12:41
Behavioral task
behavioral1
Sample
样本/Linux/shc加密脚本/069AD3938C3F9C049F670A8EB49DC1D8
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral3
Sample
样本/Linux/shc加密脚本/73F9917255A953EB749F5A3C90E3B383
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral4
Sample
样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F5973
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
Behavioral task
behavioral5
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
ubuntu1804-amd64-20240508-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral7
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral8
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-armhf-20240729-en
debian-9-armhf
Behavioral task
behavioral11
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral12
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral13
Sample
样本/Linux/挖矿程序/9D099882A24757AC5033B0C675FECBE5
Resource
ubuntu2204-amd64-20240729-en
ubuntu-22.04-amd64
Behavioral task
behavioral14
Sample
1AAF1A9F7877DC2C899D910A52F67F31.tar
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral15
Sample
1AAF1A9F7877DC2C899D910A52F67F31.tar
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
xrx/chattr
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral17
Sample
xrx/init.sh
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral18
Sample
xrx/init0
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral19
Sample
xrx/scp
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
xrx/scp
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral21
Sample
xrx/scp
Resource
debian9-mipsbe-20240729-en
debian-9-mips
Behavioral task
behavioral22
Sample
xrx/scp
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
xrx/secure
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral24
Sample
xrx/uninstall.sh
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral25
Sample
xrx/uninstall.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral26
Sample
xrx/uninstall.sh
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral27
Sample
xrx/uninstall.sh
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
General
-
Target
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
-
Size
2KB
-
MD5
e4cc1a7f992909e8509520fdd6c9a3f7
-
SHA1
2978a46c0be87a65e4371c0682329fbda7f631b0
-
SHA256
5b6783965bcab2350aa9559c6f4c08fe44d7ae764ac8fbdcb7722056a2b000d3
-
SHA512
20e14b888f90e5f5ee3c560326f16be46dfded9cf992a8436295d0318c41336109cc9750e9f3b9e5461cd95fc226da9619af0b65fdcf9093c289df983cb5040b
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/10/stat killall File opened for reading /proc/168/stat killall File opened for reading /proc/163/stat killall File opened for reading /proc/980/cmdline killall File opened for reading /proc/1287/stat killall File opened for reading /proc/1074/stat killall File opened for reading /proc/1050/stat killall File opened for reading /proc/515/stat killall File opened for reading /proc/1050/stat killall File opened for reading /proc/409/cmdline killall File opened for reading /proc/159/stat killall File opened for reading /proc/980/stat killall File opened for reading /proc/115/stat killall File opened for reading /proc/318/stat killall File opened for reading /proc/1123/stat killall File opened for reading /proc/1012/stat killall File opened for reading /proc/988/cmdline killall File opened for reading /proc/9/stat killall File opened for reading /proc/9/stat killall File opened for reading /proc/14/stat killall File opened for reading /proc/665/stat killall File opened for reading /proc/filesystems killall File opened for reading /proc/409/cmdline killall File opened for reading /proc/742/stat killall File opened for reading /proc/1/stat killall File opened for reading /proc/28/stat killall File opened for reading /proc/7/stat killall File opened for reading /proc/12/stat killall File opened for reading /proc/323/stat killall File opened for reading /proc/689/stat killall File opened for reading /proc/1329/stat killall File opened for reading /proc/11/stat killall File opened for reading /proc/160/stat killall File opened for reading /proc/953/stat killall File opened for reading /proc/1464/stat killall File opened for reading /proc/79/cmdline killall File opened for reading /proc/754/cmdline killall File opened for reading /proc/635/cmdline killall File opened for reading /proc/3/stat killall File opened for reading /proc/98/stat killall File opened for reading /proc/1061/stat killall File opened for reading /proc/1157/stat killall File opened for reading /proc/1243/cmdline killall File opened for reading /proc/1115/stat killall File opened for reading /proc/269/stat killall File opened for reading /proc/1273/stat killall File opened for reading /proc/6/stat killall File opened for reading /proc/22/stat killall File opened for reading /proc/78/stat killall File opened for reading /proc/1142/cmdline killall File opened for reading /proc/667/stat killall File opened for reading /proc/1178/cmdline killall File opened for reading /proc/318/cmdline killall File opened for reading /proc/1078/stat killall File opened for reading /proc/583/cmdline killall File opened for reading /proc/173/stat killall File opened for reading /proc/323/stat killall File opened for reading /proc/1366/stat killall File opened for reading /proc/269/stat killall File opened for reading /proc/1489/cmdline killall File opened for reading /proc/1054/stat killall File opened for reading /proc/408/stat killall File opened for reading /proc/1115/stat killall File opened for reading /proc/1127/stat killall -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1510 killall
Processes
-
/tmp/样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7/tmp/样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F71⤵PID:1495
-
/bin/grepgrep Gentoo2⤵PID:1498
-
-
/usr/bin/lsb_releaselsb_release -a2⤵PID:1497
-
/usr/local/sbin/dpkg-querydpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security3⤵PID:1499
-
-
/usr/local/bin/dpkg-querydpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security3⤵PID:1499
-
-
/usr/sbin/dpkg-querydpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security3⤵PID:1499
-
-
/usr/bin/dpkg-querydpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security3⤵PID:1499
-
-
-
/bin/grepgrep Gentoo2⤵PID:1502
-
-
/bin/catcat /etc/issue2⤵PID:1501
-
-
/usr/bin/killallkillall -9 aegis_cli2⤵
- Reads runtime system information
PID:1503
-
-
/usr/bin/killallkillall -9 aegis_update2⤵
- Reads runtime system information
PID:1504
-
-
/usr/bin/killallkillall -9 AliYunDun2⤵
- Reads runtime system information
PID:1505
-
-
/usr/bin/killallkillall -9 AliHids2⤵
- Reads runtime system information
PID:1509
-
-
/usr/bin/killallkillall -9 AliHips2⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:1510
-
-
/usr/bin/killallkillall -9 AliYunDunUpdate2⤵
- Reads runtime system information
PID:1511
-