Overview
overview
10Static
static
10样本/Lin...9DC1D8
ubuntu-24.04-amd64
7样本/Lin...B36C5B
ubuntu-24.04-amd64
6样本/Lin...E3B383
ubuntu-24.04-amd64
8样本/Lin...6F5973
ubuntu-22.04-amd64
1样本/Lin...776DB8
ubuntu-18.04-amd64
1样本/Lin...776DB8
debian-9-armhf
1样本/Lin...776DB8
debian-9-mips
1样本/Lin...776DB8
debian-9-mipsel
1样本/Lin...C9A3F7
ubuntu-18.04-amd64
6样本/Lin...C9A3F7
debian-9-armhf
6样本/Lin...C9A3F7
debian-9-mips
6样本/Lin...C9A3F7
debian-9-mipsel
6样本/Lin...FECBE5
ubuntu-24.04-amd64
101AAF1A9F78...31.tar
ubuntu-18.04-amd64
1AAF1A9F78...31.tar
debian-9-armhf
1AAF1A9F78...31.tar
debian-9-mips
1AAF1A9F78...31.tar
debian-9-mipsel
xrx/chattr
ubuntu-24.04-amd64
1xrx/init.sh
ubuntu-20.04-amd64
6xrx/init0
ubuntu-22.04-amd64
8xrx/scp
ubuntu-18.04-amd64
1xrx/scp
debian-9-armhf
1xrx/scp
debian-9-mips
1xrx/scp
debian-9-mipsel
1xrx/secure
ubuntu-20.04-amd64
7xrx/uninstall.sh
ubuntu-18.04-amd64
6xrx/uninstall.sh
debian-9-armhf
6xrx/uninstall.sh
debian-9-mips
6xrx/uninstall.sh
debian-9-mipsel
6xrx/xrx
ubuntu-22.04-amd64
6Analysis
-
max time kernel
149s -
max time network
153s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240729-en -
resource tags
arch:amd64arch:i386image:ubuntu2204-amd64-20240729-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system -
submitted
27-11-2024 05:48
Behavioral task
behavioral1
Sample
样本/Linux/shc加密脚本/069AD3938C3F9C049F670A8EB49DC1D8
Resource
ubuntu2404-amd64-20240729-en
ubuntu-24.04-amd64
Behavioral task
behavioral2
Sample
样本/Linux/shc加密脚本/42693670C71A529A11E81943F5B36C5B
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral3
Sample
样本/Linux/shc加密脚本/73F9917255A953EB749F5A3C90E3B383
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral4
Sample
样本/Linux/shc加密脚本/CDAFEFEDB4709959B4260435DC6F5973
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral5
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-armhf-20240729-en
debian-9-armhf
Behavioral task
behavioral7
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral8
Sample
样本/Linux/sh恶意脚本/9C8A5EF51CF8A89F5F00498A5A776DB8
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
ubuntu1804-amd64-20240611-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral11
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral12
Sample
样本/Linux/sh恶意脚本/E4CC1A7F992909E8509520FDD6C9A3F7
Resource
debian9-mipsel-20240418-en
debian-9-mipsel
Behavioral task
behavioral13
Sample
样本/Linux/挖矿程序/9D099882A24757AC5033B0C675FECBE5
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral14
Sample
1AAF1A9F7877DC2C899D910A52F67F31.tar
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
1AAF1A9F7877DC2C899D910A52F67F31.tar
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral16
Sample
1AAF1A9F7877DC2C899D910A52F67F31.tar
Resource
debian9-mipsbe-20240418-en
debian-9-mips
Behavioral task
behavioral17
Sample
1AAF1A9F7877DC2C899D910A52F67F31.tar
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
xrx/chattr
Resource
ubuntu2404-amd64-20240523-en
ubuntu-24.04-amd64
Behavioral task
behavioral19
Sample
xrx/init.sh
Resource
ubuntu2004-amd64-20240729-en
ubuntu-20.04-amd64
Behavioral task
behavioral20
Sample
xrx/init0
Resource
ubuntu2204-amd64-20240611-en
ubuntu-22.04-amd64
Behavioral task
behavioral21
Sample
xrx/scp
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral22
Sample
xrx/scp
Resource
debian9-armhf-20240418-en
debian-9-armhf
Behavioral task
behavioral23
Sample
xrx/scp
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral24
Sample
xrx/scp
Resource
debian9-mipsel-20240611-en
debian-9-mipsel
Behavioral task
behavioral25
Sample
xrx/secure
Resource
ubuntu2004-amd64-20240508-en
ubuntu-20.04-amd64
Behavioral task
behavioral26
Sample
xrx/uninstall.sh
Resource
ubuntu1804-amd64-20240729-en
ubuntu-18.04-amd64
Behavioral task
behavioral27
Sample
xrx/uninstall.sh
Resource
debian9-armhf-20240611-en
debian-9-armhf
Behavioral task
behavioral28
Sample
xrx/uninstall.sh
Resource
debian9-mipsbe-20240611-en
debian-9-mips
Behavioral task
behavioral29
Sample
xrx/uninstall.sh
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
General
-
Target
xrx/xrx
-
Size
5.9MB
-
MD5
9d099882a24757ac5033b0c675fecbe5
-
SHA1
1c1b1a4608918b6e95065c86b4a338e245ab36b2
-
SHA256
fb86120a4a1b13b29957eb5f95f7857cf9e469514fc20d25fad02ae87bf99091
-
SHA512
a59a855b10c0b0a0f84cfdfa89ae004c76be08a4879761d588810ef2e5f247298be63e3cd60dd2510ab35e3f3653fa4423ffb579c17f7b3e09ac47c5d4aeb9d0
-
SSDEEP
98304:h5ge1EgVtDw6pvf0pttZppppppZppppRlclclJGToGToGTCaqOpU6cXTpKDL4xW+:hNrD2irwCYM5qDv
Malware Config
Signatures
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/product_name xrx File opened for reading /sys/devices/virtual/dmi/id/board_vendor xrx File opened for reading /sys/devices/virtual/dmi/id/bios_vendor xrx File opened for reading /sys/devices/virtual/dmi/id/sys_vendor xrx -
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
description ioc Process File opened for reading /sys/devices/virtual/dmi/id/chassis_asset_tag xrx File opened for reading /sys/devices/virtual/dmi/id/bios_version xrx File opened for reading /sys/devices/virtual/dmi/id/product_uuid xrx File opened for reading /sys/devices/virtual/dmi/id/board_serial xrx File opened for reading /sys/devices/virtual/dmi/id/board_asset_tag xrx File opened for reading /sys/devices/virtual/dmi/id/chassis_vendor xrx File opened for reading /sys/devices/virtual/dmi/id/chassis_type xrx File opened for reading /sys/devices/virtual/dmi/id/chassis_version xrx File opened for reading /sys/devices/virtual/dmi/id/product_version xrx File opened for reading /sys/devices/virtual/dmi/id/chassis_serial xrx File opened for reading /sys/devices/virtual/dmi/id/board_name xrx File opened for reading /sys/devices/virtual/dmi/id/board_version xrx File opened for reading /sys/devices/virtual/dmi/id/product_serial xrx File opened for reading /sys/devices/virtual/dmi/id/bios_date xrx -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo xrx -
Reads CPU attributes 1 TTPs 3 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online xrx File opened for reading /sys/devices/system/cpu/types xrx File opened for reading /sys/devices/system/cpu/possible xrx -
Enumerates kernel/hardware configuration 1 TTPs 60 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/bus/node/devices/node0/hugepages xrx File opened for reading /sys/bus/node/devices/node0/hugepages/hugepages-1048576kB/nr_hugepages xrx File opened for reading /sys/firmware/dmi/tables/DMI xrx File opened for reading /sys/bus/cpu/devices/cpu0/cpufreq/base_frequency xrx File opened for reading /sys/kernel/mm/hugepages/hugepages-2048kB/nr_hugepages xrx File opened for reading /sys/bus/dax/target_node xrx File opened for reading /sys/bus/node/devices/node0/access1/initiators xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/level xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index9/shared_cpu_map xrx File opened for reading /sys/kernel/mm/hugepages xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/number_of_sets xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/size xrx File opened for reading /sys/bus/node/devices/node0/meminfo xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/coherency_line_size xrx File opened for reading /sys/bus/node/devices/node0/cpumap xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index4/shared_cpu_map xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index5/shared_cpu_map xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index7/shared_cpu_map xrx File opened for reading /sys/devices/system/node/online xrx File opened for reading /sys/bus/node/devices/node0/access0/initiators xrx File opened for reading /sys/bus/cpu/devices xrx File opened for reading /sys/bus/cpu/devices/cpu0/topology/die_cpus xrx File opened for reading /sys/bus/cpu/devices/cpu0/topology/physical_package_id xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/physical_line_partition xrx File opened for reading /sys/fs/cgroup/cgroup.controllers xrx File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_id xrx File opened for reading /sys/kernel/mm/hugepages/hugepages-1048576kB/nr_hugepages xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/level xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index8/shared_cpu_map xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/number_of_sets xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/type xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/shared_cpu_map xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/physical_line_partition xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/type xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/shared_cpu_map xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/physical_line_partition xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index6/shared_cpu_map xrx File opened for reading /sys/bus/cpu/devices/cpu0/topology/core_cpus xrx File opened for reading /sys/bus/cpu/devices/cpu0/topology/package_cpus xrx File opened for reading /sys/devices/virtual/dmi/id xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/type xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/size xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index1/shared_cpu_map xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/level xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/type xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/coherency_line_size xrx File opened for reading /sys/fs/cgroup/cpuset.mems.effective xrx File opened for reading /sys/bus/cpu/devices/cpu0/cpufreq/cpuinfo_max_freq xrx File opened for reading /sys/bus/dax/devices/target_node xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/number_of_sets xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/level xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index3/size xrx File opened for reading /sys/bus/node/devices/node0/access0/initiators/read_bandwidth xrx File opened for reading /sys/firmware/dmi/tables/smbios_entry_point xrx File opened for reading /sys/fs/cgroup/cpuset.cpus.effective xrx File opened for reading /sys/bus/node/devices/node0/hugepages/hugepages-2048kB/nr_hugepages xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index0/coherency_line_size xrx File opened for reading /sys/bus/cpu/devices/cpu0/cache/index2/shared_cpu_map xrx File opened for reading /sys/bus/dax/devices xrx File opened for reading /sys/bus/node/devices/node0/access0/initiators/read_latency xrx -
description ioc Process File opened for reading /proc/driver/nvidia/gpus xrx File opened for reading /proc/mounts xrx File opened for reading /proc/self/cpuset xrx File opened for reading /proc/meminfo xrx