Overview
overview
10Static
static
10xrx/chattr
ubuntu-18.04-amd64
1xrx/config.json
ubuntu-18.04-amd64
xrx/config.json
debian-9-armhf
xrx/config.json
debian-9-mips
xrx/config.json
debian-9-mipsel
xrx/init.sh
ubuntu-24.04-amd64
6xrx/init0
ubuntu-22.04-amd64
8xrx/key
ubuntu-18.04-amd64
xrx/key
debian-9-armhf
xrx/key
debian-9-mips
xrx/key
debian-9-mipsel
xrx/scp
ubuntu-18.04-amd64
1xrx/scp
debian-9-armhf
1xrx/scp
debian-9-mips
1xrx/scp
debian-9-mipsel
1xrx/secure
ubuntu-22.04-amd64
7xrx/uninstall.sh
ubuntu-18.04-amd64
6xrx/uninstall.sh
debian-9-armhf
6xrx/uninstall.sh
debian-9-mips
6xrx/uninstall.sh
debian-9-mipsel
6xrx/xrx
ubuntu-24.04-amd64
6Analysis
-
max time kernel
140s -
max time network
132s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
27-11-2024 08:55
Behavioral task
behavioral1
Sample
xrx/chattr
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
xrx/config.json
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral3
Sample
xrx/config.json
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral4
Sample
xrx/config.json
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral5
Sample
xrx/config.json
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral6
Sample
xrx/init.sh
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral7
Sample
xrx/init0
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral8
Sample
xrx/key
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral9
Sample
xrx/key
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral10
Sample
xrx/key
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral11
Sample
xrx/key
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral12
Sample
xrx/scp
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral13
Sample
xrx/scp
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral14
Sample
xrx/scp
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral15
Sample
xrx/scp
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral16
Sample
xrx/secure
Resource
ubuntu2204-amd64-20240729-en
Behavioral task
behavioral17
Sample
xrx/uninstall.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral18
Sample
xrx/uninstall.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral19
Sample
xrx/uninstall.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral20
Sample
xrx/uninstall.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
xrx/scp
-
Size
63B
-
MD5
7e21ae4da5edbbe4adaeacd5f7c1ece6
-
SHA1
f5574230833e98e010ecea9ceb027c2981f57488
-
SHA256
fc26873006164decacbcfb01d246b54539b786b404be0bb1a5cde5263031663a
-
SHA512
113ca3b1217fa477acd003d65faac8913e805281ae7f664a7a91d6195c0e354831645238f98c6c9d7fe622587065e1db5e7d2a2385ad32ff17b6644832563b1c
Malware Config
Signatures
Processes
-
/tmp/xrx/scp/tmp/xrx/scp1⤵PID:1497
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1498
-
-
/bin/sleepsleep 102⤵PID:1499
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1511
-
-
/bin/sleepsleep 102⤵PID:1512
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1513
-
-
/bin/sleepsleep 102⤵PID:1514
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1517
-
-
/bin/sleepsleep 102⤵PID:1518
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1519
-
-
/bin/sleepsleep 102⤵PID:1520
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1521
-
-
/bin/sleepsleep 102⤵PID:1522
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1523
-
-
/bin/sleepsleep 102⤵PID:1524
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1525
-
-
/bin/sleepsleep 102⤵PID:1526
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1527
-
-
/bin/sleepsleep 102⤵PID:1528
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1529
-
-
/bin/sleepsleep 102⤵PID:1530
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1531
-
-
/bin/sleepsleep 102⤵PID:1532
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1533
-
-
/bin/sleepsleep 102⤵PID:1534
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1535
-
-
/bin/sleepsleep 102⤵PID:1536
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1537
-
-
/bin/sleepsleep 102⤵PID:1538
-
-
/dev/shm/.x/secure/dev/shm/.x/secure2⤵PID:1539
-
-
/bin/sleepsleep 102⤵PID:1540
-