Overview

overview

10

Static

static

10

xrx/chattr

ubuntu-18.04-amd64

1

xrx/config.json

ubuntu-18.04-amd64

xrx/config.json

debian-9-armhf

xrx/config.json

debian-9-mips

xrx/config.json

debian-9-mipsel

xrx/init.sh

ubuntu-24.04-amd64

6

xrx/init0

ubuntu-22.04-amd64

8

xrx/key

ubuntu-18.04-amd64

xrx/key

debian-9-armhf

xrx/key

debian-9-mips

xrx/key

debian-9-mipsel

xrx/scp

ubuntu-18.04-amd64

1

xrx/scp

debian-9-armhf

1

xrx/scp

debian-9-mips

1

xrx/scp

debian-9-mipsel

1

xrx/secure

ubuntu-22.04-amd64

7

xrx/uninstall.sh

ubuntu-18.04-amd64

6

xrx/uninstall.sh

debian-9-armhf

6

xrx/uninstall.sh

debian-9-mips

6

xrx/uninstall.sh

debian-9-mipsel

6

xrx/xrx

ubuntu-24.04-amd64

6

Resubmissions

27-11-2024 08:55

241127-kvn92stkar 10

27-11-2024 05:48

241127-ghggwszqes 10

Analysis

  • max time kernel
    140s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    27-11-2024 08:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    xrx/scp

  • Size

    63B

  • MD5

    7e21ae4da5edbbe4adaeacd5f7c1ece6

  • SHA1

    f5574230833e98e010ecea9ceb027c2981f57488

  • SHA256

    fc26873006164decacbcfb01d246b54539b786b404be0bb1a5cde5263031663a

  • SHA512

    113ca3b1217fa477acd003d65faac8913e805281ae7f664a7a91d6195c0e354831645238f98c6c9d7fe622587065e1db5e7d2a2385ad32ff17b6644832563b1c

Score
1/10

Malware Config

Signatures

Processes

  • /tmp/xrx/scp
    /tmp/xrx/scp
    1⤵
      PID:676
      • /dev/shm/.x/secure
        /dev/shm/.x/secure
        2⤵
          PID:678
        • /bin/sleep
          sleep 10
          2⤵
            PID:679
          • /dev/shm/.x/secure
            /dev/shm/.x/secure
            2⤵
              PID:761
            • /bin/sleep
              sleep 10
              2⤵
                PID:762
              • /dev/shm/.x/secure
                /dev/shm/.x/secure
                2⤵
                  PID:765
                • /bin/sleep
                  sleep 10
                  2⤵
                    PID:766
                  • /dev/shm/.x/secure
                    /dev/shm/.x/secure
                    2⤵
                      PID:772
                    • /bin/sleep
                      sleep 10
                      2⤵
                        PID:773
                      • /dev/shm/.x/secure
                        /dev/shm/.x/secure
                        2⤵
                          PID:776
                        • /bin/sleep
                          sleep 10
                          2⤵
                            PID:777
                          • /dev/shm/.x/secure
                            /dev/shm/.x/secure
                            2⤵
                              PID:780
                            • /bin/sleep
                              sleep 10
                              2⤵
                                PID:781
                              • /dev/shm/.x/secure
                                /dev/shm/.x/secure
                                2⤵
                                  PID:784
                                • /bin/sleep
                                  sleep 10
                                  2⤵
                                    PID:785
                                  • /dev/shm/.x/secure
                                    /dev/shm/.x/secure
                                    2⤵
                                      PID:788
                                    • /bin/sleep
                                      sleep 10
                                      2⤵
                                        PID:789
                                      • /dev/shm/.x/secure
                                        /dev/shm/.x/secure
                                        2⤵
                                          PID:792
                                        • /bin/sleep
                                          sleep 10
                                          2⤵
                                            PID:793
                                          • /dev/shm/.x/secure
                                            /dev/shm/.x/secure
                                            2⤵
                                              PID:796
                                            • /bin/sleep
                                              sleep 10
                                              2⤵
                                                PID:797
                                              • /dev/shm/.x/secure
                                                /dev/shm/.x/secure
                                                2⤵
                                                  PID:800
                                                • /bin/sleep
                                                  sleep 10
                                                  2⤵
                                                    PID:801
                                                  • /dev/shm/.x/secure
                                                    /dev/shm/.x/secure
                                                    2⤵
                                                      PID:804
                                                    • /bin/sleep
                                                      sleep 10
                                                      2⤵
                                                        PID:805
                                                      • /dev/shm/.x/secure
                                                        /dev/shm/.x/secure
                                                        2⤵
                                                          PID:808
                                                        • /bin/sleep
                                                          sleep 10
                                                          2⤵
                                                            PID:809
                                                          • /dev/shm/.x/secure
                                                            /dev/shm/.x/secure
                                                            2⤵
                                                              PID:812
                                                            • /bin/sleep
                                                              sleep 10
                                                              2⤵
                                                                PID:813
                                                              • /dev/shm/.x/secure
                                                                /dev/shm/.x/secure
                                                                2⤵
                                                                  PID:817
                                                                • /bin/sleep
                                                                  sleep 10
                                                                  2⤵
                                                                    PID:818

                                                                Network

                                                                MITRE ATT&CK Matrix

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads