Overview
overview
10Static
static
10xrx/chattr
ubuntu-18.04-amd64
1xrx/config.json
ubuntu-18.04-amd64
xrx/config.json
debian-9-armhf
xrx/config.json
debian-9-mips
xrx/config.json
debian-9-mipsel
xrx/init.sh
ubuntu-24.04-amd64
6xrx/init0
ubuntu-22.04-amd64
8xrx/key
ubuntu-18.04-amd64
xrx/key
debian-9-armhf
xrx/key
debian-9-mips
xrx/key
debian-9-mipsel
xrx/scp
ubuntu-18.04-amd64
1xrx/scp
debian-9-armhf
1xrx/scp
debian-9-mips
1xrx/scp
debian-9-mipsel
1xrx/secure
ubuntu-22.04-amd64
7xrx/uninstall.sh
ubuntu-18.04-amd64
6xrx/uninstall.sh
debian-9-armhf
6xrx/uninstall.sh
debian-9-mips
6xrx/uninstall.sh
debian-9-mipsel
6xrx/xrx
ubuntu-24.04-amd64
6Analysis
-
max time kernel
0s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240611-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
27-11-2024 08:55
Behavioral task
behavioral1
Sample
xrx/chattr
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
xrx/config.json
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral3
Sample
xrx/config.json
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral4
Sample
xrx/config.json
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral5
Sample
xrx/config.json
Resource
debian9-mipsel-20240729-en
Behavioral task
behavioral6
Sample
xrx/init.sh
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral7
Sample
xrx/init0
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral8
Sample
xrx/key
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral9
Sample
xrx/key
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral10
Sample
xrx/key
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral11
Sample
xrx/key
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral12
Sample
xrx/scp
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral13
Sample
xrx/scp
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral14
Sample
xrx/scp
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral15
Sample
xrx/scp
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral16
Sample
xrx/secure
Resource
ubuntu2204-amd64-20240729-en
Behavioral task
behavioral17
Sample
xrx/uninstall.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral18
Sample
xrx/uninstall.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral19
Sample
xrx/uninstall.sh
Resource
debian9-mipsbe-20240729-en
Behavioral task
behavioral20
Sample
xrx/uninstall.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
xrx/uninstall.sh
-
Size
2KB
-
MD5
e4cc1a7f992909e8509520fdd6c9a3f7
-
SHA1
2978a46c0be87a65e4371c0682329fbda7f631b0
-
SHA256
5b6783965bcab2350aa9559c6f4c08fe44d7ae764ac8fbdcb7722056a2b000d3
-
SHA512
20e14b888f90e5f5ee3c560326f16be46dfded9cf992a8436295d0318c41336109cc9750e9f3b9e5461cd95fc226da9619af0b65fdcf9093c289df983cb5040b
Malware Config
Signatures
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Processes:
killallkillallkillallkillallkillallkillalldescription ioc Process File opened for reading /proc/168/stat killall File opened for reading /proc/98/stat killall File opened for reading /proc/5/stat killall File opened for reading /proc/13/stat killall File opened for reading /proc/241/stat killall File opened for reading /proc/203/stat killall File opened for reading /proc/1157/stat killall File opened for reading /proc/485/stat killall File opened for reading /proc/485/stat killall File opened for reading /proc/26/stat killall File opened for reading /proc/1135/cmdline killall File opened for reading /proc/5/stat killall File opened for reading /proc/82/stat killall File opened for reading /proc/1192/stat killall File opened for reading /proc/1167/stat killall File opened for reading /proc/1193/stat killall File opened for reading /proc/534/stat killall File opened for reading /proc/1327/stat killall File opened for reading /proc/1/stat killall File opened for reading /proc/171/stat killall File opened for reading /proc/35/stat killall File opened for reading /proc/32/stat killall File opened for reading /proc/4/stat killall File opened for reading /proc/1131/stat killall File opened for reading /proc/15/stat killall File opened for reading /proc/30/stat killall File opened for reading /proc/1122/stat killall File opened for reading /proc/1355/cmdline killall File opened for reading /proc/168/stat killall File opened for reading /proc/963/stat killall File opened for reading /proc/1506/stat killall File opened for reading /proc/1139/cmdline killall File opened for reading /proc/420/stat killall File opened for reading /proc/18/stat killall File opened for reading /proc/555/stat killall File opened for reading /proc/80/stat killall File opened for reading /proc/164/stat killall File opened for reading /proc/415/stat killall File opened for reading /proc/500/stat killall File opened for reading /proc/499/stat killall File opened for reading /proc/1520/stat killall File opened for reading /proc/546/cmdline killall File opened for reading /proc/1153/stat killall File opened for reading /proc/4/stat killall File opened for reading /proc/21/stat killall File opened for reading /proc/170/stat killall File opened for reading /proc/83/stat killall File opened for reading /proc/21/stat killall File opened for reading /proc/173/stat killall File opened for reading /proc/1192/stat killall File opened for reading /proc/1195/stat killall File opened for reading /proc/956/cmdline killall File opened for reading /proc/1313/stat killall File opened for reading /proc/503/stat killall File opened for reading /proc/1289/cmdline killall File opened for reading /proc/1295/stat killall File opened for reading /proc/455/stat killall File opened for reading /proc/3/stat killall File opened for reading /proc/36/stat killall File opened for reading /proc/653/stat killall File opened for reading /proc/115/cmdline killall File opened for reading /proc/1258/cmdline killall File opened for reading /proc/1289/stat killall File opened for reading /proc/10/stat killall -
System Network Configuration Discovery 1 TTPs 1 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/xrx/uninstall.sh/tmp/xrx/uninstall.sh1⤵PID:1510
-
/bin/grepgrep Gentoo2⤵PID:1513
-
-
/usr/bin/lsb_releaselsb_release -a2⤵PID:1512
-
/usr/local/sbin/dpkg-querydpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security3⤵PID:1514
-
-
/usr/local/bin/dpkg-querydpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security3⤵PID:1514
-
-
/usr/sbin/dpkg-querydpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security3⤵PID:1514
-
-
/usr/bin/dpkg-querydpkg-query -f "\${Version} \${Provides} " -W lsb-core lsb-cxx lsb-graphics lsb-desktop lsb-languages lsb-multimedia lsb-printing lsb-security3⤵PID:1514
-
-
-
/bin/grepgrep Gentoo2⤵PID:1517
-
-
/bin/catcat /etc/issue2⤵PID:1516
-
-
/usr/bin/killallkillall -9 aegis_cli2⤵
- Reads runtime system information
PID:1518
-
-
/usr/bin/killallkillall -9 aegis_update2⤵
- Reads runtime system information
PID:1519
-
-
/usr/bin/killallkillall -9 AliYunDun2⤵
- Reads runtime system information
PID:1523
-
-
/usr/bin/killallkillall -9 AliHids2⤵
- Reads runtime system information
PID:1524
-
-
/usr/bin/killallkillall -9 AliHips2⤵
- Reads runtime system information
- System Network Configuration Discovery
PID:1525
-
-
/usr/bin/killallkillall -9 AliYunDunUpdate2⤵
- Reads runtime system information
PID:1526
-