Analysis

  • max time kernel
    0s
  • max time network
    132s
  • platform
    ubuntu-24.04_amd64
  • resource
    ubuntu2404-amd64-20250307-en
  • resource tags

    arch:amd64arch:i386image:ubuntu2404-amd64-20250307-enkernel:6.8.0-31-genericlocale:en-usos:ubuntu-24.04-amd64system
  • submitted
    19/03/2025, 06:15

General

  • Target

    uptime

  • Size

    1.3MB

  • MD5

    3360733db8c342e4e27c386e439f19fd

  • SHA1

    d0eb93bcf9e275455fdb3f413c9bff0798175f7e

  • SHA256

    f3bf42a350f7ee3632cb7de5429d4788c685c6a8df5c8ff7016ddcef26c58756

  • SHA512

    f7d3c3dd3efa669ca7f8398d9f65a6b584119b86f2a27f0c9fb422f9170972dd9b54897614d3585f7b8ccb89dbe479636010897b92e86f73affe7c9d07f9a842

  • SSDEEP

    24576:k/MVGU9AEwutWTdz+1MSUNaFLNS1SuSSVCI0:kUoQAEw3Tdz+1MSUN+LNCr

Score
3/10

Malware Config

Signatures

  • Reads runtime system information 3 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/uptime
    /tmp/uptime
    1⤵
      PID:2547
    • /bin/bash
      /bin/bash /dev/fd/3
      1⤵
        PID:2547
        • /usr/bin/date
          date "+%T"
          2⤵
            PID:2550
          • /usr/bin/awk
            awk "-F[a-z]:" "{ print \$2 }"
            2⤵
            • Reads runtime system information
            PID:2553
          • /usr/bin/awk
            awk "-F, " "{print \$1, \$2, \$3}"
            2⤵
            • Reads runtime system information
            PID:2554
          • /usr/bin/wc
            wc -l
            2⤵
              PID:2557
            • /usr/bin/who
              who
              2⤵
                PID:2556
              • /usr/bin/awk
                awk "{print \$3 \" \" \$4 \" \" \$5 \" \" \$6}"
                2⤵
                • Reads runtime system information
                PID:2560

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • /usr/share/zoneinfo/CTE

              Filesize

              3B

              MD5

              2c744dffd279d7e9e0910ce594eb4f4f

              SHA1

              9aa23bb69d6a07ff8bac5ee2f86f600939ed47b7

              SHA256

              8855c6119660c614d285554e51769066e94fcb75ff215ccc2fa6b4838b18756b

              SHA512

              273f657f512693340d8d1f1f5a257ae7bb676f7e9887b9b79e15ab0084ee9c0562e3a93153762480522168867eff2acc0a4ce22406a18cd84382f8498a78369a