efb5dd988589695eeaf0c856214bc3d318ea3cb860b854fb2e8a703452cd9d09

Analysis

max time kernel
86s
max time network
150s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20250619-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20250619-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
18/07/2025, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cron.elf
Size 85KB
Sample250718-a2falsfk4s
SHA256 efb5dd988589695eeaf0c856214bc3d318ea3cb860b854fb2e8a703452cd9d09
MD5 ec189510f0181cba47f86d47b94392bb
SHA1 ac761720a2545694bcfe70f81fd65040ca72a559
SHA512 05f5071278acc565c8e3d4c443b5eddf229de09284c02c38a12c35b613c68d89ddd0696f02241e2f1b78f0957d2ac1d77201ec43b3ece2e3ad7c0f2bf7552b0c
SSDEEP 1536:PQSj7HELqqj/nJQB35TNBoWDqNU1TrWCG46yPjJH7WoFg:PQScLqqj/JqrOoTrWCGpysoi
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (148233) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Watchdog functionality 1 TTPs 2 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc
File opened for modification	/dev/watchdog
File opened for modification	/dev/misc/watchdog

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 1 IoCs

description	ioc
File opened for modification	/bin/watchdog

Changes its process name 1 IoCs

description	ioc	pid
Changes the process name, possibly in an attempt to hide itself	ssh	1571

Reads CPU attributes 1 TTPs 17 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/722/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/691/stat	killall
File opened for reading	/proc/193/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/735/status	pkill
File opened for reading	/proc/735/stat	killall
File opened for reading	/proc/683/stat	killall
File opened for reading	/proc/174/stat	killall
File opened for reading	/proc/1121/stat	killall
File opened for reading	/proc/722/cmdline	pkill
File opened for reading	/proc/95/stat	killall
File opened for reading	/proc/1791/stat	killall
File opened for reading	/proc/1020/stat	killall
File opened for reading	/proc/504/stat	killall
File opened for reading	/proc/613/stat	killall
File opened for reading	/proc/1214/stat	killall
File opened for reading	/proc/1319/stat	killall
File opened for reading	/proc/1117/stat	killall
File opened for reading	/proc/1098/stat	killall
File opened for reading	/proc/947/stat	killall
File opened for reading	/proc/972/stat	killall
File opened for reading	/proc/947/stat	killall
File opened for reading	/proc/611/stat	killall
File opened for reading	/proc/191/stat	killall
File opened for reading	/proc/174/stat	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/1046/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/1059/stat	killall
File opened for reading	/proc/1473/cmdline	pkill
File opened for reading	/proc/114/stat	killall
File opened for reading	/proc/947/stat	killall
File opened for reading	/proc/411/stat	killall
File opened for reading	/proc/95/stat	killall
File opened for reading	/proc/1218/stat	killall
File opened for reading	/proc/185/stat	killall
File opened for reading	/proc/894/stat	killall
File opened for reading	/proc/89/stat	killall
File opened for reading	/proc/802/cmdline	pkill
File opened for reading	/proc/160/stat	killall
File opened for reading	/proc/189/stat	killall
File opened for reading	/proc/182/status	pkill
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/1028/stat	killall
File opened for reading	/proc/1108/cmdline	pkill
File opened for reading	/proc/585/stat	killall
File opened for reading	/proc/199/cmdline	pkill
File opened for reading	/proc/505/stat	killall
File opened for reading	/proc/1331/stat	killall
File opened for reading	/proc/722/status	pkill
File opened for reading	/proc/768/stat	killall
File opened for reading	/proc/314/cmdline	pkill
File opened for reading	/proc/199/stat	killall
File opened for reading	/proc/585/stat	killall
File opened for reading	/proc/1098/stat	killall
File opened for reading	/proc/1105/stat	killall
File opened for reading	/proc/611/stat	killall
File opened for reading	/proc/1090/stat	killall
File opened for reading	/proc/1098/stat	killall
File opened for reading	/proc/1205/stat	killall
File opened for reading	/proc/1574/stat	killall
File opened for reading	/proc/411/stat	killall

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
PID:1582

/usr/bin/killall
killall -9 ps
1⤵
PID:1584

/usr/bin/killall
killall -9 python
1⤵
PID:1586

/usr/bin/killall
killall -9 nc
1⤵
PID:1588

/usr/bin/killall
killall -9 netcat
1⤵
- Reads runtime system information
PID:1590

/usr/bin/killall
killall -9 tftp
1⤵
PID:1592

/usr/bin/killall
killall -9 wget
1⤵
PID:1594

/usr/bin/killall
killall -9 curl
1⤵
PID:1596

/usr/bin/killall
killall -9 busybox
1⤵
- Reads runtime system information
PID:1598

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1600

/usr/bin/killall
killall -9 ps
1⤵
PID:1602

/usr/bin/killall
killall -9 python
1⤵
PID:1604

/usr/bin/killall
killall -9 nc
1⤵
PID:1606

/usr/bin/killall
killall -9 netcat
1⤵
PID:1608

/usr/bin/killall
killall -9 tftp
1⤵
PID:1610

/usr/bin/killall
killall -9 wget
1⤵
PID:1612

/usr/bin/killall
killall -9 curl
1⤵
PID:1614

/usr/bin/killall
killall -9 busybox
1⤵
PID:1616

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1618

/usr/bin/killall
killall -9 ps
1⤵
- Reads runtime system information
PID:1620

/usr/bin/killall
killall -9 python
1⤵
PID:1622

/usr/bin/killall
killall -9 nc
1⤵
PID:1624

/usr/bin/killall
killall -9 netcat
1⤵
PID:1626

/usr/bin/killall
killall -9 tftp
1⤵
PID:1628

/usr/bin/killall
killall -9 wget
1⤵
PID:1630

/usr/bin/killall
killall -9 curl
1⤵
- Reads runtime system information
PID:1632

/usr/bin/killall
killall -9 busybox
1⤵
PID:1634

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1636

/usr/bin/killall
killall -9 ps
1⤵
- Reads runtime system information
PID:1638

/usr/bin/killall
killall -9 python
1⤵
- Reads runtime system information
PID:1640

/usr/bin/killall
killall -9 nc
1⤵
PID:1642

/usr/bin/killall
killall -9 netcat
1⤵
PID:1644

/usr/bin/killall
killall -9 tftp
1⤵
PID:1646

/usr/bin/killall
killall -9 wget
1⤵
PID:1648

/usr/bin/killall
killall -9 curl
1⤵
- Reads runtime system information
PID:1650

/usr/bin/killall
killall -9 busybox
1⤵
- Reads runtime system information
PID:1652

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1654

/usr/bin/killall
killall -9 ps
1⤵
PID:1656

/usr/bin/killall
killall -9 python
1⤵
PID:1658

/usr/bin/killall
killall -9 nc
1⤵
PID:1660

/usr/bin/killall
killall -9 netcat
1⤵
- Reads runtime system information
PID:1662

/usr/bin/killall
killall -9 tftp
1⤵
PID:1664

/usr/bin/killall
killall -9 wget
1⤵
PID:1666

/usr/bin/killall
killall -9 curl
1⤵
- Reads runtime system information
PID:1668

/usr/bin/killall
killall -9 busybox
1⤵
PID:1670

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
PID:1672

/usr/bin/killall
killall -9 ps
1⤵
PID:1674

/usr/bin/killall
killall -9 python
1⤵
- Reads runtime system information
PID:1676

/usr/bin/killall
killall -9 nc
1⤵
PID:1678

/usr/bin/killall
killall -9 netcat
1⤵
- Reads runtime system information
PID:1680

/usr/bin/killall
killall -9 tftp
1⤵
- Reads runtime system information
PID:1682

/usr/bin/killall
killall -9 wget
1⤵
PID:1684

/usr/bin/killall
killall -9 curl
1⤵
PID:1686

/usr/bin/killall
killall -9 busybox
1⤵
- Reads runtime system information
PID:1688

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
PID:1694

/usr/bin/killall
killall -9 ps
1⤵
PID:1696

/usr/bin/killall
killall -9 python
1⤵
- Reads runtime system information
PID:1698

/usr/bin/killall
killall -9 nc
1⤵
PID:1700

/usr/bin/killall
killall -9 netcat
1⤵
PID:1702

/usr/bin/killall
killall -9 tftp
1⤵
- Reads runtime system information
PID:1704

/usr/bin/killall
killall -9 wget
1⤵
- Reads runtime system information
PID:1706

/usr/bin/killall
killall -9 curl
1⤵
PID:1708

/usr/bin/killall
killall -9 busybox
1⤵
PID:1710

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1715

/usr/bin/killall
killall -9 ps
1⤵
PID:1717

/usr/bin/killall
killall -9 python
1⤵
PID:1719

/usr/bin/killall
killall -9 nc
1⤵
PID:1721

/usr/bin/killall
killall -9 netcat
1⤵
PID:1723

/usr/bin/killall
killall -9 tftp
1⤵
- Reads runtime system information
PID:1725

/usr/bin/killall
killall -9 wget
1⤵
PID:1727

/usr/bin/killall
killall -9 curl
1⤵
PID:1729

/usr/bin/killall
killall -9 busybox
1⤵
- Reads runtime system information
PID:1731

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
PID:1733

/usr/bin/killall
killall -9 ps
1⤵
- Reads runtime system information
PID:1735

/usr/bin/killall
killall -9 python
1⤵
PID:1737

/usr/bin/killall
killall -9 nc
1⤵
- Reads runtime system information
PID:1739

/usr/bin/killall
killall -9 netcat
1⤵
PID:1741

/usr/bin/killall
killall -9 tftp
1⤵
PID:1743

/usr/bin/killall
killall -9 wget
1⤵
PID:1745

/usr/bin/killall
killall -9 curl
1⤵
- Reads runtime system information
PID:1747

/usr/bin/killall
killall -9 busybox
1⤵
PID:1749

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
PID:1753

/usr/bin/killall
killall -9 ps
1⤵
PID:1755

/usr/bin/killall
killall -9 python
1⤵
PID:1757

/usr/bin/killall
killall -9 nc
1⤵
- Reads runtime system information
PID:1759

/usr/bin/killall
killall -9 netcat
1⤵
PID:1761

/usr/bin/killall
killall -9 tftp
1⤵
PID:1763

/usr/bin/killall
killall -9 wget
1⤵
PID:1765

/usr/bin/killall
killall -9 curl
1⤵
PID:1767

/usr/bin/killall
killall -9 busybox
1⤵
PID:1769

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1771

/usr/bin/killall
killall -9 ps
1⤵
PID:1773

/usr/bin/killall
killall -9 python
1⤵
PID:1775

/usr/bin/killall
killall -9 nc
1⤵
PID:1777

/usr/bin/killall
killall -9 netcat
1⤵
PID:1779

/usr/bin/killall
killall -9 tftp
1⤵
PID:1781

/usr/bin/killall
killall -9 wget
1⤵
PID:1783

/usr/bin/killall
killall -9 curl
1⤵
PID:1785

/usr/bin/killall
killall -9 busybox
1⤵
PID:1787

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
PID:1789

/usr/bin/killall
killall -9 ps
1⤵
PID:1793

/usr/bin/killall
killall -9 python
1⤵
PID:1795

/usr/bin/killall
killall -9 nc
1⤵
- Reads runtime system information
PID:1797

/usr/bin/killall
killall -9 netcat
1⤵
- Reads runtime system information
PID:1799

/usr/bin/killall
killall -9 tftp
1⤵
- Reads runtime system information
PID:1801

/usr/bin/killall
killall -9 wget
1⤵
- Reads runtime system information
PID:1803

/usr/bin/killall
killall -9 curl
1⤵
PID:1805

/usr/bin/killall
killall -9 busybox
1⤵
- Reads runtime system information
PID:1807

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
PID:1816

/usr/bin/killall
killall -9 ps
1⤵
PID:1818

/usr/bin/killall
killall -9 python
1⤵
PID:1820

/usr/bin/killall
killall -9 nc
1⤵
- Reads runtime system information
PID:1822

/usr/bin/killall
killall -9 netcat
1⤵
PID:1824

/usr/bin/killall
killall -9 tftp
1⤵
- Reads runtime system information
PID:1826

/usr/bin/killall
killall -9 wget
1⤵
- Reads runtime system information
PID:1828

/usr/bin/killall
killall -9 curl
1⤵
- Reads runtime system information
PID:1830

/usr/bin/killall
killall -9 busybox
1⤵
PID:1832

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
PID:1834

/usr/bin/killall
killall -9 ps
1⤵
- Reads runtime system information
PID:1838

/usr/bin/killall
killall -9 python
1⤵
- Reads runtime system information
PID:1840

/usr/bin/killall
killall -9 nc
1⤵
- Reads runtime system information
PID:1842

/usr/bin/killall
killall -9 netcat
1⤵
PID:1844

/usr/bin/killall
killall -9 tftp
1⤵
- Reads runtime system information
PID:1846

/usr/bin/killall
killall -9 wget
1⤵
- Reads runtime system information
PID:1848

/usr/bin/killall
killall -9 curl
1⤵
PID:1850

/usr/bin/killall
killall -9 busybox
1⤵
PID:1852

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1854

/usr/bin/killall
killall -9 ps
1⤵
- Reads runtime system information
PID:1856

/usr/bin/killall
killall -9 python
1⤵
- Reads runtime system information
PID:1858

/usr/bin/killall
killall -9 nc
1⤵
PID:1860

/usr/bin/killall
killall -9 netcat
1⤵
- Reads runtime system information
PID:1862

/usr/bin/killall
killall -9 tftp
1⤵
PID:1864

/usr/bin/killall
killall -9 wget
1⤵
PID:1866

/usr/bin/killall
killall -9 curl
1⤵
PID:1868

/usr/bin/killall
killall -9 busybox
1⤵
- Reads runtime system information
PID:1870

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1874

/usr/bin/killall
killall -9 ps
1⤵
PID:1876

/usr/bin/killall
killall -9 python
1⤵
PID:1878

/usr/bin/killall
killall -9 nc
1⤵
- Reads runtime system information
PID:1880

/usr/bin/killall
killall -9 netcat
1⤵
PID:1882

/usr/bin/killall
killall -9 tftp
1⤵
PID:1884

/usr/bin/killall
killall -9 wget
1⤵
PID:1886

/usr/bin/killall
killall -9 curl
1⤵
PID:1888

/usr/bin/killall
killall -9 busybox
1⤵
PID:1890

/usr/bin/pkill
pkill -9 "\\.sh"
1⤵
- Reads CPU attributes
PID:1892

/usr/bin/killall
killall -9 ps
1⤵
PID:1894

/usr/bin/killall
killall -9 python
1⤵
PID:1896

/usr/bin/killall
killall -9 nc
1⤵
- Reads runtime system information
PID:1898

/usr/bin/killall
killall -9 netcat
1⤵
PID:1900

/usr/bin/killall
killall -9 tftp
1⤵
- Reads runtime system information
PID:1902

/usr/bin/killall
killall -9 wget
1⤵
PID:1904

/usr/bin/killall
killall -9 curl
1⤵
PID:1906

/usr/bin/killall
killall -9 busybox
1⤵
PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads