Analysis
- max time kernel
0s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
30/06/2026, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
Resource
debian9-armhf-20260513-en
debian-9-armhf
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target 14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
- Size 122KB
- Sample260630-2xw64sbs8t
- SHA256 14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397
- MD5 bbd5cac02e5a6df02668f0d62ed4061a
- SHA1 3bfe75039b163508564f51641d5e9a2e70454571
- SHA512 b4480f644de34163f89700cbda8b1db64f27e774b41bfb4acea19b171dfbcd649c36c65c3637a67c40adad1de17c3539203131a2492bddca74211644475a668d
- SSDEEP 1536:U2Gbr4bmp4zHSFhQo+Pww6JPh6UiTX430AjJSSaED/y9yTnML:pqr4bmKHSIPq6U1tzpq
- TLSH T143C3EA2269514DF434C8D67C46C751502738A00B890A2D2CF4AEF6683FAEA78B1F67FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/137/status ps File opened for reading /proc/179/stat ps File opened for reading /proc/969/cmdline ps File opened for reading /proc/182/stat ps File opened for reading /proc/14/status ps File opened for reading /proc/176/stat ps File opened for reading /proc/280/status ps File opened for reading /proc/728/status ps File opened for reading /proc/900/stat ps File opened for reading /proc/1488/stat ps File opened for reading /proc/1496/status ps File opened for reading /proc/32/status ps File opened for reading /proc/454/status ps File opened for reading /proc/671/status ps File opened for reading /proc/679/status ps File opened for reading /proc/1018/status ps File opened for reading /proc/1192/status ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/34/status ps File opened for reading /proc/175/status ps File opened for reading /proc/487/cmdline ps File opened for reading /proc/447/cmdline ps File opened for reading /proc/1250/status ps File opened for reading /proc/25/stat ps File opened for reading /proc/84/cmdline ps File opened for reading /proc/561/stat ps File opened for reading /proc/976/stat ps File opened for reading /proc/1088/stat ps File opened for reading /proc/1495/status ps File opened for reading /proc/1499/status ps File opened for reading /proc/1052/stat ps File opened for reading /proc/1089/stat ps File opened for reading /proc/5/status ps File opened for reading /proc/32/stat ps File opened for reading /proc/689/stat ps File opened for reading /proc/1319/stat ps File opened for reading /proc/17/status ps File opened for reading /proc/185/cmdline ps File opened for reading /proc/419/stat ps File opened for reading /proc/561/cmdline ps File opened for reading /proc/999/status ps File opened for reading /proc/1087/stat ps File opened for reading /proc/1300/status ps File opened for reading /proc/81/status ps File opened for reading /proc/1062/status ps File opened for reading /proc/1348/status ps File opened for reading /proc/31/stat ps File opened for reading /proc/35/stat ps File opened for reading /proc/615/status ps File opened for reading /proc/714/cmdline ps File opened for reading /proc/14/cmdline ps File opened for reading /proc/3/stat ps File opened for reading /proc/24/status ps File opened for reading /proc/185/stat ps File opened for reading /proc/213/stat ps File opened for reading /proc/902/stat ps File opened for reading /proc/meminfo ps File opened for reading /proc/175/stat ps File opened for reading /proc/329/cmdline ps File opened for reading /proc/1026/stat ps File opened for reading /proc/1048/status ps File opened for reading /proc/1087/cmdline ps File opened for reading /proc/5/stat ps File opened for reading /proc/456/status ps
Processes
-
/tmp/14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b204568397/tmp/14b9ed4cd14aaf9bd54932249170c53ceac147940844e7929eb7b2b2045683971⤵PID:1488
-
/usr/bin/trtr -d .2⤵PID:1493
-
-
/usr/bin/trtr -d "\""2⤵PID:1492
-
-
/usr/bin/cutcut -d "=" -f22⤵PID:1491
-
-
/bin/grepgrep "^VERSION_ID" /etc/os-release2⤵PID:1490
-
-
/bin/mkdirmkdir -p /var/log/x-ui2⤵PID:1494
-
-
/bin/grepgrep -v grep2⤵PID:1498
-
-
/usr/bin/wcwc -l2⤵PID:1499
-
-
/bin/grepgrep xray-linux2⤵PID:1497
-
-
/bin/psps -ef2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1496
-