Overview
overview
7Static
static
5.rsync/a/a
ubuntu-18.04-amd64
7.rsync/a/a
debian-9-armhf
7.rsync/a/a
debian-9-mips
.rsync/a/a
debian-9-mipsel
.rsync/a/init01
ubuntu-18.04-amd64
6.rsync/a/init01
debian-9-armhf
6.rsync/a/init01
debian-9-mips
.rsync/a/init01
debian-9-mipsel
.rsync/a/kswapd00
ubuntu-18.04-amd64
1.rsync/a/run
ubuntu-18.04-amd64
6.rsync/a/run
debian-9-armhf
6.rsync/a/run
debian-9-mips
.rsync/a/run
debian-9-mipsel
.rsync/b/a
ubuntu-18.04-amd64
7.rsync/b/a
debian-9-armhf
7.rsync/b/a
debian-9-mips
.rsync/b/a
debian-9-mipsel
.rsync/b/run
ubuntu-18.04-amd64
6.rsync/b/run
debian-9-armhf
6.rsync/b/run
debian-9-mips
.rsync/b/run
debian-9-mipsel
.rsync/b/stop
ubuntu-18.04-amd64
6.rsync/b/stop
debian-9-armhf
6.rsync/b/stop
debian-9-mips
.rsync/b/stop
debian-9-mipsel
Analysis
- max time kernel
5s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/07/2026, 11:16
Behavioral task
behavioral1
Sample
.rsync/a/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
.rsync/a/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral3
Sample
.rsync/a/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral4
Sample
.rsync/a/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
.rsync/a/init01
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
.rsync/a/init01
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral7
Sample
.rsync/a/init01
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral8
Sample
.rsync/a/init01
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
.rsync/a/kswapd00
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
.rsync/a/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
.rsync/a/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral12
Sample
.rsync/a/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral13
Sample
.rsync/a/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral14
Sample
.rsync/b/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
.rsync/b/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral16
Sample
.rsync/b/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral17
Sample
.rsync/b/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
.rsync/b/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
.rsync/b/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral20
Sample
.rsync/b/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral21
Sample
.rsync/b/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral22
Sample
.rsync/b/stop
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral23
Sample
.rsync/b/stop
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral24
Sample
.rsync/b/stop
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral25
Sample
.rsync/b/stop
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target .rsync/a/a
- Size 6KB
- Sample260722-nc84aaeb43
- SHA256 72edb1d7a64f7f65720f562e3f4ff8c3383e214adb2d6246668743eeeec3fdf1
- MD5 a811d27b9892d7c160c0a4f3e80ed665
- SHA1 92324ac67a329ae203846bdae87dc4547d974684
- SHA512 a34ac1d09057bce344ddd31a22967c72888174e29b34fd3d223a6b421dc53eb33a8d9902eb0236accbc6a5032cb7c33ef1d4e65106656f21bef9287433ed41f7
- SSDEEP 192:gfgH9BeKLOOuK/0HiBeKLOOuKYAV9HdnIllo:gfgDeg9ue0Seg9ubA7
- TLSH T101D1F90AF35857BBAE1D58E43CCB7D326C277696E4B10CE519C68781C8ECA0D78B021E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1505 chmod 1506 chmod - Executes dropped EXE 1 IoCs
ioc pid Process /tmp/.rsync/a/upd 1507 a -
ioc pid Process /lib/modules/4.15.0-213-generic/kernel/arch/x86/kernel/msr.ko 1493 modprobe - Enumerates running processes
Discovers information about currently running processes on the system
- Write file to user bin folder 1 IoCs
description ioc Process File opened for modification /usr/bin/systemtd touch - Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo grep File opened for reading /proc/cpuinfo grep - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill - Enumerates kernel/hardware configuration 1 TTPs 2 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/module/msr/initstate modprobe File opened for reading /sys/devices/system/node a -
description ioc Process File opened for reading /proc/27/status pkill File opened for reading /proc/259/status pkill File opened for reading /proc/1078/status pkill File opened for reading /proc/1502/stat pidof File opened for reading /proc/169/cmdline pkill File opened for reading /proc/479/cmdline pkill File opened for reading /proc/23/cmdline pidof File opened for reading /proc/639/stat pidof File opened for reading /proc/510/cmdline pkill File opened for reading /proc/551/cmdline pkill File opened for reading /proc/888/cmdline pkill File opened for reading /proc/1477/cmdline pidof File opened for reading /proc/201/status pkill File opened for reading /proc/488/status pkill File opened for reading /proc/699/cmdline pkill File opened for reading /proc/895/cmdline pkill File opened for reading /proc/1044/status pkill File opened for reading /proc/6/cmdline pkill File opened for reading /proc/9/status pkill File opened for reading /proc/78/status pkill File opened for reading /proc/163/status pkill File opened for reading /proc/640/status pkill File opened for reading /proc/202/cmdline pidof File opened for reading /proc/895/stat pidof File opened for reading /proc/1480/stat pidof File opened for reading /proc/642/cmdline pkill File opened for reading /proc/987/cmdline pkill File opened for reading /proc/1056/status pkill File opened for reading /proc/158/stat pidof File opened for reading /proc/160/stat pidof File opened for reading /proc/445/cmdline pidof File opened for reading /proc/954/stat pidof File opened for reading /proc/959/stat pidof File opened for reading /proc/79/cmdline pidof File opened for reading /proc/954/cmdline pidof File opened for reading /proc/162/status pkill File opened for reading /proc/696/status pkill File opened for reading /proc/1058/status pkill File opened for reading /proc/1079/cmdline pkill File opened for reading /proc/174/stat pidof File opened for reading /proc/696/stat pidof File opened for reading /proc/950/cmdline pidof File opened for reading /proc/1019/stat pidof File opened for reading /proc/18/status pkill File opened for reading /proc/174/cmdline pkill File opened for reading /proc/336/status pkill File opened for reading /proc/19/stat pidof File opened for reading /proc/27/cmdline pidof File opened for reading /proc/35/cmdline pidof File opened for reading /proc/98/cmdline pidof File opened for reading /proc/492/stat pidof File opened for reading /proc/15/status pkill File opened for reading /proc/filesystems find File opened for reading /proc/1118/cmdline pidof File opened for reading /proc/1447/cmdline pidof File opened for reading /proc/115/status pkill File opened for reading /proc/950/stat pidof File opened for reading /proc/1080/cmdline pidof File opened for reading /proc/1084/stat pidof File opened for reading /proc/1239/status pkill File opened for reading /proc/115/stat pidof File opened for reading /proc/268/status pkill File opened for reading /proc/954/cmdline pkill File opened for reading /proc/974/status pkill - Writes file to tmp directory 4 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.rsync/a/dir.dir a File opened for modification /tmp/.rsync/a/upd a File opened for modification /tmp/.rsync/a/dir.dir run File opened for modification /tmp/.rsync/a/bash.pid run
Processes
-
/tmp/.rsync/a/a/tmp/.rsync/a/a1⤵
- Executes dropped EXE
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:1482 -
/usr/bin/crontabcrontab -r2⤵PID:1483
-
-
/bin/catcat dir.dir2⤵PID:1485
-
-
/usr/bin/whoamiwhoami2⤵PID:1486
-
-
/usr/bin/idid -u2⤵PID:1487
-
-
/bin/rmrm -rf /usr/bin/systemtd2⤵PID:1488
-
-
/usr/bin/touchtouch /usr/bin/systemtd2⤵
- Write file to user bin folder
PID:1489
-
-
/bin/chmodchmod -w /usr/bin2⤵PID:1490
-
-
/usr/bin/pkillpkill -9 "\\-bash"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1491
-
-
/sbin/modprobemodprobe msr "allow_writes=on"2⤵
- Loads a kernel module
- Enumerates kernel/hardware configuration
PID:1493
-
-
/bin/grepgrep -E "AMD Ryzen|AMD EPYC" /proc/cpuinfo2⤵
- Checks CPU configuration
PID:1495
-
-
/bin/grepgrep Intel /proc/cpuinfo2⤵
- Checks CPU configuration
PID:1498
-
-
/usr/bin/nprocnproc2⤵PID:1499
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=1"2⤵PID:1500
-
-
/usr/bin/findfind /sys/devices/system/node/node0 -maxdepth 0 -type d2⤵
- Reads runtime system information
PID:1501
-
-
/bin/chmodchmod u+x upd2⤵
- File and Directory Permissions Modification
PID:1505
-
-
/bin/chmodchmod 777 a dir.dir init01 kswapd00 run upd2⤵
- File and Directory Permissions Modification
PID:1506
-
-
/tmp/.rsync/a/upd./upd2⤵PID:1507
-
-
/tmp/.rsync/a/run./run1⤵
- Writes file to tmp directory
PID:1508 -
/tmp/.rsync/a/stop./stop2⤵PID:1509
-
-
/bin/sleepsleep 52⤵PID:1510
-
-
/bin/catcat dir.dir2⤵PID:1512
-
-
/bin/pidofpidof kswapd002⤵
- Reads runtime system information
PID:1514
-
-
/usr/bin/nohupnohup ./kswapd002⤵PID:1513
-
-
/tmp/.rsync/a/kswapd00./kswapd002⤵PID:1513
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.rsync/a/bash.pid
- Size 5B
- SHA256 67ebee0a13d3c664b128409c682bfe85ad9874df81a8b71698c5106ae4e7feb9
- MD5 9c58a6a301cae336405ad4f2e8eea081
- SHA1 7d58dd005afa51c401583acebd36f45dc32b0078
- SHA512 b3f8f8b0fbe7375f862c69b2dd95103799ca8d85a52c55d9811498604b075bf8fd20ea5873b02b3d549b389a78930df4f8a5f134c47d64893932557531445e42
- MD5 SHA1 SHA512
- Path /tmp/.rsync/a/dir.dir
- Size 14B
- SHA256 ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7
- MD5 b3d878adcf4672bbd1f31cffac10c769
- SHA1 ce5798837933ece35a7e26a0a3dc06cab19c6275
- SHA512 019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c
- MD5 SHA1 SHA512
- Path /tmp/.rsync/a/upd
- Size 175B
- SHA256 419a443ff93475ef3abb6e71e5a94e56aea8b7c1f1c4402b3662425815432d46
- MD5 a136fbe534c2487d3c89bd6a26847bd0
- SHA1 11b9362ba79b67dd5d5baf7cf11e0003f049d6e0
- SHA512 85047cf9d22037d2581ae41275107b243c0bb3259b57fe46bd3fd04a1abe75a7fdeace8a9eae1fae31349a00183206b40259ab3957db8f4f16a79e67133485e9
- TLSH T1F2C08C84B0273D16B52A6ABD30292E311099E80D0814174201D8CD73E36F046F180A10
- MD5 SHA1 SHA512 TLSH