Overview
overview
7Static
static
5.rsync/a/a
ubuntu-18.04-amd64
7.rsync/a/a
debian-9-armhf
7.rsync/a/a
debian-9-mips
.rsync/a/a
debian-9-mipsel
.rsync/a/init01
ubuntu-18.04-amd64
6.rsync/a/init01
debian-9-armhf
6.rsync/a/init01
debian-9-mips
.rsync/a/init01
debian-9-mipsel
.rsync/a/kswapd00
ubuntu-18.04-amd64
1.rsync/a/run
ubuntu-18.04-amd64
6.rsync/a/run
debian-9-armhf
6.rsync/a/run
debian-9-mips
.rsync/a/run
debian-9-mipsel
.rsync/b/a
ubuntu-18.04-amd64
7.rsync/b/a
debian-9-armhf
7.rsync/b/a
debian-9-mips
.rsync/b/a
debian-9-mipsel
.rsync/b/run
ubuntu-18.04-amd64
6.rsync/b/run
debian-9-armhf
6.rsync/b/run
debian-9-mips
.rsync/b/run
debian-9-mipsel
.rsync/b/stop
ubuntu-18.04-amd64
6.rsync/b/stop
debian-9-armhf
6.rsync/b/stop
debian-9-mips
.rsync/b/stop
debian-9-mipsel
Analysis
- max time kernel
5s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/07/2026, 11:16
Behavioral task
behavioral1
Sample
.rsync/a/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
.rsync/a/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral3
Sample
.rsync/a/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral4
Sample
.rsync/a/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
.rsync/a/init01
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
.rsync/a/init01
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral7
Sample
.rsync/a/init01
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral8
Sample
.rsync/a/init01
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
.rsync/a/kswapd00
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
.rsync/a/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
.rsync/a/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral12
Sample
.rsync/a/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral13
Sample
.rsync/a/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral14
Sample
.rsync/b/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
.rsync/b/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral16
Sample
.rsync/b/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral17
Sample
.rsync/b/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
.rsync/b/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
.rsync/b/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral20
Sample
.rsync/b/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral21
Sample
.rsync/b/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral22
Sample
.rsync/b/stop
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral23
Sample
.rsync/b/stop
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral24
Sample
.rsync/b/stop
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral25
Sample
.rsync/b/stop
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target .rsync/a/run
- Size 116B
- Sample260722-nc84aaeb43
- SHA256 c74456763d09eecb859b6e2cd05ccc49363698bf9a0f2e05908a7baa1911dc66
- MD5 52a98777306437c8f21cd8ecd9de2c26
- SHA1 ef1e62d634866475c673db2cdf16885b917898e6
- SHA512 e2995998e6b396116749980efb251aee2aea50e37b8ec5544eb4a65e5d741cbe6d447e9c1a595bb6ed6f0610d3f26d605b4e7a24d2a150c1edd65ad96d3b28fa
- TLSH T18DB0128408723D48B90C37F67B8B9E3DC1935E23911DB48191984A71F29D70BDC7928F
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/1/cmdline pidof File opened for reading /proc/178/stat pidof File opened for reading /proc/657/stat pidof File opened for reading /proc/943/stat pidof File opened for reading /proc/1071/stat pidof File opened for reading /proc/1319/cmdline pidof File opened for reading /proc/250/cmdline pidof File opened for reading /proc/487/stat pidof File opened for reading /proc/1486/stat pidof File opened for reading /proc/32/stat pidof File opened for reading /proc/184/cmdline pidof File opened for reading /proc/986/stat pidof File opened for reading /proc/1047/cmdline pidof File opened for reading /proc/1147/stat pidof File opened for reading /proc/1492/cmdline pidof File opened for reading /proc/21/stat pidof File opened for reading /proc/650/cmdline pidof File opened for reading /proc/924/stat pidof File opened for reading /proc/27/stat pidof File opened for reading /proc/173/stat pidof File opened for reading /proc/213/cmdline pidof File opened for reading /proc/470/cmdline pidof File opened for reading /proc/1193/cmdline pidof File opened for reading /proc/5/stat pidof File opened for reading /proc/5/cmdline pidof File opened for reading /proc/174/cmdline pidof File opened for reading /proc/454/stat pidof File opened for reading /proc/653/cmdline pidof File opened for reading /proc/999/stat pidof File opened for reading /proc/1062/cmdline pidof File opened for reading /proc/1089/stat pidof File opened for reading /proc/170/stat pidof File opened for reading /proc/181/stat pidof File opened for reading /proc/280/stat pidof File opened for reading /proc/280/cmdline pidof File opened for reading /proc/679/cmdline pidof File opened for reading /proc/1030/cmdline pidof File opened for reading /proc/1083/stat pidof File opened for reading /proc/1136/stat pidof File opened for reading /proc/137/stat pidof File opened for reading /proc/173/cmdline pidof File opened for reading /proc/419/stat pidof File opened for reading /proc/493/cmdline pidof File opened for reading /proc/1486/cmdline pidof File opened for reading /proc/1487/stat pidof File opened for reading /proc/23/cmdline pidof File opened for reading /proc/84/stat pidof File opened for reading /proc/650/stat pidof File opened for reading /proc/969/stat pidof File opened for reading /proc/1034/stat pidof File opened for reading /proc/1038/cmdline pidof File opened for reading /proc/1047/stat pidof File opened for reading /proc/188/stat pidof File opened for reading /proc/213/stat pidof File opened for reading /proc/419/cmdline pidof File opened for reading /proc/657/cmdline pidof File opened for reading /proc/900/stat pidof File opened for reading /proc/1257/cmdline pidof File opened for reading /proc/183/cmdline pidof File opened for reading /proc/1175/stat pidof File opened for reading /proc/82/cmdline pidof File opened for reading /proc/176/stat pidof File opened for reading /proc/250/stat pidof File opened for reading /proc/575/stat pidof - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.rsync/a/dir.dir run File opened for modification /tmp/.rsync/a/bash.pid run
Processes
-
/tmp/.rsync/a/run/tmp/.rsync/a/run1⤵
- Writes file to tmp directory
PID:1492 -
/tmp/.rsync/a/stop./stop2⤵PID:1493
-
-
/bin/sleepsleep 52⤵PID:1494
-
-
/bin/catcat dir.dir2⤵PID:1501
-
-
/bin/pidofpidof kswapd002⤵
- Reads runtime system information
PID:1503
-
-
/usr/bin/nohupnohup ./kswapd002⤵PID:1502
-
-
/tmp/.rsync/a/kswapd00./kswapd002⤵PID:1502
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.rsync/a/dir.dir
- Size 14B
- SHA256 ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7
- MD5 b3d878adcf4672bbd1f31cffac10c769
- SHA1 ce5798837933ece35a7e26a0a3dc06cab19c6275
- SHA512 019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c
- MD5 SHA1 SHA512