Overview
overview
7Static
static
5.rsync/a/a
ubuntu-18.04-amd64
7.rsync/a/a
debian-9-armhf
7.rsync/a/a
debian-9-mips
.rsync/a/a
debian-9-mipsel
.rsync/a/init01
ubuntu-18.04-amd64
6.rsync/a/init01
debian-9-armhf
6.rsync/a/init01
debian-9-mips
.rsync/a/init01
debian-9-mipsel
.rsync/a/kswapd00
ubuntu-18.04-amd64
1.rsync/a/run
ubuntu-18.04-amd64
6.rsync/a/run
debian-9-armhf
6.rsync/a/run
debian-9-mips
.rsync/a/run
debian-9-mipsel
.rsync/b/a
ubuntu-18.04-amd64
7.rsync/b/a
debian-9-armhf
7.rsync/b/a
debian-9-mips
.rsync/b/a
debian-9-mipsel
.rsync/b/run
ubuntu-18.04-amd64
6.rsync/b/run
debian-9-armhf
6.rsync/b/run
debian-9-mips
.rsync/b/run
debian-9-mipsel
.rsync/b/stop
ubuntu-18.04-amd64
6.rsync/b/stop
debian-9-armhf
6.rsync/b/stop
debian-9-mips
.rsync/b/stop
debian-9-mipsel
Analysis
- max time kernel
5s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
22/07/2026, 11:16
Behavioral task
behavioral1
Sample
.rsync/a/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
.rsync/a/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral3
Sample
.rsync/a/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral4
Sample
.rsync/a/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
.rsync/a/init01
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
.rsync/a/init01
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral7
Sample
.rsync/a/init01
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral8
Sample
.rsync/a/init01
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
.rsync/a/kswapd00
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
.rsync/a/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
.rsync/a/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral12
Sample
.rsync/a/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral13
Sample
.rsync/a/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral14
Sample
.rsync/b/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
.rsync/b/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral16
Sample
.rsync/b/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral17
Sample
.rsync/b/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
.rsync/b/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
.rsync/b/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral20
Sample
.rsync/b/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral21
Sample
.rsync/b/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral22
Sample
.rsync/b/stop
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral23
Sample
.rsync/b/stop
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral24
Sample
.rsync/b/stop
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral25
Sample
.rsync/b/stop
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target .rsync/a/run
- Size 116B
- Sample260722-nc84aaeb43
- SHA256 c74456763d09eecb859b6e2cd05ccc49363698bf9a0f2e05908a7baa1911dc66
- MD5 52a98777306437c8f21cd8ecd9de2c26
- SHA1 ef1e62d634866475c673db2cdf16885b917898e6
- SHA512 e2995998e6b396116749980efb251aee2aea50e37b8ec5544eb4a65e5d741cbe6d447e9c1a595bb6ed6f0610d3f26d605b4e7a24d2a150c1edd65ad96d3b28fa
- TLSH T18DB0128408723D48B90C37F67B8B9E3DC1935E23911DB48191984A71F29D70BDC7928F
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for reading /proc/4/stat pidof File opened for reading /proc/9/cmdline pidof File opened for reading /proc/20/cmdline pidof File opened for reading /proc/27/cmdline pidof File opened for reading /proc/41/cmdline pidof File opened for reading /proc/297/stat pidof File opened for reading /proc/584/stat pidof File opened for reading /proc/655/stat pidof File opened for reading /proc/6/stat pidof File opened for reading /proc/9/stat pidof File opened for reading /proc/14/cmdline pidof File opened for reading /proc/294/cmdline pidof File opened for reading /proc/658/stat pidof File opened for reading /proc/743/stat pidof File opened for reading /proc/18/cmdline pidof File opened for reading /proc/19/stat pidof File opened for reading /proc/153/stat pidof File opened for reading /proc/655/cmdline pidof File opened for reading /proc/13/cmdline pidof File opened for reading /proc/1/stat pidof File opened for reading /proc/137/cmdline pidof File opened for reading /proc/285/stat pidof File opened for reading /proc/17/stat pidof File opened for reading /proc/28/cmdline pidof File opened for reading /proc/135/cmdline pidof File opened for reading /proc/312/stat pidof File opened for reading /proc/25/cmdline pidof File opened for reading /proc/29/cmdline pidof File opened for reading /proc/43/stat pidof File opened for reading /proc/137/stat pidof File opened for reading /proc/621/cmdline pidof File opened for reading /proc/654/stat pidof File opened for reading /proc/19/cmdline pidof File opened for reading /proc/22/stat pidof File opened for reading /proc/282/stat pidof File opened for reading /proc/556/cmdline pidof File opened for reading /proc/169/stat pidof File opened for reading /proc/310/cmdline pidof File opened for reading /proc/572/cmdline pidof File opened for reading /proc/652/cmdline pidof File opened for reading /proc/20/stat pidof File opened for reading /proc/106/cmdline pidof File opened for reading /proc/556/stat pidof File opened for reading /proc/11/cmdline pidof File opened for reading /proc/24/cmdline pidof File opened for reading /proc/26/cmdline pidof File opened for reading /proc/98/cmdline pidof File opened for reading /proc/285/cmdline pidof File opened for reading /proc/4/cmdline pidof File opened for reading /proc/21/stat pidof File opened for reading /proc/109/stat pidof File opened for reading /proc/159/stat pidof File opened for reading /proc/5/cmdline pidof File opened for reading /proc/24/stat pidof File opened for reading /proc/294/stat pidof File opened for reading /proc/569/cmdline pidof File opened for reading /proc/10/stat pidof File opened for reading /proc/15/stat pidof File opened for reading /proc/17/cmdline pidof File opened for reading /proc/11/stat pidof File opened for reading /proc/18/stat pidof File opened for reading /proc/21/cmdline pidof File opened for reading /proc/5/stat pidof File opened for reading /proc/23/cmdline pidof - Writes file to tmp directory 2 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.rsync/a/bash.pid run File opened for modification /tmp/.rsync/a/dir.dir run
Processes
-
/tmp/.rsync/a/run/tmp/.rsync/a/run1⤵
- Writes file to tmp directory
PID:658 -
/tmp/.rsync/a/stop./stop2⤵PID:659
-
-
/bin/sleepsleep 52⤵PID:660
-
-
/bin/catcat dir.dir2⤵PID:742
-
-
/bin/pidofpidof kswapd002⤵
- Reads runtime system information
PID:744
-
-
/usr/bin/nohupnohup ./kswapd002⤵PID:743
-
-
/tmp/.rsync/a/kswapd00./kswapd002⤵PID:743
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.rsync/a/dir.dir
- Size 14B
- SHA256 ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7
- MD5 b3d878adcf4672bbd1f31cffac10c769
- SHA1 ce5798837933ece35a7e26a0a3dc06cab19c6275
- SHA512 019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c
- MD5 SHA1 SHA512