dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920

Analysis

max time kernel
144s
max time network
139s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/07/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.rsync/b/a
Size 157B
Sample260722-nc84aaeb43
SHA256 dc43fdfbb5f7e8ecc80353dcd85889c0c08483c99acbce35b3ed8f399c936920
MD5 17dfec62acb9bc298bb333fbe391f486
SHA1 960fdc0a9c8dd4879c96ec76f69a9dedc6ec9795
SHA512 21d49249ca656d3f6ce7a77876796590ae66d31963a6cdf65bb294ca45372e68686f8f7fd846035ed53f1155962447a8054bf2ea081e02fbb4b3fa1b6e376881
TLSH
T1CDC08CCC06F83308AEC8E662F50332F802C18A0CA80A9C03748A1AB2C2D43E238143C0
MD5 SHA1 SHA512 TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 4 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1500	chmod
1501	chmod
1502	chmod
1503	chmod

Attempts to change immutable files 2 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
1630	chattr
1631	chattr

Enumerates running processes
Discovers information about currently running processes on the system

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	edac0	1622	perl
Changes the process name, possibly in an attempt to hide itself	edac0	1627	perl

Reads CPU attributes 1 TTPs 25 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/1549/stat	ps
File opened for reading	/proc/175/cmdline	ps
File opened for reading	/proc/1506/cmdline	ps
File opened for reading	/proc/1484/cmdline	ps
File opened for reading	/proc/468/cmdline	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/546/status	ps
File opened for reading	/proc/502/status	ps
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/987/stat	ps
File opened for reading	/proc/1059/cmdline	ps
File opened for reading	/proc/468/status	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/1094/status	pkill
File opened for reading	/proc/668/stat	ps
File opened for reading	/proc/1488/status	ps
File opened for reading	/proc/564/status	ps
File opened for reading	/proc/1256/status	ps
File opened for reading	/proc/1076/status	pkill
File opened for reading	/proc/1101/status	ps
File opened for reading	/proc/174/stat	ps
File opened for reading	/proc/1505/status	pkill
File opened for reading	/proc/997/status	pkill
File opened for reading	/proc/469/status	pkill
File opened for reading	/proc/460/cmdline	pkill
File opened for reading	/proc/31/cmdline	pkill
File opened for reading	/proc/461/status	pkill
File opened for reading	/proc/3/stat	killall
File opened for reading	/proc/1063/cmdline	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/1087/status	pkill
File opened for reading	/proc/10/cmdline	pkill
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/28/cmdline	ps
File opened for reading	/proc/1001/stat	ps
File opened for reading	/proc/668/stat	killall
File opened for reading	/proc/1054/cmdline	pkill
File opened for reading	/proc/1100/cmdline	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/30/cmdline	ps
File opened for reading	/proc/1062/cmdline	pkill
File opened for reading	/proc/204/status	pkill
File opened for reading	/proc/318/cmdline	pkill
File opened for reading	/proc/84/cmdline	ps
File opened for reading	/proc/709/cmdline	ps
File opened for reading	/proc/1532/stat	ps
File opened for reading	/proc/81/status	pkill
File opened for reading	/proc/78/stat	killall
File opened for reading	/proc/1062/stat	killall
File opened for reading	/proc/1384/status	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/1161/cmdline	ps
File opened for reading	/proc/1558/stat	ps
File opened for reading	/proc/1459/cmdline	ps
File opened for reading	/proc/3/status	pkill
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/1488/status	pkill
File opened for reading	/proc/324/cmdline	pkill
File opened for reading	/proc/557/status	pkill
File opened for reading	/proc/997/cmdline	pkill

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.rsync/b/dir.dir	a
File opened for modification	/tmp/.rsync/b/sync	a
File opened for modification	/tmp/.rsync/b/.out	stop

/tmp/.rsync/b/a
/tmp/.rsync/b/a
1⤵
- Writes file to tmp directory
PID:1496
- /bin/cat
  cat dir.dir
  2⤵
  PID:1497
- /tmp/.rsync/b/stop
  ./stop
  2⤵
  PID:1499
- /bin/chmod
  chmod u+x sync
  2⤵
  - File and Directory Permissions Modification
  PID:1500
- /bin/chmod
  chmod u+x stop
  2⤵
  - File and Directory Permissions Modification
  PID:1501
- /bin/chmod
  chmod u+x ps
  2⤵
  - File and Directory Permissions Modification
  PID:1502
- /bin/chmod
  chmod u+x run
  2⤵
  - File and Directory Permissions Modification
  PID:1503
- /tmp/.rsync/b/run
  ./run
  2⤵
  PID:1504
- - /bin/sleep
    sleep 5
    3⤵
    PID:1506
- - /usr/bin/nohup
    nohup ./stop
    3⤵
    PID:1505
- - /tmp/.rsync/b/stop
    ./stop
    3⤵
    - Writes file to tmp directory
    PID:1505
  - - /usr/bin/killall
      killall -9 rsync
      4⤵
      Reads runtime system information
      PID:1507
  - - /usr/bin/killall
      killall -9 sync
      4⤵
      PID:1508
  - - /usr/bin/killall
      killall -9 perl
      4⤵
      Reads runtime system information
      PID:1509
  - - /usr/bin/killall
      killall -9 ps
      4⤵
      PID:1510
  - - /usr/bin/killall
      killall -9 pool
      4⤵
      Reads runtime system information
      PID:1511
  - - /usr/bin/killall
      killall -9 nginx
      4⤵
      PID:1512
  - - /usr/bin/killall
      killall -9 ecryptfs
      4⤵
      PID:1513
  - - /usr/bin/killall
      killall -9 xmr
      4⤵
      Reads runtime system information
      PID:1518
  - - /usr/bin/killall
      killall -9 edac0
      4⤵
      PID:1519
  - - /usr/bin/killall
      killall -9 agent
      4⤵
      Reads runtime system information
      PID:1520
  - - /usr/bin/pkill
      pkill -9 ps
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1521
  - - /usr/bin/pkill
      pkill -9 pool
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1522
  - - /usr/bin/pkill
      pkill -9 nginx
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1523
  - - /usr/bin/pkill
      pkill -9 ecryptfs
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1527
  - - /usr/bin/pkill
      pkill -9 xmr
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1528
  - - /usr/bin/pkill
      pkill -9 edac0
      4⤵
      Reads CPU attributes
      PID:1529
  - - /usr/bin/pkill
      pkill -9 sync
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1530
  - - /usr/bin/pkill
      pkill -9 agent
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1531
  - - /usr/bin/awk
      awk "{print \$1}"
      4⤵
      PID:1537
  - - /bin/grep
      grep -v grep
      4⤵
      PID:1536
  - - /bin/grep
      grep ps
      4⤵
      PID:1535
  - - /bin/ps
      ps x
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1534
  - - /usr/bin/awk
      awk "{print \$1}"
      4⤵
      PID:1548
  - - /bin/grep
      grep -v grep
      4⤵
      PID:1547
  - - /bin/grep
      grep sync
      4⤵
      PID:1546
  - - /bin/ps
      ps x
      4⤵
      Reads CPU attributes
      PID:1545
  - - /usr/bin/awk
      awk "{print \$1}"
      4⤵
      PID:1556
  - - /bin/grep
      grep -v grep
      4⤵
      PID:1555
  - - /bin/grep
      grep nginx
      4⤵
      PID:1554
  - - /bin/ps
      ps x
      4⤵
      Reads CPU attributes
      PID:1553
  - - /bin/grep
      grep -v grep
      4⤵
      PID:1562
  - - /usr/bin/awk
      awk "{print \$1}"
      4⤵
      PID:1563
  - - /bin/grep
      grep ecryptfs
      4⤵
      PID:1561
  - - /bin/ps
      ps x
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1560
  - - /bin/grep
      grep -v grep
      4⤵
      PID:1567
  - - /bin/grep
      grep xmr
      4⤵
      PID:1566
  - - /usr/bin/awk
      awk "{print \$1}"
      4⤵
      PID:1568
  - - /bin/ps
      ps x
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1565
  - - /bin/grep
      grep -v grep
      4⤵
      PID:1572
  - - /usr/bin/awk
      awk "{print \$1}"
      4⤵
      PID:1573
  - - /bin/grep
      grep edac0
      4⤵
      PID:1571
  - - /bin/ps
      ps x
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1570
  - - /bin/grep
      grep -v grep
      4⤵
      PID:1577
  - - /bin/grep
      grep agent
      4⤵
      PID:1576
  - - /bin/ps
      ps x
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1575
  - - /usr/bin/awk
      awk "{print \$1}"
      4⤵
      PID:1578
  - - /bin/grep
      grep -v grep
      4⤵
      PID:1582
  - - /usr/bin/awk
      awk "{print \$1}"
      4⤵
      PID:1583
  - - /bin/grep
      grep perl
      4⤵
      PID:1581
  - - /bin/ps
      ps x
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1580
  - - /bin/grep
      grep -v grep
      4⤵
      PID:1587
  - - /usr/bin/awk
      awk "{print \$1}"
      4⤵
      PID:1588
  - - /bin/grep
      grep rsync
      4⤵
      PID:1586
  - - /bin/ps
      ps x
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1585
  - - /usr/bin/awk
      awk "{print \$2}"
      4⤵
      PID:1595
  - - /bin/grep
      grep rsync
      4⤵
      PID:1594
  - - /bin/ps
      ps -ef
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1593
  - - /usr/bin/awk
      awk "{print \$2}"
      4⤵
      PID:1599
  - - /bin/grep
      grep sync
      4⤵
      PID:1598
  - - /bin/ps
      ps -ef
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1597
  - - /usr/bin/awk
      awk "{print \$2}"
      4⤵
      PID:1603
  - - /bin/grep
      grep ps
      4⤵
      PID:1602
  - - /bin/ps
      ps -ef
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1601
  - - /usr/bin/pkill
      pkill -9 rsync
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1604
  - - /usr/bin/pkill
      pkill -9 perl
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1605
  - - /usr/bin/pkill
      pkill -9 agent
      4⤵
      Reads CPU attributes
      Reads runtime system information
      PID:1606
  - - /usr/bin/pkill
      pkill -9 edac0
      4⤵
      Reads CPU attributes
      PID:1607
  - - /usr/bin/pkill
      pkill -9 ps
      4⤵
      Reads CPU attributes
      PID:1608
  - - /bin/rm
      rm -rf .proc .out
      4⤵
      PID:1609
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1621
- - /usr/bin/perl
    perl
    3⤵
    - Changes its process name
    PID:1622
  - - /usr/local/sbin/uname
      uname -a
      4⤵
      PID:1623
  - - /usr/local/bin/uname
      uname -a
      4⤵
      PID:1623
  - - /usr/sbin/uname
      uname -a
      4⤵
      PID:1623
  - - /usr/bin/uname
      uname -a
      4⤵
      PID:1623
  - - /sbin/uname
      uname -a
      4⤵
      PID:1623
  - - /bin/uname
      uname -a
      4⤵
      PID:1623
- - /usr/bin/perl
    perl
    3⤵
    - Changes its process name
    PID:1627
  - - /usr/local/sbin/uname
      uname -a
      4⤵
      PID:1628
  - - /usr/local/bin/uname
      uname -a
      4⤵
      PID:1628
  - - /usr/sbin/uname
      uname -a
      4⤵
      PID:1628
  - - /usr/bin/uname
      uname -a
      4⤵
      PID:1628
  - - /sbin/uname
      uname -a
      4⤵
      PID:1628
  - - /bin/uname
      uname -a
      4⤵
      PID:1628
- - /usr/bin/base64
    base64 --decode
    3⤵
    PID:1626
- - /usr/bin/chattr
    chattr -ia -R "~/.ssh"
    3⤵
    - Attempts to change immutable files
    PID:1630
- - /usr/bin/chattr
    chattr +ia -R "~/.ssh"
    3⤵
    - Attempts to change immutable files
    PID:1631

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dir.dir

Path /tmp/.rsync/b/dir.dir
Size 14B
SHA256 8e0465a977658aca8fe06bec84742ed7c298db88cba64fc87de85409c6c909e8
MD5 e21fb1889e57316ccbd97f98e1282a54
SHA1 ee8de521fb7ae11f81615ce31a45b5f7a79feee8
SHA512 3ac5bf18363442ea8e4f478b2595a5e13199d80378c82f2ffeacb03cf64cf30c5e82c9a618d2a0f2d9d5386aeb1576e154e654eb20fc6967a43472f3f5047445
MD5 SHA1 SHA512

Submit Download

sync

Path /tmp/.rsync/b/sync
Size 33B
SHA256 7602dd04cbfa214345d0ae0b2ee26ed6475ea4d9053575cb99e29b956f536d0e
MD5 a0eea5d0b1c4743cc7b8c798399581e0
SHA1 bf30ba5824c9ec612aa4654eb895e3cb738b4e18
SHA512 9e70bc0608f42b83712d5e2911d21e6ab627c830d0ae4b8fa5e0eeea6555bc4cce49d7fafdea28a1888b55b28461cab34153dee3746bc084c1e8a296f849d06f
MD5 SHA1 SHA512