bbcb8075b98d143c022d8ca427a42c439ab72464f5335c10514ae959a4e743ba

Analysis

max time kernel
148s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/07/2026, 11:16

Target
.rsync/b/run
Size 73KB
Sample260722-nc84aaeb43
SHA256 bbcb8075b98d143c022d8ca427a42c439ab72464f5335c10514ae959a4e743ba
MD5 efa525c6083be0dc386321f130353c24
SHA1 061571b328272cf0a908f796ab65c3eed3b00f3d
SHA512 4b74b45de2f4d78dd8586c969f3beff515a53a0a5e5e25f9394501a0ebd39e897317c733b1598c4f6875edabcc305a849f1156d1b5233aeb3321470ee49c704e
SSDEEP 1536:rG6dkLpUqE3VuQz7kG6dkLpUqE3VuQz7M:rXdkOeXdkOm
TLSH
T1B173D82AEE8F1D498BD16C021BCE09E469CC1789DCD45DDF500FE6985E6F03819EC6E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Attempts to change immutable files 2 IoCs

Modifies inode attributes on the filesystem to allow changing of immutable files.

pid	Process
771	chattr
772	chattr

Changes its process name 2 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	edac0	763	perl
Changes the process name, possibly in an attempt to hide itself	edac0	768	perl

/tmp/.rsync/b/run
/tmp/.rsync/b/run
1⤵
PID:677
- /bin/sleep
  sleep 5
  2⤵
  PID:680
- /usr/bin/nohup
  nohup ./stop
  2⤵
  PID:679
- /tmp/.rsync/b/stop
  ./stop
  2⤵
  PID:679
- /usr/bin/base64
  base64 --decode
  2⤵
  PID:762
- /usr/bin/perl
  perl
  2⤵
  - Changes its process name
  PID:763
- - /usr/local/sbin/uname
    uname -a
    3⤵
    PID:764
- - /usr/local/bin/uname
    uname -a
    3⤵
    PID:764
- - /usr/sbin/uname
    uname -a
    3⤵
    PID:764
- - /usr/bin/uname
    uname -a
    3⤵
    PID:764
- - /sbin/uname
    uname -a
    3⤵
    PID:764
- - /bin/uname
    uname -a
    3⤵
    PID:764
- /usr/bin/perl
  perl
  2⤵
  - Changes its process name
  PID:768
- - /usr/local/sbin/uname
    uname -a
    3⤵
    PID:769
- - /usr/local/bin/uname
    uname -a
    3⤵
    PID:769
- - /usr/sbin/uname
    uname -a
    3⤵
    PID:769
- - /usr/bin/uname
    uname -a
    3⤵
    PID:769
- - /sbin/uname
    uname -a
    3⤵
    PID:769
- - /bin/uname
    uname -a
    3⤵
    PID:769
- /usr/bin/base64
  base64 --decode
  2⤵
  PID:767
- /usr/bin/chattr
  chattr -ia -R "~/.ssh"
  2⤵
  - Attempts to change immutable files
  PID:771
- /usr/bin/chattr
  chattr +ia -R "~/.ssh"
  2⤵
  - Attempts to change immutable files
  PID:772