Overview
overview
7Static
static
5.rsync/a/a
ubuntu-18.04-amd64
7.rsync/a/a
debian-9-armhf
7.rsync/a/a
debian-9-mips
.rsync/a/a
debian-9-mipsel
.rsync/a/init01
ubuntu-18.04-amd64
6.rsync/a/init01
debian-9-armhf
6.rsync/a/init01
debian-9-mips
.rsync/a/init01
debian-9-mipsel
.rsync/a/kswapd00
ubuntu-18.04-amd64
1.rsync/a/run
ubuntu-18.04-amd64
6.rsync/a/run
debian-9-armhf
6.rsync/a/run
debian-9-mips
.rsync/a/run
debian-9-mipsel
.rsync/b/a
ubuntu-18.04-amd64
7.rsync/b/a
debian-9-armhf
7.rsync/b/a
debian-9-mips
.rsync/b/a
debian-9-mipsel
.rsync/b/run
ubuntu-18.04-amd64
6.rsync/b/run
debian-9-armhf
6.rsync/b/run
debian-9-mips
.rsync/b/run
debian-9-mipsel
.rsync/b/stop
ubuntu-18.04-amd64
6.rsync/b/stop
debian-9-armhf
6.rsync/b/stop
debian-9-mips
.rsync/b/stop
debian-9-mipsel
Analysis
- max time kernel
6s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
22/07/2026, 11:16
Behavioral task
behavioral1
Sample
.rsync/a/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
.rsync/a/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral3
Sample
.rsync/a/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral4
Sample
.rsync/a/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
.rsync/a/init01
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
.rsync/a/init01
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral7
Sample
.rsync/a/init01
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral8
Sample
.rsync/a/init01
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
.rsync/a/kswapd00
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
.rsync/a/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
.rsync/a/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral12
Sample
.rsync/a/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral13
Sample
.rsync/a/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral14
Sample
.rsync/b/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
.rsync/b/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral16
Sample
.rsync/b/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral17
Sample
.rsync/b/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
.rsync/b/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
.rsync/b/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral20
Sample
.rsync/b/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral21
Sample
.rsync/b/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral22
Sample
.rsync/b/stop
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral23
Sample
.rsync/b/stop
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral24
Sample
.rsync/b/stop
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral25
Sample
.rsync/b/stop
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target .rsync/a/a
- Size 6KB
- Sample260722-nc84aaeb43
- SHA256 72edb1d7a64f7f65720f562e3f4ff8c3383e214adb2d6246668743eeeec3fdf1
- MD5 a811d27b9892d7c160c0a4f3e80ed665
- SHA1 92324ac67a329ae203846bdae87dc4547d974684
- SHA512 a34ac1d09057bce344ddd31a22967c72888174e29b34fd3d223a6b421dc53eb33a8d9902eb0236accbc6a5032cb7c33ef1d4e65106656f21bef9287433ed41f7
- SSDEEP 192:gfgH9BeKLOOuK/0HiBeKLOOuKYAV9HdnIllo:gfgDeg9ue0Seg9ubA7
- TLSH T101D1F90AF35857BBAE1D58E43CCB7D326C277696E4B10CE519C68781C8ECA0D78B021E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 2 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 691 chmod 692 chmod - Executes dropped EXE 1 IoCs
ioc pid Process /tmp/.rsync/a/upd 693 a - Enumerates running processes
Discovers information about currently running processes on the system
- Write file to user bin folder 1 IoCs
description ioc Process File opened for modification /usr/bin/systemtd touch - Checks CPU configuration 1 TTPs 2 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo grep File opened for reading /proc/cpuinfo grep - Reads CPU attributes 1 TTPs 2 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online sysctl - Enumerates kernel/hardware configuration 1 TTPs 1 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/devices/system/node a -
description ioc Process File opened for reading /proc/3/status pkill File opened for reading /proc/17/status pkill File opened for reading /proc/75/status pkill File opened for reading /proc/167/cmdline pkill File opened for reading /proc/335/status pkill File opened for reading /proc/573/cmdline pidof File opened for reading /proc/13/cmdline pidof File opened for reading /proc/107/stat pidof File opened for reading /proc/300/stat pidof File opened for reading /proc/156/cmdline pkill File opened for reading /proc/318/cmdline pkill File opened for reading /proc/573/cmdline pkill File opened for reading /proc/639/cmdline pkill File opened for reading /proc/665/status pkill File opened for reading /proc/3/cmdline pidof File opened for reading /proc/17/cmdline pidof File opened for reading /proc/665/stat pidof File opened for reading /proc/filesystems id File opened for reading /proc/27/cmdline pkill File opened for reading /proc/28/status pkill File opened for reading /proc/228/cmdline pidof File opened for reading /proc/573/status pkill File opened for reading /proc/605/cmdline pkill File opened for reading /proc/16/cmdline pidof File opened for reading /proc/640/cmdline pidof File opened for reading /proc/4/cmdline pkill File opened for reading /proc/13/stat pidof File opened for reading /proc/694/cmdline pidof File opened for reading /proc/43/cmdline pkill File opened for reading /proc/24/cmdline pidof File opened for reading /proc/582/cmdline pidof File opened for reading /proc/1/cmdline pkill File opened for reading /proc/2/cmdline pkill File opened for reading /proc/6/status pkill File opened for reading /proc/104/status pkill File opened for reading /proc/670/status pkill File opened for reading /proc/774/cmdline pidof File opened for reading /proc/11/cmdline pkill File opened for reading /proc/318/status pkill File opened for reading /proc/678/status pkill File opened for reading /proc/302/stat pidof File opened for reading /proc/329/cmdline pkill File opened for reading /proc/20/cmdline pidof File opened for reading /proc/335/stat pidof File opened for reading /proc/5/status pkill File opened for reading /proc/7/cmdline pidof File opened for reading /proc/3/cmdline pkill File opened for reading /proc/20/cmdline pkill File opened for reading /proc/29/cmdline pidof File opened for reading /proc/665/cmdline pidof File opened for reading /proc/4/status pkill File opened for reading /proc/150/cmdline pkill File opened for reading /proc/sys/kernel/osrelease sysctl File opened for reading /proc/294/stat pidof File opened for reading /proc/297/stat pidof File opened for reading /proc/21/status pkill File opened for reading /proc/316/status pkill File opened for reading /proc/582/cmdline pkill File opened for reading /proc/583/status pkill File opened for reading /proc/684/status pkill File opened for reading /proc/cmdline modprobe File opened for reading /proc/filesystems sysctl File opened for reading /proc/134/cmdline pidof File opened for reading /proc/318/cmdline pidof - Writes file to tmp directory 6 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.rsync/a/upd a File opened for modification /tmp/.rsync/a/dir.dir run File opened for modification /tmp/.rsync/a/bash.pid run File opened for modification /tmp/.rsync/a/@!�@@8@@�_f�-�!-�!Q�tdV� sh File opened for modification /tmp/.rsync/a/� sh File opened for modification /tmp/.rsync/a/dir.dir a
Processes
-
/tmp/.rsync/a/a/tmp/.rsync/a/a1⤵
- Executes dropped EXE
- Enumerates kernel/hardware configuration
- Writes file to tmp directory
PID:671 -
/usr/bin/crontabcrontab -r2⤵PID:672
-
-
/bin/catcat dir.dir2⤵PID:674
-
-
/usr/bin/whoamiwhoami2⤵PID:675
-
-
/usr/bin/idid -u2⤵
- Reads runtime system information
PID:676
-
-
/bin/rmrm -rf /usr/bin/systemtd2⤵PID:677
-
-
/usr/bin/touchtouch /usr/bin/systemtd2⤵
- Write file to user bin folder
PID:679
-
-
/bin/chmodchmod -w /usr/bin2⤵PID:682
-
-
/usr/bin/pkillpkill -9 "\\-bash"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:684
-
-
/sbin/modprobemodprobe msr "allow_writes=on"2⤵
- Reads runtime system information
PID:685
-
-
/bin/grepgrep -E "AMD Ryzen|AMD EPYC" /proc/cpuinfo2⤵
- Checks CPU configuration
PID:686
-
-
/bin/grepgrep Intel /proc/cpuinfo2⤵
- Checks CPU configuration
PID:687
-
-
/usr/bin/nprocnproc2⤵PID:688
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=1"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:689
-
-
/usr/bin/findfind "/sys/devices/system/node/node*" -maxdepth 0 -type d2⤵PID:690
-
-
/bin/chmodchmod u+x upd2⤵
- File and Directory Permissions Modification
PID:691
-
-
/bin/chmodchmod 777 a dir.dir init01 kswapd00 run upd2⤵
- File and Directory Permissions Modification
PID:692
-
-
/tmp/.rsync/a/upd./upd2⤵PID:693
-
-
/tmp/.rsync/a/run./run1⤵
- Writes file to tmp directory
PID:694 -
/tmp/.rsync/a/stop./stop2⤵PID:695
-
-
/bin/sleepsleep 52⤵PID:696
-
-
/bin/catcat dir.dir2⤵PID:772
-
-
/usr/bin/nohupnohup ./kswapd002⤵PID:773
-
-
/bin/pidofpidof kswapd002⤵
- Reads runtime system information
PID:774
-
-
/tmp/.rsync/a/kswapd00./kswapd002⤵PID:773
-
-
/bin/sh/bin/sh ./kswapd002⤵
- Writes file to tmp directory
PID:773
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /tmp/.rsync/a/dir.dir
- Size 14B
- SHA256 ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7
- MD5 b3d878adcf4672bbd1f31cffac10c769
- SHA1 ce5798837933ece35a7e26a0a3dc06cab19c6275
- SHA512 019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c
- MD5 SHA1 SHA512
- Path /tmp/.rsync/a/upd
- Size 175B
- SHA256 419a443ff93475ef3abb6e71e5a94e56aea8b7c1f1c4402b3662425815432d46
- MD5 a136fbe534c2487d3c89bd6a26847bd0
- SHA1 11b9362ba79b67dd5d5baf7cf11e0003f049d6e0
- SHA512 85047cf9d22037d2581ae41275107b243c0bb3259b57fe46bd3fd04a1abe75a7fdeace8a9eae1fae31349a00183206b40259ab3957db8f4f16a79e67133485e9
- TLSH T1F2C08C84B0273D16B52A6ABD30292E311099E80D0814174201D8CD73E36F046F180A10
- MD5 SHA1 SHA512 TLSH