Overview
overview
7Static
static
5.rsync/a/a
ubuntu-18.04-amd64
7.rsync/a/a
debian-9-armhf
7.rsync/a/a
debian-9-mips
.rsync/a/a
debian-9-mipsel
.rsync/a/init01
ubuntu-18.04-amd64
6.rsync/a/init01
debian-9-armhf
6.rsync/a/init01
debian-9-mips
.rsync/a/init01
debian-9-mipsel
.rsync/a/kswapd00
ubuntu-18.04-amd64
1.rsync/a/run
ubuntu-18.04-amd64
6.rsync/a/run
debian-9-armhf
6.rsync/a/run
debian-9-mips
.rsync/a/run
debian-9-mipsel
.rsync/b/a
ubuntu-18.04-amd64
7.rsync/b/a
debian-9-armhf
7.rsync/b/a
debian-9-mips
.rsync/b/a
debian-9-mipsel
.rsync/b/run
ubuntu-18.04-amd64
6.rsync/b/run
debian-9-armhf
6.rsync/b/run
debian-9-mips
.rsync/b/run
debian-9-mipsel
.rsync/b/stop
ubuntu-18.04-amd64
6.rsync/b/stop
debian-9-armhf
6.rsync/b/stop
debian-9-mips
.rsync/b/stop
debian-9-mipsel
Analysis
- max time kernel
0s - max time network
81s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
22/07/2026, 11:16
Behavioral task
behavioral1
Sample
.rsync/a/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
.rsync/a/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral3
Sample
.rsync/a/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral4
Sample
.rsync/a/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
.rsync/a/init01
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
.rsync/a/init01
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral7
Sample
.rsync/a/init01
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral8
Sample
.rsync/a/init01
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
.rsync/a/kswapd00
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
.rsync/a/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
.rsync/a/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral12
Sample
.rsync/a/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral13
Sample
.rsync/a/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral14
Sample
.rsync/b/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
.rsync/b/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral16
Sample
.rsync/b/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral17
Sample
.rsync/b/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
.rsync/b/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
.rsync/b/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral20
Sample
.rsync/b/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral21
Sample
.rsync/b/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral22
Sample
.rsync/b/stop
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral23
Sample
.rsync/b/stop
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral24
Sample
.rsync/b/stop
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral25
Sample
.rsync/b/stop
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target .rsync/b/stop
- Size 1KB
- Sample260722-nc84aaeb43
- SHA256 593ea276e442f1df193419307b24bdc11b050d34fe465db33289b79fd9e50ca8
- MD5 b010ac9859f9344e6300665418a17dfd
- SHA1 fcccfa7280f4f496b18b6332d1b8bba52c973e9f
- SHA512 3f58f006f3b4f4f09bc421a6e91da671a1ddd06ef5fc8ee6162c43e1836f591f569f559ca6de5068791c4177fb55d8338629cafe1a58528963680f2bdd453b2b
- TLSH T109214F0C6173FF7B5923EE72D661472585ABD48A88F73F1C1102BAB8B184009F73149E
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 10 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/901/stat killall File opened for reading /proc/693/cmdline pkill File opened for reading /proc/157/cmdline pkill File opened for reading /proc/160/status pkill File opened for reading /proc/1189/status ps File opened for reading /proc/985/cmdline killall File opened for reading /proc/656/cmdline killall File opened for reading /proc/975/status pkill File opened for reading /proc/1052/status pkill File opened for reading /proc/1048/status pkill File opened for reading /proc/17/stat killall File opened for reading /proc/1472/cmdline killall File opened for reading /proc/1022/cmdline killall File opened for reading /proc/722/status pkill File opened for reading /proc/909/cmdline pkill File opened for reading /proc/1057/status pkill File opened for reading /proc/27/status pkill File opened for reading /proc/496/status pkill File opened for reading /proc/1098/cmdline pkill File opened for reading /proc/30/status ps File opened for reading /proc/892/cmdline ps File opened for reading /proc/559/stat killall File opened for reading /proc/8/cmdline pkill File opened for reading /proc/28/status pkill File opened for reading /proc/86/cmdline pkill File opened for reading /proc/14/cmdline ps File opened for reading /proc/923/status ps File opened for reading /proc/1095/cmdline ps File opened for reading /proc/4/stat killall File opened for reading /proc/1480/cmdline pkill File opened for reading /proc/442/cmdline pkill File opened for reading /proc/31/status ps File opened for reading /proc/1085/stat ps File opened for reading /proc/174/stat ps File opened for reading /proc/1052/status ps File opened for reading /proc/1507/stat ps File opened for reading /proc/35/stat killall File opened for reading /proc/975/stat killall File opened for reading /proc/1161/status pkill File opened for reading /proc/115/cmdline pkill File opened for reading /proc/559/cmdline pkill File opened for reading /proc/470/cmdline ps File opened for reading /proc/1297/cmdline killall File opened for reading /proc/26/stat killall File opened for reading /proc/1373/stat killall File opened for reading /proc/441/cmdline pkill File opened for reading /proc/34/status pkill File opened for reading /proc/30/stat ps File opened for reading /proc/82/stat ps File opened for reading /proc/78/status ps File opened for reading /proc/158/stat killall File opened for reading /proc/928/cmdline pkill File opened for reading /proc/20/cmdline pkill File opened for reading /proc/1315/status pkill File opened for reading /proc/1095/stat ps File opened for reading /proc/1/stat killall File opened for reading /proc/1190/cmdline pkill File opened for reading /proc/1297/status pkill File opened for reading /proc/176/cmdline pkill File opened for reading /proc/521/status pkill File opened for reading /proc/80/cmdline pkill File opened for reading /proc/1161/status pkill File opened for reading /proc/13/cmdline ps File opened for reading /proc/496/cmdline ps - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.rsync/b/.out stop
Processes
-
/tmp/.rsync/b/stop/tmp/.rsync/b/stop1⤵
- Writes file to tmp directory
PID:1480 -
/usr/bin/killallkillall -9 rsync2⤵
- Reads runtime system information
PID:1481
-
-
/usr/bin/killallkillall -9 sync2⤵
- Reads runtime system information
PID:1484
-
-
/usr/bin/killallkillall -9 perl2⤵
- Reads runtime system information
PID:1485
-
-
/usr/bin/killallkillall -9 ps2⤵
- Reads runtime system information
PID:1488
-
-
/usr/bin/killallkillall -9 pool2⤵
- Reads runtime system information
PID:1489
-
-
/usr/bin/killallkillall -9 nginx2⤵
- Reads runtime system information
PID:1490
-
-
/usr/bin/killallkillall -9 ecryptfs2⤵PID:1491
-
-
/usr/bin/killallkillall -9 xmr2⤵PID:1492
-
-
/usr/bin/killallkillall -9 edac02⤵
- Reads runtime system information
PID:1496
-
-
/usr/bin/killallkillall -9 agent2⤵
- Reads runtime system information
PID:1497
-
-
/usr/bin/pkillpkill -9 ps2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1498
-
-
/usr/bin/pkillpkill -9 pool2⤵
- Reads CPU attributes
PID:1499
-
-
/usr/bin/pkillpkill -9 nginx2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1500
-
-
/usr/bin/pkillpkill -9 ecryptfs2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1501
-
-
/usr/bin/pkillpkill -9 xmr2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1502
-
-
/usr/bin/pkillpkill -9 edac02⤵
- Reads CPU attributes
- Reads runtime system information
PID:1503
-
-
/usr/bin/pkillpkill -9 sync2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1504
-
-
/usr/bin/pkillpkill -9 agent2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1505
-
-
/usr/bin/awkawk "{print \$1}"2⤵PID:1515
-
-
/bin/psps x2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1512
-
-
/bin/grepgrep -v grep2⤵PID:1514
-
-
/bin/grepgrep ps2⤵PID:1513
-
-
/usr/bin/awkawk "{print \$1}"2⤵PID:1524
-
-
/bin/grepgrep -v grep2⤵PID:1523
-
-
/bin/grepgrep sync2⤵PID:1522
-
-
/bin/psps x2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1521
-