Overview
overview
7Static
static
5.rsync/a/a
ubuntu-18.04-amd64
7.rsync/a/a
debian-9-armhf
7.rsync/a/a
debian-9-mips
.rsync/a/a
debian-9-mipsel
.rsync/a/init01
ubuntu-18.04-amd64
6.rsync/a/init01
debian-9-armhf
6.rsync/a/init01
debian-9-mips
.rsync/a/init01
debian-9-mipsel
.rsync/a/kswapd00
ubuntu-18.04-amd64
1.rsync/a/run
ubuntu-18.04-amd64
6.rsync/a/run
debian-9-armhf
6.rsync/a/run
debian-9-mips
.rsync/a/run
debian-9-mipsel
.rsync/b/a
ubuntu-18.04-amd64
7.rsync/b/a
debian-9-armhf
7.rsync/b/a
debian-9-mips
.rsync/b/a
debian-9-mipsel
.rsync/b/run
ubuntu-18.04-amd64
6.rsync/b/run
debian-9-armhf
6.rsync/b/run
debian-9-mips
.rsync/b/run
debian-9-mipsel
.rsync/b/stop
ubuntu-18.04-amd64
6.rsync/b/stop
debian-9-armhf
6.rsync/b/stop
debian-9-mips
.rsync/b/stop
debian-9-mipsel
Analysis
- max time kernel
3s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
22/07/2026, 11:16
Behavioral task
behavioral1
Sample
.rsync/a/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral2
Sample
.rsync/a/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral3
Sample
.rsync/a/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral4
Sample
.rsync/a/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral5
Sample
.rsync/a/init01
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
.rsync/a/init01
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral7
Sample
.rsync/a/init01
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral8
Sample
.rsync/a/init01
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral9
Sample
.rsync/a/kswapd00
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral10
Sample
.rsync/a/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral11
Sample
.rsync/a/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral12
Sample
.rsync/a/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral13
Sample
.rsync/a/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral14
Sample
.rsync/b/a
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral15
Sample
.rsync/b/a
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral16
Sample
.rsync/b/a
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral17
Sample
.rsync/b/a
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral18
Sample
.rsync/b/run
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral19
Sample
.rsync/b/run
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral20
Sample
.rsync/b/run
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral21
Sample
.rsync/b/run
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral22
Sample
.rsync/b/stop
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral23
Sample
.rsync/b/stop
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral24
Sample
.rsync/b/stop
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral25
Sample
.rsync/b/stop
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target .rsync/b/stop
- Size 1KB
- Sample260722-nc84aaeb43
- SHA256 593ea276e442f1df193419307b24bdc11b050d34fe465db33289b79fd9e50ca8
- MD5 b010ac9859f9344e6300665418a17dfd
- SHA1 fcccfa7280f4f496b18b6332d1b8bba52c973e9f
- SHA512 3f58f006f3b4f4f09bc421a6e91da671a1ddd06ef5fc8ee6162c43e1836f591f569f559ca6de5068791c4177fb55d8338629cafe1a58528963680f2bdd453b2b
- TLSH T109214F0C6173FF7B5923EE72D661472585ABD48A88F73F1C1102BAB8B184009F73149E
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 10 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online ps File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill File opened for reading /sys/devices/system/cpu/online pkill -
description ioc Process File opened for reading /proc/6/stat killall File opened for reading /proc/13/stat killall File opened for reading /proc/662/stat killall File opened for reading /proc/106/cmdline pkill File opened for reading /proc/578/cmdline ps File opened for reading /proc/9/status ps File opened for reading /proc/9/stat killall File opened for reading /proc/9/cmdline ps File opened for reading /proc/565/stat killall File opened for reading /proc/76/stat killall File opened for reading /proc/159/status pkill File opened for reading /proc/108/cmdline ps File opened for reading /proc/109/stat killall File opened for reading /proc/297/cmdline pkill File opened for reading /proc/4/cmdline pkill File opened for reading /proc/43/cmdline pkill File opened for reading /proc/580/stat killall File opened for reading /proc/16/stat killall File opened for reading /proc/664/status pkill File opened for reading /proc/664/cmdline pkill File opened for reading /proc/6/stat killall File opened for reading /proc/297/status pkill File opened for reading /proc/293/cmdline pkill File opened for reading /proc/138/stat killall File opened for reading /proc/8/stat killall File opened for reading /proc/109/status pkill File opened for reading /proc/22/cmdline pkill File opened for reading /proc/169/status pkill File opened for reading /proc/26/status ps File opened for reading /proc/41/stat killall File opened for reading /proc/29/stat ps File opened for reading /proc/565/status ps File opened for reading /proc/13/stat killall File opened for reading /proc/14/status pkill File opened for reading /proc/98/cmdline pkill File opened for reading /proc/580/cmdline pkill File opened for reading /proc/15/cmdline pkill File opened for reading /proc/658/status pkill File opened for reading /proc/635/stat killall File opened for reading /proc/658/stat killall File opened for reading /proc/76/status pkill File opened for reading /proc/25/cmdline ps File opened for reading /proc/146/cmdline killall File opened for reading /proc/29/cmdline pkill File opened for reading /proc/108/status pkill File opened for reading /proc/29/cmdline pkill File opened for reading /proc/297/status pkill File opened for reading /proc/159/stat killall File opened for reading /proc/12/cmdline pkill File opened for reading /proc/25/status pkill File opened for reading /proc/287/cmdline pkill File opened for reading /proc/5/stat killall File opened for reading /proc/10/cmdline pkill File opened for reading /proc/98/status pkill File opened for reading /proc/159/status pkill File opened for reading /proc/313/status pkill File opened for reading /proc/578/status ps File opened for reading /proc/17/stat killall File opened for reading /proc/8/cmdline pkill File opened for reading /proc/219/stat ps File opened for reading /proc/27/stat killall File opened for reading /proc/298/stat killall File opened for reading /proc/298/stat killall File opened for reading /proc/12/status pkill - Writes file to tmp directory 1 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/.rsync/b/.out stop
Processes
-
/tmp/.rsync/b/stop/tmp/.rsync/b/stop1⤵
- Writes file to tmp directory
PID:664 -
/usr/bin/killallkillall -9 rsync2⤵
- Reads runtime system information
PID:665
-
-
/usr/bin/killallkillall -9 sync2⤵PID:667
-
-
/usr/bin/killallkillall -9 perl2⤵
- Reads runtime system information
PID:668
-
-
/usr/bin/killallkillall -9 ps2⤵
- Reads runtime system information
PID:669
-
-
/usr/bin/killallkillall -9 pool2⤵
- Reads runtime system information
PID:673
-
-
/usr/bin/killallkillall -9 nginx2⤵PID:675
-
-
/usr/bin/killallkillall -9 ecryptfs2⤵
- Reads runtime system information
PID:676
-
-
/usr/bin/killallkillall -9 xmr2⤵
- Reads runtime system information
PID:677
-
-
/usr/bin/killallkillall -9 edac02⤵
- Reads runtime system information
PID:678
-
-
/usr/bin/killallkillall -9 agent2⤵
- Reads runtime system information
PID:679
-
-
/usr/bin/pkillpkill -9 ps2⤵
- Reads CPU attributes
- Reads runtime system information
PID:680
-
-
/usr/bin/pkillpkill -9 pool2⤵
- Reads CPU attributes
- Reads runtime system information
PID:681
-
-
/usr/bin/pkillpkill -9 nginx2⤵
- Reads CPU attributes
- Reads runtime system information
PID:683
-
-
/usr/bin/pkillpkill -9 ecryptfs2⤵
- Reads CPU attributes
- Reads runtime system information
PID:686
-
-
/usr/bin/pkillpkill -9 xmr2⤵
- Reads CPU attributes
- Reads runtime system information
PID:687
-
-
/usr/bin/pkillpkill -9 edac02⤵
- Reads CPU attributes
- Reads runtime system information
PID:688
-
-
/usr/bin/pkillpkill -9 sync2⤵
- Reads CPU attributes
- Reads runtime system information
PID:689
-
-
/usr/bin/pkillpkill -9 agent2⤵
- Reads CPU attributes
- Reads runtime system information
PID:690
-
-
/bin/psps x2⤵
- Reads CPU attributes
- Reads runtime system information
PID:692
-
-
/bin/grepgrep -v grep2⤵PID:694
-
-
/bin/grepgrep ps2⤵PID:693
-
-
/usr/bin/awkawk "{print \$1}"2⤵PID:695
-
-
/bin/grepgrep sync2⤵PID:701
-
-
/bin/grepgrep -v grep2⤵PID:702
-
-
/bin/psps x2⤵
- Reads CPU attributes
- Reads runtime system information
PID:700
-
-
/usr/bin/awkawk "{print \$1}"2⤵PID:703
-