Analysis
- max time kernel
0s - max time network
129s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
18/08/2026, 04:06
Static task
static1
Behavioral task
behavioral1
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-armhf-20260513-en
debian-9-armhf
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-mipsbe-20260513-en
debian-9-mips
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
4 signatures
150 seconds
General
- Target 93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
- Size 1KB
- Sample260818-epekrsdr3w
- SHA256 93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b
- MD5 94b2ed5fd20ce8398e62756e2b8c6303
- SHA1 6cd683aae5096741660d8617421b029c8290a8bf
- SHA512 4cde6f82fe0f078ebaad8da56cf7066db2b1254c7740b67c7b4909c3b8f210f153834f087954be6ef6eb32be4724e6cb9a2901c6e635c7f2a8c11341ee695f53
- TLSH T14B21D0C5F8A8DEB1BDB8717A806A120115DB695F1477B13110F2C8641B0C59DD5BEB33
- MD5 SHA1 SHA512 TLSH
Score
6/10
Malware Config
Signatures
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online pgrep -
description ioc Process File opened for reading /proc/1092/fd ss File opened for reading /proc/968/attr/current ss File opened for reading /proc/1027/status pgrep File opened for reading /proc/98/fd ss File opened for reading /proc/1455/attr/current ss File opened for reading /proc/79/status pgrep File opened for reading /proc/901/status pgrep File opened for reading /proc/10/fd ss File opened for reading /proc/36/fd ss File opened for reading /proc/1049/fd ss File opened for reading /proc/1061/attr/current ss File opened for reading /proc/164/fd ss File opened for reading /proc/1159/status pgrep File opened for reading /proc/1187/status pgrep File opened for reading /proc/649/fd ss File opened for reading /proc/1480/fd ss File opened for reading /proc/2/fd ss File opened for reading /proc/1045/fd ss File opened for reading /proc/173/status pgrep File opened for reading /proc/1344/stat ss File opened for reading /proc/1480/attr/current ss File opened for reading /proc/988/attr/current ss File opened for reading /proc/1092/attr/current ss File opened for reading /proc/554/stat ss File opened for reading /proc/1019/attr/current ss File opened for reading /proc/984/fd ss File opened for reading /proc/169/attr/current ss File opened for reading /proc/98/cmdline pgrep File opened for reading /proc/1049/cmdline pgrep File opened for reading /proc/426/stat ss File opened for reading /proc/446/fd ss File opened for reading /proc/473/attr/current ss File opened for reading /proc/610/stat ss File opened for reading /proc/1247/attr/current ss File opened for reading /proc/23/status pgrep File opened for reading /proc/23/fd ss File opened for reading /proc/166/fd ss File opened for reading /proc/1379/stat ss File opened for reading /proc/668/stat ss File opened for reading /proc/1092/attr/current ss File opened for reading /proc/546/attr/current ss File opened for reading /proc/17/fd ss File opened for reading /proc/160/attr/current ss File opened for reading /proc/171/status pgrep File opened for reading /proc/7/fd ss File opened for reading /proc/30/fd ss File opened for reading /proc/30/attr/current ss File opened for reading /proc/682/fd ss File opened for reading /proc/707/fd ss File opened for reading /proc/1080/stat ss File opened for reading /proc/1172/stat ss File opened for reading /proc/1291/attr/current ss File opened for reading /proc/201/fd ss File opened for reading /proc/472/attr/current ss File opened for reading /proc/1044/fd ss File opened for reading /proc/1344/fd ss File opened for reading /proc/1508/fd ss File opened for reading /proc/450/cmdline pgrep File opened for reading /proc/cmdline systemctl File opened for reading /proc/942/fd ss File opened for reading /proc/3/attr/current ss File opened for reading /proc/8/fd ss File opened for reading /proc/1051/stat ss File opened for reading /proc/28/fd ss
Processes
-
/tmp/93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b/tmp/93dcd0aa6a183e47d2d2f70f669bf5d3cee3537e6085163e4ba31e1f5b46dc3b1⤵PID:1488
-
/bin/grepgrep -q :4432⤵PID:1490
-
-
/bin/ssss -tlnp2⤵
- Reads runtime system information
PID:1489
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"2⤵PID:1500
-
-
/bin/systemctlsystemctl start cnc.service2⤵
- Reads runtime system information
PID:1501
-
-
/bin/grepgrep -q :802⤵PID:1508
-
-
/bin/ssss -tlnp2⤵
- Reads runtime system information
PID:1507
-
-
/usr/bin/pgreppgrep -f auto_pwner_v142⤵
- Reads CPU attributes
- Reads runtime system information
PID:1509
-
-
/bin/datedate "+%Y-%m-%d %H:%M:%S"2⤵PID:1511
-
-
/bin/systemctlsystemctl start botpwner.service2⤵PID:1512
-