Overview

overview

4

Static

static

1

cron.sh

ubuntu-18.04-amd64

4

cron.sh

debian-9-armhf

4

cron.sh

debian-9-mips

4

cron.sh

debian-9-mipsel

4

Analysis

  • max time kernel
    0s
  • max time network
    130s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    02/10/2026, 18:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cron.sh
  • Size 1KB
  • Sample261002-w487csfg63
  • SHA256 261b69124bc3a9311535deaee7b998a51a09989f6d338d972467f164d1bcb4a7
  • MD5 SHA1 SHA512 TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Reads runtime system information 2 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/cron.sh
    /tmp/cron.sh
    1⤵
      PID:1489
      • /usr/bin/pgrep
        pgrep -u aeyedefend -c -f "artisan queue:work"
        2⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1490
      • /usr/bin/pgrep
        pgrep -u aeyedefend -c -f "artisan schedule:work"
        2⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:1492
      • /usr/bin/nohup
        nohup php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
        2⤵
          PID:1491
        • /usr/local/sbin/php
          php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
          2⤵
            PID:1491
          • /usr/local/bin/php
            php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
            2⤵
              PID:1491
            • /usr/sbin/php
              php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
              2⤵
                PID:1491
              • /usr/bin/php
                php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
                2⤵
                  PID:1491
                • /sbin/php
                  php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
                  2⤵
                    PID:1491
                  • /bin/php
                    php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
                    2⤵
                      PID:1491
                    • /snap/bin/php
                      php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
                      2⤵
                        PID:1491
                    • /usr/bin/nohup
                      nohup php /home/aeyedefend/public_html/artisan schedule:work
                      1⤵
                        PID:1495
                      • /usr/local/sbin/php
                        php /home/aeyedefend/public_html/artisan schedule:work
                        1⤵
                          PID:1495
                        • /usr/local/bin/php
                          php /home/aeyedefend/public_html/artisan schedule:work
                          1⤵
                            PID:1495
                          • /usr/sbin/php
                            php /home/aeyedefend/public_html/artisan schedule:work
                            1⤵
                              PID:1495
                            • /usr/bin/php
                              php /home/aeyedefend/public_html/artisan schedule:work
                              1⤵
                                PID:1495
                              • /sbin/php
                                php /home/aeyedefend/public_html/artisan schedule:work
                                1⤵
                                  PID:1495
                                • /bin/php
                                  php /home/aeyedefend/public_html/artisan schedule:work
                                  1⤵
                                    PID:1495
                                  • /snap/bin/php
                                    php /home/aeyedefend/public_html/artisan schedule:work
                                    1⤵
                                      PID:1495

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads