Overview

overview

4

Static

static

1

cron.sh

ubuntu-18.04-amd64

4

cron.sh

debian-9-armhf

4

cron.sh

debian-9-mips

4

cron.sh

debian-9-mipsel

4

Analysis

  • max time kernel
    0s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    02/10/2026, 18:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    cron.sh
  • Size 1KB
  • Sample261002-w487csfg63
  • SHA256 261b69124bc3a9311535deaee7b998a51a09989f6d338d972467f164d1bcb4a7
  • MD5 SHA1 SHA512 TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Reads CPU attributes 1 TTPs 2 IoCs
    discovery
  • Reads runtime system information 4 IoCs

    Reads data from /proc virtual filesystem.

    discovery

Processes

  • /tmp/cron.sh
    /tmp/cron.sh
    1⤵
      PID:651
      • /usr/bin/pgrep
        pgrep -u aeyedefend -c -f "artisan queue:work"
        2⤵
        • Reads CPU attributes
        • Reads runtime system information
        PID:656
      • /usr/bin/nohup
        nohup php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
        2⤵
          PID:665
        • /usr/local/sbin/php
          php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
          2⤵
            PID:665
          • /usr/bin/pgrep
            pgrep -u aeyedefend -c -f "artisan schedule:work"
            2⤵
            • Reads CPU attributes
            • Reads runtime system information
            PID:668
          • /usr/local/bin/php
            php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
            2⤵
              PID:665
            • /usr/sbin/php
              php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
              2⤵
                PID:665
              • /usr/bin/php
                php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
                2⤵
                  PID:665
                • /sbin/php
                  php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
                  2⤵
                    PID:665
                  • /bin/php
                    php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
                    2⤵
                      PID:665
                  • /usr/bin/nohup
                    nohup php /home/aeyedefend/public_html/artisan schedule:work
                    1⤵
                      PID:674
                    • /usr/local/sbin/php
                      php /home/aeyedefend/public_html/artisan schedule:work
                      1⤵
                        PID:674
                      • /usr/local/bin/php
                        php /home/aeyedefend/public_html/artisan schedule:work
                        1⤵
                          PID:674
                        • /usr/sbin/php
                          php /home/aeyedefend/public_html/artisan schedule:work
                          1⤵
                            PID:674
                          • /usr/bin/php
                            php /home/aeyedefend/public_html/artisan schedule:work
                            1⤵
                              PID:674
                            • /sbin/php
                              php /home/aeyedefend/public_html/artisan schedule:work
                              1⤵
                                PID:674
                              • /bin/php
                                php /home/aeyedefend/public_html/artisan schedule:work
                                1⤵
                                  PID:674

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads