261b69124bc3a9311535deaee7b998a51a09989f6d338d972467f164d1bcb4a7

Analysis

max time kernel
1s
platform
debian-9_mips
resource
debian9-mipsbe-20260513-en
resource tags

arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
02/10/2026, 18:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cron.sh
Size 1KB
Sample261002-w487csfg63
SHA256 261b69124bc3a9311535deaee7b998a51a09989f6d338d972467f164d1bcb4a7
MD5 ab75f1a67205766504b8252c3969679c
SHA1 d8632d98cc0b20c06ca82fddf9677653b57212e0
SHA512 54f667c04e4495adc5547a93e41e29d1bea46f359c6d5fca1752aa09d89a052986697635e8aeaf809b1b2721479d5bb06103363e73b5582f88641c61219bc78b
TLSH
T17121D00BB2BC67703D6D2D2995EDB2D57A830617096488FEE09A7C7682102DC80D9F31
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Reads CPU attributes 1 TTPs 2 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 4 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/filesystems	pgrep
File opened for reading	/proc/sys/kernel/osrelease	pgrep
File opened for reading	/proc/filesystems	pgrep

/tmp/cron.sh
/tmp/cron.sh
1⤵
PID:715
- /usr/bin/pgrep
  pgrep -u aeyedefend -c -f "artisan queue:work"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:719
- /usr/bin/nohup
  nohup php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
  2⤵
  PID:727
- /usr/bin/pgrep
  pgrep -u aeyedefend -c -f "artisan schedule:work"
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:729
- /usr/local/sbin/php
  php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
  2⤵
  PID:727
- /usr/local/bin/php
  php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
  2⤵
  PID:727
- /usr/sbin/php
  php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
  2⤵
  PID:727
- /usr/bin/php
  php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
  2⤵
  PID:727
- /sbin/php
  php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
  2⤵
  PID:727
- /bin/php
  php /home/aeyedefend/public_html/artisan queue:work "--timeout=0"
  2⤵
  PID:727
- /usr/bin/nohup
  nohup php /home/aeyedefend/public_html/artisan schedule:work
  2⤵
  PID:732

/usr/local/sbin/php
php /home/aeyedefend/public_html/artisan schedule:work
1⤵
PID:732

/usr/local/bin/php
php /home/aeyedefend/public_html/artisan schedule:work
1⤵
PID:732

/usr/sbin/php
php /home/aeyedefend/public_html/artisan schedule:work
1⤵
PID:732

/usr/bin/php
php /home/aeyedefend/public_html/artisan schedule:work
1⤵
PID:732

/sbin/php
php /home/aeyedefend/public_html/artisan schedule:work
1⤵
PID:732

/bin/php
php /home/aeyedefend/public_html/artisan schedule:work
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads