9747157ba021aa05cf2f33eb4ca8ba1b565dee35a5d5e7075c4e87e11a85b805

Analysis

max time kernel
0s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
29/10/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MrsWatson-0.9.7/Linux/mrswatsontest64
Size 269KB
Sample261029-vce9ja1vas
SHA256 9747157ba021aa05cf2f33eb4ca8ba1b565dee35a5d5e7075c4e87e11a85b805
MD5 6e698707ac58d2389dcd03224ab79112
SHA1 d5b4a0dab6b93c81a4bcfbda247d3bb2e522da2b
SHA512 da7f18fa04cb50896828fae67cbdbdf98db486eaecac71f26267cc7421768494c29cba81f76fa5b53b138c781a8e6df26122060e69b3c7c79394745c18a1bb4f
SSDEEP 6144:G966y3ig8zG4pjwxYjatc+TqrvtkXBibMSghY/ZVdUfJbM64zHUxQBbZyyMaJr:Gi2y4mxYjatc+TqrvtaBibM0/ZkfxMhH
TLSH
T1A8444A53B86204FDCAA6D134466E4131D8FDF6E41272BA3B2B64D3743D86E341F1ABA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp

Writes file to tmp directory 8 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/MrsWatson-0.9.7/Linux/invalid/fileUtilitiesTest.txt	mrswatsontest64
File opened for modification	/tmp/mrswatsontest-sitWnF/fileUtilitiesTest.txt	mrswatsontest64
File opened for modification	/tmp/mrswatsontest-config.txt	mrswatsontest64
File opened for modification	/tmp/MrsWatson-0.9.7/Linux/test_file.txt	mrswatsontest64
File opened for modification	/tmp/MrsWatson-0.9.7/Linux/test_dir/test_file.txt	mrswatsontest64
File opened for modification	/tmp/MrsWatson-0.9.7/Linux/test_dir_dest/test_dir/test_file.txt	cp
File opened for modification	/tmp/MrsWatson-0.9.7/Linux/fileUtilitiesTest.txt	mrswatsontest64
File opened for modification	/tmp/mrswatsontest-s7GAPd/fileUtilitiesTest.txt	mrswatsontest64

/tmp/MrsWatson-0.9.7/Linux/mrswatsontest64
/tmp/MrsWatson-0.9.7/Linux/mrswatsontest64
1⤵
- Writes file to tmp directory
PID:1523
- /bin/sh
  sh -c "/bin/cp -r \"/tmp/MrsWatson-0.9.7/Linux/test_dir\" \"/tmp/MrsWatson-0.9.7/Linux/test_dir_dest\""
  2⤵
  PID:1524
- - /bin/cp
    /bin/cp -r /tmp/MrsWatson-0.9.7/Linux/test_dir /tmp/MrsWatson-0.9.7/Linux/test_dir_dest
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1526
- /bin/sh
  sh -c "/bin/rm -rf \"/tmp/mrswatsontest-s7GAPd\""
  2⤵
  PID:1528
- - /bin/rm
    /bin/rm -rf /tmp/mrswatsontest-s7GAPd
    3⤵
    PID:1529
- /bin/sh
  sh -c "/bin/rm -rf \"/tmp/mrswatsontest-JevDAW\""
  2⤵
  PID:1530
- - /bin/rm
    /bin/rm -rf /tmp/mrswatsontest-JevDAW
    3⤵
    PID:1531
- /bin/sh
  sh -c "/bin/rm -rf \"/tmp/mrswatsontest-sitWnF\""
  2⤵
  PID:1532
- - /bin/rm
    /bin/rm -rf /tmp/mrswatsontest-sitWnF
    3⤵
    PID:1533
- /bin/sh
  sh -c "/bin/rm -rf \"/tmp/mrswatsontest-rYkMco\""
  2⤵
  PID:1534
- - /bin/rm
    /bin/rm -rf /tmp/mrswatsontest-rYkMco
    3⤵
    PID:1535
- /bin/sh
  sh -c "/bin/rm -rf \"/tmp/mrswatsontest-G7aU36\""
  2⤵
  PID:1536
- - /bin/rm
    /bin/rm -rf /tmp/mrswatsontest-G7aU36
    3⤵
    PID:1537

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

test_file.txt

Path /tmp/MrsWatson-0.9.7/Linux/test_file.txt
Size 13B
SHA256 7440bb6750b04e658a78ba2c85810e22de4c68176cceaddb775f20cb81dfcdb8
MD5 c20a3bcceed7996e2f037702a9f90fde
SHA1 8b0ae1f67e43f299fa4a98fce557cf479528a39b
SHA512 abdd4b1d2ae1f782c8edb4cbffeee1b94562e0e52d8aa8979a77a3d877b3b56a011f0a65ae886e25a4f5ac63c7300dbce59257703140630e0fb7ef799023eb60
MD5 SHA1 SHA512

Submit Download

test_file.txt

Path /tmp/MrsWatson-0.9.7/Linux/test_file.txt
Size 27B
SHA256 c3d47da75ca89df9750cdc743a718775711da0bf8389a146eba43c2fa3230fe5
MD5 05611f03af0bd3fdbd04bcd3ce8e696f
SHA1 f1c4fd22e6a0900bbfed5f4124dfcfdbec60d9bb
SHA512 a24551bf78bccac97d0aaf5910319c3a11cfbbf438dd9b819950a6686c43b4fec3c91901ae9d099ec6e4f3b2dc5a209e66982c1631899dceaa1f1861ab1c05f6
MD5 SHA1 SHA512

Submit Download

test_file.txt

Path /tmp/MrsWatson-0.9.7/Linux/test_file.txt
Size 26B
SHA256 ac861f8ec73eb4e6cfa2436fba25e7b10cc0b2d76eb9e413d47f0a9a821b7289
MD5 b6abcbf31615eea64ff4b7643f31ce92
SHA1 f8e6bcca5636c7d5ebdcc392f14d9e82f2ad4756
SHA512 a36c9a4a7880943f950dc626e8fa4bf27881659a53bad45cc559518d314206449ece98a2aabf6e10c35feae06c26997401acd4636d40d35e08982024e5bd10c1
MD5 SHA1 SHA512

Submit Download

mrswatsontest-config.txt

Path /tmp/mrswatsontest-config.txt
Size 14B
SHA256 74f76ce80d399eb07f3f0a212b0046f28c5498732a3472146f7145ccbac14328
MD5 947b90613734c56ef81d8775f5c273bc
SHA1 d697ae52feb0353a68732192c062ea5fdf7cd009
SHA512 06eca5635bea81fb2ef461979e445c4c7c2d48e7bf7ebbaf580d6e90a89f276d4370d422b499ada4178c5ef1a33328a6dc95504f6feb669370a45096411a960d
MD5 SHA1 SHA512

Submit Download

mrswatsontest-config.txt

Path /tmp/mrswatsontest-config.txt
Size 10B
SHA256 cb8d77cf1b6a0da58e45be7a8b9cef942c4f472c61f99aece7c118076ef53dd5
MD5 eec19a295d3bff07a81e0d0edad89b5c
SHA1 0d3e897ced37ec6daf197c64dbde1574a93385e0
SHA512 c26504b8b0253740feb3d3f03743ef4b2ba1a610722110f4ad84404ee62f37fec08ea57fbd7f3c785b7c1b2fe47ca9a03c439589a82bd8090bb92c7c111c08b8
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads