Overview

overview

10

Static

static

10

.rsync/a/a

ubuntu-18.04-amd64

7

.rsync/a/a

debian-9-armhf

7

.rsync/a/a

debian-9-mips

7

.rsync/a/a

debian-9-mipsel

7

.rsync/a/anacron

ubuntu-22.04-amd64

6

.rsync/a/cron

ubuntu-22.04-amd64

1

.rsync/a/run

ubuntu-18.04-amd64

3

.rsync/a/run

debian-9-armhf

3

.rsync/a/run

debian-9-mips

3

.rsync/a/run

debian-9-mipsel

3

.rsync/a/stop

ubuntu-18.04-amd64

6

.rsync/a/stop

debian-9-armhf

6

.rsync/a/stop

debian-9-mips

6

.rsync/a/stop

debian-9-mipsel

6

.rsync/c/go

ubuntu-18.04-amd64

3

.rsync/c/go

debian-9-armhf

3

.rsync/c/go

debian-9-mips

3

.rsync/c/go

debian-9-mipsel

3

.rsync/c/golan

ubuntu-18.04-amd64

1

.rsync/c/golan

debian-9-armhf

1

.rsync/c/golan

debian-9-mips

1

.rsync/c/golan

debian-9-mipsel

1

.rsync/c/l...c.so.6

ubuntu-22.04-amd64

.rsync/c/l...l.so.2

ubuntu-24.04-amd64

1

.rsync/c/l...s.so.2

ubuntu-22.04-amd64

1

.rsync/c/l...s.so.2

ubuntu-24.04-amd64

1

.rsync/c/l...d.so.0

ubuntu-24.04-amd64

.rsync/c/l....23.so

ubuntu-24.04-amd64

1

.rsync/c/l...v.so.2

ubuntu-24.04-amd64

1

.rsync/c/lib/32/tsm

ubuntu-24.04-amd64

1

.rsync/c/l...c.so.6

ubuntu-22.04-amd64

1

.rsync/c/l...l.so.2

ubuntu-24.04-amd64

1

Analysis

  • max time kernel
    10s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    28-06-2024 12:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    .rsync/a/run

  • Size

    215B

  • MD5

    5b63cdc5b5ceef5bde4a2f9672f68069

  • SHA1

    7491fe2657c4fa2a8d99fcd7a56e38624ff8b7fc

  • SHA256

    cf4aaf185449bb639ec7e7fab66583488c79526bff02c08154190c66c2cd31b3

  • SHA512

    e32275e3e15c824c854329401aaece0a0456535ecdb2b296df12ef18f31613cff183fbd4279331014bc332d42f1b8c54e97aecd9029ee70d240c2468851d4551

Score
3/10

Malware Config

Signatures

  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/.rsync/a/run
    /tmp/.rsync/a/run
    1⤵
    • Writes file to tmp directory
    PID:681
    • /tmp/.rsync/a/stop
      ./stop
      2⤵
        PID:683
      • /bin/sleep
        sleep 10
        2⤵
          PID:687
        • /bin/cat
          cat dir.dir
          2⤵
            PID:763
          • /bin/uname
            uname -m
            2⤵
              PID:764

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • /tmp/.rsync/a/bash.pid
            Filesize

            1B

            MD5

            68b329da9893e34099c7d8ad5cb9c940

            SHA1

            adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

            SHA256

            01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

            SHA512

            be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

            Download Submit
          • /tmp/.rsync/a/dir.dir
            Filesize

            14B

            MD5

            b3d878adcf4672bbd1f31cffac10c769

            SHA1

            ce5798837933ece35a7e26a0a3dc06cab19c6275

            SHA256

            ea5fce19c5fbbbc6c3c36eb9e8e295dfb525e9669aafaf8abe9ddb4e00e345c7

            SHA512

            019d21a618b3ccc70c0c7ede225cbbb704e2b448048586c44c74c81a747129da9f3f9675f2a29363af320d2684974a1ff00ac608c53de4458aeacd3ed4f9da2c

            Download Submit