Edit tour

Linux Analysis Report
conf.png

Overview

General Information

Sample name:	conf.png
Analysis ID:	1645160
MD5:	65234357f9c2f318acac81d881bb27f2
SHA1:	f9094f8226f694dce08d02b96101dfed94097e74
SHA256:	cef751cdfbabbdde4670d99eece963b1730da16da4f60f985c41c93d2d0ea7eb
Infos:

Detection

Tsunami

Score:	84
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Tsunami

Executes the "crontab" command typically for achieving persistence

Explicitly modifies time stamps using the "touch" command

Sample tries to persist itself using cron

Creates hidden files and/or directories

Creates hidden files without content (potentially used as a mutex)

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "grep" command used to find patterns in files or piped streams

Executes the "rm" command used to delete files or directories

Executes the "touch" command used to create files or modify time stamps

Reads system version information

Sample contains only a LOAD segment without any section mappings

Sample listens on a socket

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1645160
Start date and time:	2025-03-21 14:38:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	conf.png
Detection:	MAL
Classification:	mal84.troj.evad.linPNG@0/5@0/0

Runtime Messages

Command:	/tmp/conf.png
PID:	6211
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

system is lnxubuntu20

conf.png (PID: 6211, Parent: 6132, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/conf.png

conf.png New Fork (PID: 6213, Parent: 6211)

conf.png New Fork (PID: 6215, Parent: 6213)

sh (PID: 6215, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"

sh New Fork (PID: 6217, Parent: 6215)

conf.png New Fork (PID: 6218, Parent: 6213)

sh (PID: 6218, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod 700 /tmp/conf.png > /dev/null 2>&1 &"

sh New Fork (PID: 6220, Parent: 6218)

chmod (PID: 6220, Parent: 1860, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 700 /tmp/conf.png

conf.png New Fork (PID: 6221, Parent: 6213)

sh (PID: 6221, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "touch -acmr /bin/ls /tmp/conf.png"

sh New Fork (PID: 6223, Parent: 6221)

touch (PID: 6223, Parent: 6221, MD5: 3859c173f5d3b37be3e531b7c84a9c68) Arguments: touch -acmr /bin/ls /tmp/conf.png

conf.png New Fork (PID: 6224, Parent: 6213)

sh (PID: 6224, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "(crontab -l | grep -v \"/tmp/conf.png\" | grep -v \"no cron\" | grep -v \"lesshts/run.sh\" > /var/run/.x00846930886) > /dev/null 2>&1"

sh New Fork (PID: 6226, Parent: 6224)

sh New Fork (PID: 6227, Parent: 6226)

crontab (PID: 6227, Parent: 6226, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l

sh New Fork (PID: 6228, Parent: 6226)

grep (PID: 6228, Parent: 6226, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -v /tmp/conf.png

sh New Fork (PID: 6229, Parent: 6226)

grep (PID: 6229, Parent: 6226, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -v "no cron"

sh New Fork (PID: 6230, Parent: 6226)

grep (PID: 6230, Parent: 6226, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -v lesshts/run.sh

conf.png New Fork (PID: 6231, Parent: 6213)

sh (PID: 6231, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"* * * * * /tmp/conf.png > /dev/null 2>&1 &\" >> /var/run/.x00846930886"

conf.png New Fork (PID: 6237, Parent: 6213)

sh (PID: 6237, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "crontab /var/run/.x00846930886"

sh New Fork (PID: 6242, Parent: 6237)

crontab (PID: 6242, Parent: 6237, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab /var/run/.x00846930886

conf.png New Fork (PID: 6243, Parent: 6213)

sh (PID: 6243, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /var/run/.x00846930886"

sh New Fork (PID: 6248, Parent: 6243)

rm (PID: 6248, Parent: 6243, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /var/run/.x00846930886

conf.png New Fork (PID: 6249, Parent: 6213)

sh (PID: 6249, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cat /etc/inittab | grep -v \"/tmp/conf.png\" > /etc/inittab2"

sh New Fork (PID: 6254, Parent: 6249)

cat (PID: 6254, Parent: 6249, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /etc/inittab

sh New Fork (PID: 6255, Parent: 6249)

grep (PID: 6255, Parent: 6249, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -v /tmp/conf.png

conf.png New Fork (PID: 6256, Parent: 6213)

sh (PID: 6256, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo \"0:2345:respawn:/tmp/conf.png\" >> /etc/inittab2"

conf.png New Fork (PID: 6261, Parent: 6213)

sh (PID: 6261, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cat /etc/inittab2 > /etc/inittab"

sh New Fork (PID: 6266, Parent: 6261)

cat (PID: 6266, Parent: 6261, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /etc/inittab2

conf.png New Fork (PID: 6267, Parent: 6213)

sh (PID: 6267, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /etc/inittab2"

sh New Fork (PID: 6272, Parent: 6267)

rm (PID: 6272, Parent: 6267, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /etc/inittab2

conf.png New Fork (PID: 6273, Parent: 6213)

sh (PID: 6273, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "touch -acmr /bin/ls /etc/inittab"

sh New Fork (PID: 6278, Parent: 6273)

touch (PID: 6278, Parent: 6273, MD5: 3859c173f5d3b37be3e531b7c84a9c68) Arguments: touch -acmr /bin/ls /etc/inittab

conf.png New Fork (PID: 6279, Parent: 6213)

sh (PID: 6279, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/bin/uname -n"

sh New Fork (PID: 6284, Parent: 6279)

uname (PID: 6284, Parent: 6279, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: /bin/uname -n

conf.png New Fork (PID: 6285, Parent: 6213)

sh (PID: 6285, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/bin/uname -n"

sh New Fork (PID: 6291, Parent: 6285)

uname (PID: 6291, Parent: 6285, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: /bin/uname -n

conf.png New Fork (PID: 6292, Parent: 6213)

sh (PID: 6292, Parent: 6213, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/bin/uname -n"

sh New Fork (PID: 6297, Parent: 6292)

uname (PID: 6297, Parent: 6292, MD5: 4ac7c634c5bec95753c480e9d421dcc2) Arguments: /bin/uname -n

dash New Fork (PID: 6355, Parent: 4331)

rm (PID: 6355, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.U04JniX6To /tmp/tmp.83mzqoU2jO /tmp/tmp.JoCGz7H2nA

dash New Fork (PID: 6356, Parent: 4331)

rm (PID: 6356, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.U04JniX6To /tmp/tmp.83mzqoU2jO /tmp/tmp.JoCGz7H2nA

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Tsunami		No Attribution	http://get.cyberx-labs.com/radiation-report http://researchcenter.paloaltonetworks.com/2017/04/unit42-new-iotlinux-malware-targets-dvrs-forms-botnet/ https://asec.ahnlab.com/en/54647/ https://blog.aquasec.com/8220-gang-confluence-vulnerability-cve-2022-26134 https://blog.aquasec.com/fileless-malware-container-security	https://malpedia.caad.fkie.fraunhofer.de/details/elf.tsunami

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
conf.png	Linux_Trojan_Tsunami_97288af8	unknown	unknown	0xc1936:$a: 61 6E 64 65 6D 6F 20 73 68 69 72 61 6E 61 69 20 77 61 20 79 6F 2C

Memory Dumps

Source	Rule	Description	Author	Strings
6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x155e28:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x155e48:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp	LinuxTsunami	unknown	unknown	0x157ce8:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Process Memory Space: conf.png PID: 6211	JoeSecurity_Tsunami	Yara detected Tsunami	Joe Security
Process Memory Space: conf.png PID: 6211	Linux_Trojan_Tsunami_ad60d7e8	unknown	unknown	0x9d52:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64 0x9d71:$a: 4E 4F 54 49 43 45 20 25 73 20 3A 53 70 6F 6F 66 73 3A 20 25 64 2E 25 64 2E 25 64 2E 25 64
Process Memory Space: conf.png PID: 6211	LinuxTsunami	unknown	unknown	0xb8b1:$c: NOTICE %s :I'm having a problem resolving my host, someone will have to SPOOFS me manually.
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: conf.png

Avira: detected

Multi AV Scanner detection for submitted file

Source: conf.png	Virustotal: Detection: 61%			Perma Link
Source: conf.png	ReversingLabs: Detection: 53%

Source: global traffic	TCP traffic: 192.168.2.23:41200 -> 202.28.32.30:8080
Source: global traffic	TCP traffic: 192.168.2.23:36720 -> 211.103.199.98:8080
Source: global traffic	TCP traffic: 192.168.2.23:59270 -> 202.165.193.211:8080
Source: global traffic	TCP traffic: 192.168.2.23:37834 -> 216.215.60.21:8080
Source: global traffic	TCP traffic: 192.168.2.23:58562 -> 147.252.1.254:8080
Source: global traffic	TCP traffic: 192.168.2.23:53304 -> 83.143.80.227:8080

Source: /tmp/conf.png (PID: 6213)

Socket: 127.0.0.1:64008

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 211.103.199.98
Source: unknown	TCP traffic detected without corresponding DNS query: 211.103.199.98
Source: unknown	TCP traffic detected without corresponding DNS query: 211.103.199.98
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 211.103.199.98
Source: unknown	TCP traffic detected without corresponding DNS query: 202.165.193.211
Source: unknown	TCP traffic detected without corresponding DNS query: 202.165.193.211
Source: unknown	TCP traffic detected without corresponding DNS query: 202.165.193.211
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 202.165.193.211
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 216.215.60.21
Source: unknown	TCP traffic detected without corresponding DNS query: 216.215.60.21
Source: unknown	TCP traffic detected without corresponding DNS query: 216.215.60.21
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 216.215.60.21
Source: unknown	TCP traffic detected without corresponding DNS query: 147.252.1.254
Source: unknown	TCP traffic detected without corresponding DNS query: 211.103.199.98
Source: unknown	TCP traffic detected without corresponding DNS query: 211.103.199.98
Source: unknown	TCP traffic detected without corresponding DNS query: 211.103.199.98
Source: unknown	TCP traffic detected without corresponding DNS query: 211.103.199.98
Source: unknown	TCP traffic detected without corresponding DNS query: 83.143.80.227
Source: unknown	TCP traffic detected without corresponding DNS query: 83.143.80.227
Source: unknown	TCP traffic detected without corresponding DNS query: 83.143.80.227
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 83.143.80.227
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 147.252.1.254
Source: unknown	TCP traffic detected without corresponding DNS query: 147.252.1.254
Source: unknown	TCP traffic detected without corresponding DNS query: 147.252.1.254
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 202.28.32.30

Source: conf.png, 6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp	String found in binary or memory: http://www.debian.org/Bugs/
Source: conf.png, 6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33608 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39248
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: conf.png, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_97288af8 Author: unknown
Source: 6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: 6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Author: unknown
Source: Process Memory Space: conf.png PID: 6211, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 Author: unknown
Source: Process Memory Space: conf.png PID: 6211, type: MEMORYSTR	Matched rule: LinuxTsunami Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: conf.png, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_97288af8 reference_sample = c39eb055c5f71ebfd6881ff04e876f49495c0be5560687586fc47bf5faee0c84, os = linux, severity = x86, creation_date = 2021-12-13, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = a1e20b699822b47359c8585ff01da06f585b9d7187a433fe0151394b16aa8113, id = 97288af8-f447-48ba-9df3-4e90f1420249, last_modified = 2022-01-26
Source: 6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: 6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp, type: MEMORY	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_
Source: Process Memory Space: conf.png PID: 6211, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_ad60d7e8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = e1ca4c566307238a5d8cd16db8d0d528626e0b92379177b167ce25b4c88d10ce, id = ad60d7e8-0823-4bfa-b823-681c554bf297, last_modified = 2021-09-16
Source: Process Memory Space: conf.png PID: 6211, type: MEMORYSTR	Matched rule: LinuxTsunami Description = Strings inside, Reference = http://www.kernelmode.info/forum/viewtopic.php?f=16&t=3483, Date = 2014/09/12, Author = @benkow_

Source: classification engine

Classification label: mal84.troj.evad.linPNG@0/5@0/0

Persistence and Installation Behavior

Executes the "crontab" command typically for achieving persistence

Source: /bin/sh (PID: 6227)	Crontab executable: /usr/bin/crontab -> crontab -l			Jump to behavior
Source: /bin/sh (PID: 6242)	Crontab executable: /usr/bin/crontab -> crontab /var/run/.x00846930886			Jump to behavior

Explicitly modifies time stamps using the "touch" command

Source: /bin/sh (PID: 6223)	Touch executable uses timestamp modification options: touch -acmr /bin/ls /tmp/conf.png			Jump to behavior
Source: /bin/sh (PID: 6278)	Touch executable uses timestamp modification options: touch -acmr /bin/ls /etc/inittab			Jump to behavior

Sample tries to persist itself using cron

Source: /usr/bin/crontab (PID: 6242)	File: /var/spool/cron/crontabs/tmp.01vzQa			Jump to behavior
Source: /usr/bin/crontab (PID: 6242)	File: /var/spool/cron/crontabs/root			Jump to behavior

Source: /bin/sh (PID: 6230)	File: /var/run/.x00846930886	Jump to behavior
Source: /bin/sh (PID: 6231)	File: /var/run/.x00846930886	Jump to behavior
Source: /usr/bin/crontab (PID: 6242)	Directory: /var/run/.x00846930886	Jump to behavior

Source: /bin/sh (PID: 6231)

Empty hidden file: /var/run/.x00846930886

Jump to behavior

Source: /tmp/conf.png (PID: 6215)	Shell command executed: sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"	Jump to behavior
Source: /tmp/conf.png (PID: 6218)	Shell command executed: sh -c "chmod 700 /tmp/conf.png > /dev/null 2>&1 &"	Jump to behavior
Source: /tmp/conf.png (PID: 6221)	Shell command executed: sh -c "touch -acmr /bin/ls /tmp/conf.png"	Jump to behavior
Source: /tmp/conf.png (PID: 6224)	Shell command executed: sh -c "(crontab -l \| grep -v \"/tmp/conf.png\" \| grep -v \"no cron\" \| grep -v \"lesshts/run.sh\" > /var/run/.x00846930886) > /dev/null 2>&1"	Jump to behavior
Source: /tmp/conf.png (PID: 6231)	Shell command executed: sh -c "echo \"* * * * * /tmp/conf.png > /dev/null 2>&1 &\" >> /var/run/.x00846930886"	Jump to behavior
Source: /tmp/conf.png (PID: 6237)	Shell command executed: sh -c "crontab /var/run/.x00846930886"	Jump to behavior
Source: /tmp/conf.png (PID: 6243)	Shell command executed: sh -c "rm -rf /var/run/.x00846930886"	Jump to behavior
Source: /tmp/conf.png (PID: 6249)	Shell command executed: sh -c "cat /etc/inittab \| grep -v \"/tmp/conf.png\" > /etc/inittab2"	Jump to behavior
Source: /tmp/conf.png (PID: 6256)	Shell command executed: sh -c "echo \"0:2345:respawn:/tmp/conf.png\" >> /etc/inittab2"	Jump to behavior
Source: /tmp/conf.png (PID: 6261)	Shell command executed: sh -c "cat /etc/inittab2 > /etc/inittab"	Jump to behavior
Source: /tmp/conf.png (PID: 6267)	Shell command executed: sh -c "rm -rf /etc/inittab2"	Jump to behavior
Source: /tmp/conf.png (PID: 6273)	Shell command executed: sh -c "touch -acmr /bin/ls /etc/inittab"	Jump to behavior
Source: /tmp/conf.png (PID: 6279)	Shell command executed: sh -c "/bin/uname -n"	Jump to behavior
Source: /tmp/conf.png (PID: 6285)	Shell command executed: sh -c "/bin/uname -n"	Jump to behavior
Source: /tmp/conf.png (PID: 6292)	Shell command executed: sh -c "/bin/uname -n"	Jump to behavior

Source: /bin/sh (PID: 6220)

Chmod executable: /usr/bin/chmod -> chmod 700 /tmp/conf.png

Jump to behavior

Source: /bin/sh (PID: 6228)	Grep executable: /usr/bin/grep -> grep -v /tmp/conf.png	Jump to behavior
Source: /bin/sh (PID: 6229)	Grep executable: /usr/bin/grep -> grep -v "no cron"	Jump to behavior
Source: /bin/sh (PID: 6230)	Grep executable: /usr/bin/grep -> grep -v lesshts/run.sh	Jump to behavior
Source: /bin/sh (PID: 6255)	Grep executable: /usr/bin/grep -> grep -v /tmp/conf.png	Jump to behavior

Source: /bin/sh (PID: 6248)	Rm executable: /usr/bin/rm -> rm -rf /var/run/.x00846930886	Jump to behavior
Source: /bin/sh (PID: 6272)	Rm executable: /usr/bin/rm -> rm -rf /etc/inittab2	Jump to behavior
Source: /usr/bin/dash (PID: 6355)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.U04JniX6To /tmp/tmp.83mzqoU2jO /tmp/tmp.JoCGz7H2nA	Jump to behavior
Source: /usr/bin/dash (PID: 6356)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.U04JniX6To /tmp/tmp.83mzqoU2jO /tmp/tmp.JoCGz7H2nA	Jump to behavior

Source: /bin/sh (PID: 6223)	Touch executable: /usr/bin/touch -> touch -acmr /bin/ls /tmp/conf.png			Jump to behavior
Source: /bin/sh (PID: 6278)	Touch executable: /usr/bin/touch -> touch -acmr /bin/ls /etc/inittab			Jump to behavior

Source: /tmp/conf.png (PID: 6213)

Reads version info: /proc/version

Jump to behavior

Source: /usr/bin/chmod (PID: 6220)

File: /tmp/conf.png (bits: - usr: - grp: - all: rwx)

Jump to behavior

Source: conf.png

Submission file: segment LOAD with 7.8018 entropy (max. 8.0)

Source: /tmp/conf.png (PID: 6211)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/uname (PID: 6284)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/uname (PID: 6291)	Queries kernel information via 'uname':	Jump to behavior
Source: /bin/uname (PID: 6297)	Queries kernel information via 'uname':	Jump to behavior

Source: conf.png, 6211.1.00005577c6ce0000.00005577c6e8e000.rw-.sdmp	Binary or memory string: wU!/etc/qemu-binfmt/arm
Source: conf.png, 6211.1.00007ffd4c94c000.00007ffd4c96d000.rw-.sdmp	Binary or memory string: sx86_64/usr/bin/qemu-arm/tmp/conf.pngSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/conf.png
Source: conf.png, 6211.1.00005577c6ce0000.00005577c6e8e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: conf.png, 6211.1.00007ffd4c94c000.00007ffd4c96d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Tsunami

Source: Yara match	File source: 6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: conf.png PID: 6211, type: MEMORYSTR

Remote Access Functionality

Yara detected Tsunami

Source: Yara match	File source: 6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: conf.png PID: 6211, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Hide Artifacts	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	2 File and Directory Permissions Modification	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Indicator Removal	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
conf.png	61%	Virustotal		Browse
conf.png	54%	ReversingLabs	Linux.Trojan.Tsunami
conf.png	100%	Avira	LINUX/Tsunami.tfrtv

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.debian.org/Bugs/	conf.png, 6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp	false		high
http://www.openssl.org/support/faq.html	conf.png, 6211.1.00007f5c98017000.00007f5c981b9000.r-x.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
147.252.1.254	unknown	Ireland	1213	HEANETIE	false
216.215.60.21	unknown	United States	46392	GCPOWERNETUS	false
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
211.103.199.98	unknown	China	17964	DXTNETBeijingDian-Xin-TongNetworkTechnologiesCoLtd	false
202.165.193.211	unknown	Papua New Guinea	17828	PNGDATACOLIMITED-AS-PGPNGDATACOLTDPG	false
202.28.32.30	unknown	Thailand	9562	MSU-TH-APMahasarakhamUniversityTH	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
83.143.80.227	unknown	Norway	34989	SERVETHEWORLD-ASNO	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	miner.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	arm7.elf	Get hash	malicious	Mirai	Browse
	eehah4.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	linux_arm5.elf	Get hash	malicious	Chaos	Browse
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
34.249.145.219	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	sparc.nn.elf	Get hash	malicious	Mirai	Browse
	miner.elf	Get hash	malicious	Unknown	Browse
	miner.elf	Get hash	malicious	Unknown	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GCPOWERNETUS	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	162.246.30.37
	GqM7ZJDz69.elf	Get hash	malicious	Unknown	Browse	162.246.30.10
	apep.arm7	Get hash	malicious	Mirai	Browse	162.246.30.46
	h0Zfzahz2m	Get hash	malicious	Gafgyt Mirai	Browse	162.246.29.35
	B9NYHbUNyZ	Get hash	malicious	Gafgyt Mirai	Browse	162.246.29.35
AMAZON-02US	https://gateway.btfs.io/btfs/Qmbzme7iX8d3RS7sQkyvDwwsL6z2KB788hUr=%206F8CQAJrB6#adres@example.com	Get hash	malicious	Unknown	Browse	18.238.49.110
	Optimum Nationwide - development 2025.pdf	Get hash	malicious	HTMLPhisher	Browse	108.138.106.65
	https://www.psychologie-sociale.com	Get hash	malicious	Unknown	Browse	18.238.55.92
	https://outl0okwebadmin.pages.dev/owa	Get hash	malicious	HTMLPhisher	Browse	13.226.94.12
	https://outl0okwebadmin.pages.dev/owa	Get hash	malicious	HTMLPhisher	Browse	13.226.94.10
	https://vintagelights.com/%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%201/	Get hash	malicious	HTMLPhisher	Browse	108.139.47.125
	na.elf	Get hash	malicious	Prometei	Browse	34.243.160.129
	na.elf	Get hash	malicious	Prometei	Browse	52.212.150.54
	na.elf	Get hash	malicious	Prometei	Browse	52.212.150.54
	na.elf	Get hash	malicious	Prometei	Browse	52.212.150.54
DXTNETBeijingDian-Xin-TongNetworkTechnologiesCoLtd	jklspc.elf	Get hash	malicious	Unknown	Browse	203.207.123.60
	jaws.elf	Get hash	malicious	Unknown	Browse	60.253.136.163
	1isequal9.mpsl.elf	Get hash	malicious	Unknown	Browse	202.130.20.165
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	203.207.123.33
	m68k.elf	Get hash	malicious	Unknown	Browse	211.101.17.244
	morte.arm.elf	Get hash	malicious	Unknown	Browse	219.234.173.23
	res.spc.elf	Get hash	malicious	Unknown	Browse	211.101.106.224
	res.sh4.elf	Get hash	malicious	Unknown	Browse	203.207.172.10
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	219.234.243.210
	arm7	Get hash	malicious	Unknown	Browse	203.207.123.32
HEANETIE	x86_64.elf	Get hash	malicious	Mirai	Browse	157.190.28.110
	i486.elf	Get hash	malicious	Mirai	Browse	87.47.64.237
	hoho.i486.elf	Get hash	malicious	Unknown	Browse	136.206.92.53
	splx86.elf	Get hash	malicious	Unknown	Browse	87.34.185.245
	resgod.mips.elf	Get hash	malicious	Mirai	Browse	87.37.255.17
	resgod.x86.elf	Get hash	malicious	Mirai	Browse	157.190.234.187
	hoho.m68k.elf	Get hash	malicious	Unknown	Browse	193.1.236.142
	ssh.arm.elf	Get hash	malicious	Mirai	Browse	44.155.182.218
	hgfs.arm5.elf	Get hash	malicious	Unknown	Browse	87.33.59.66
	hgfs.mips.elf	Get hash	malicious	Unknown	Browse	143.239.194.203
AMAZON-02US	https://gateway.btfs.io/btfs/Qmbzme7iX8d3RS7sQkyvDwwsL6z2KB788hUr=%206F8CQAJrB6#adres@example.com	Get hash	malicious	Unknown	Browse	18.238.49.110
	Optimum Nationwide - development 2025.pdf	Get hash	malicious	HTMLPhisher	Browse	108.138.106.65
	https://www.psychologie-sociale.com	Get hash	malicious	Unknown	Browse	18.238.55.92
	https://outl0okwebadmin.pages.dev/owa	Get hash	malicious	HTMLPhisher	Browse	13.226.94.12
	https://outl0okwebadmin.pages.dev/owa	Get hash	malicious	HTMLPhisher	Browse	13.226.94.10
	https://vintagelights.com/%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%201/	Get hash	malicious	HTMLPhisher	Browse	108.139.47.125
	na.elf	Get hash	malicious	Prometei	Browse	34.243.160.129
	na.elf	Get hash	malicious	Prometei	Browse	52.212.150.54
	na.elf	Get hash	malicious	Prometei	Browse	52.212.150.54
	na.elf	Get hash	malicious	Prometei	Browse	52.212.150.54

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/inittab

Download File

Process:	/usr/bin/cat
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.297130563869282
Encrypted:	false
SSDEEP:	3:IQfXzs/3hIn:IQghIn
MD5:	C7F84E39ADD6606880B95C83F92202A2
SHA1:	C6FF30A7AD6417BBAD81C34CFEB8FF519E87A2E1
SHA-256:	997EACC8E2251E35D421543C355FEC29557484CB8F74D9A626CC61DAC06E4878
SHA-512:	54A9C3BA85201734F700268B280AA22341C7341F2CE961D168E5A5AF0419D59BA04A9278241E31B36E8E4E85BE6685D150F287E26CA743A0B62C2DB6D8CC171E
Malicious:	true
Reputation:	low
Preview:	0:2345:respawn:/tmp/conf.png.

/etc/inittab2

Download File

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.297130563869282
Encrypted:	false
SSDEEP:	3:IQfXzs/3hIn:IQghIn
MD5:	C7F84E39ADD6606880B95C83F92202A2
SHA1:	C6FF30A7AD6417BBAD81C34CFEB8FF519E87A2E1
SHA-256:	997EACC8E2251E35D421543C355FEC29557484CB8F74D9A626CC61DAC06E4878
SHA-512:	54A9C3BA85201734F700268B280AA22341C7341F2CE961D168E5A5AF0419D59BA04A9278241E31B36E8E4E85BE6685D150F287E26CA743A0B62C2DB6D8CC171E
Malicious:	false
Reputation:	low
Preview:	0:2345:respawn:/tmp/conf.png.

/run/.x00846930886

Download File

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	43
Entropy (8bit):	4.0101286386653285
Encrypted:	false
SSDEEP:	3:3P11waKd3h3B2sFz:IBNh3DFz
MD5:	DE2F5871B285C0B9BF3DB0FF85B95814
SHA1:	CCA2DB8A7E6B5737D77F81444636FA863FC9E861
SHA-256:	BD6E6129D1E27F1CD2DD311B85BF8687E395467DC86F5A2ADC9378A8AA24CAAC
SHA-512:	4865C82527C8B6A9A85F739BD9CC2025DA6366C372A68B87B3762D5BB273E1DF88C31B59E5E47A855779977677C64FDC45219783733745F25293D1FCC314960C
Malicious:	true
Reputation:	low
Preview:	* * * * * /tmp/conf.png > /dev/null 2>&1 &.

/run/systemd/resolve/stub-resolv.conf

Download File

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.221097250057958
Encrypted:	false
SSDEEP:	3:KkN:KW
MD5:	FE0B86955E4EB444F17F54D086580B1F
SHA1:	E19182DD3A1465BDA3AA2E1A63067BEC82DD5AD3
SHA-256:	BE102039B1DC4747490C6994CA8DC17D12D32219561F8BA23E8C0B865AC223ED
SHA-512:	6E03176E423005C87C6C7B2EC4E90C46639D4311839A980317102A10445BC563E1C9E288605D6D5B18FADD32563C4C0AE2284F6016A54C81E5A97FA7C3CD5A26
Malicious:	false
Reputation:	low
Preview:	nameserver 8.8.8.8.

/var/spool/cron/crontabs/tmp.01vzQa

Download File

Process:	/usr/bin/crontab
File Type:	ASCII text
Category:	dropped
Size (bytes):	239
Entropy (8bit):	5.210365098761063
Encrypted:	false
SSDEEP:	6:SUrpqoqQjEOP1K+1xbJYJOBFQZ0Dk4iGMQ5UYLtCFt39YBNh3DFz:8Qjx8Z/4UeHLU9Yfh9
MD5:	B58240B233B5C5D1E9D0C85453B73CAF
SHA1:	D65311C1F7BC471939FB2A69A14DEC629893F602
SHA-256:	57E529B60FE83551A940AE5A08932E58BE08308E176A5492976D3F89C972C861
SHA-512:	2EA7013BB351B704B43A6D8A7531A442B4CFA52B5AFAE930BA807693F8206E4E50078AC24F4D27BF7930B135F02FE3B0C5DBD641DC03C021E45D13979109345E
Malicious:	true
Reputation:	low
Preview:	# DO NOT EDIT THIS FILE - edit the master and reinstall..# (/var/run/.x00846930886 installed on Fri Mar 21 08:39:19 2025).# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $).* * * * * /tmp/conf.png > /dev/null 2>&1 &.

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI5 version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.818871871361637
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	conf.png
File size:	924'980 bytes
MD5:	65234357f9c2f318acac81d881bb27f2
SHA1:	f9094f8226f694dce08d02b96101dfed94097e74
SHA256:	cef751cdfbabbdde4670d99eece963b1730da16da4f60f985c41c93d2d0ea7eb
SHA512:	538fd9db53f15d0258c00640485297b19a46e9908594236538d1a86a3ca3a3283a08e9ac912f9be7b4de616639a1a6e95d08db396f48b8a170ef43670acdcbd7
SSDEEP:	24576:gbkLpPSpXOL6eKL/z8JOuNvgK3Omu71D7SWR6QGx:1RNC/zCt6F7SBJ
TLSH:	AD15239C83DE7A810BFB187E74ED34AD69D313105F424CE9EE712A6307E40F607AA985
File Content Preview:	.ELF..............(.........4...........4. ...(...................... ... ..........................................6.l.........................x.........ELF......(.v.....4...9.&.... ..~6....?p.......<............p..]..'....}.D........m?....H..D.X.l..]..?

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0xc9710
Flags:	0x5000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	2
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
LOAD	0x0	0x8000	0x8000	0xc200f	0xc200f	7.8018	0x5	R E	0x8000
LOAD	0x2e10	0x1bae10	0x1bae10	0x0	0x0	0.0000	0x6	RW	0x8000

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 64
• 8080 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 21, 2025 14:39:17.028408051 CET	33608	443	192.168.2.23	54.171.230.55
Mar 21, 2025 14:39:17.796392918 CET	43928	443	192.168.2.23	91.189.91.42
Mar 21, 2025 14:39:21.180093050 CET	41200	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:39:22.211754084 CET	41200	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:39:23.427526951 CET	42836	443	192.168.2.23	91.189.91.43
Mar 21, 2025 14:39:24.227368116 CET	41200	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:39:24.963449001 CET	42516	80	192.168.2.23	109.202.202.202
Mar 21, 2025 14:39:28.290829897 CET	41200	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:39:31.201066971 CET	36720	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:39:32.226284981 CET	36720	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:39:34.242149115 CET	36720	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:39:38.017576933 CET	43928	443	192.168.2.23	91.189.91.42
Mar 21, 2025 14:39:38.273452997 CET	36720	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:39:41.228679895 CET	59270	8080	192.168.2.23	202.165.193.211
Mar 21, 2025 14:39:42.240916014 CET	59270	8080	192.168.2.23	202.165.193.211
Mar 21, 2025 14:39:44.256959915 CET	59270	8080	192.168.2.23	202.165.193.211
Mar 21, 2025 14:39:45.553956985 CET	39248	443	192.168.2.23	34.249.145.219
Mar 21, 2025 14:39:45.554044008 CET	443	39248	34.249.145.219	192.168.2.23
Mar 21, 2025 14:39:45.554167986 CET	39248	443	192.168.2.23	34.249.145.219
Mar 21, 2025 14:39:45.555109978 CET	39248	443	192.168.2.23	34.249.145.219
Mar 21, 2025 14:39:45.555160046 CET	443	39248	34.249.145.219	192.168.2.23
Mar 21, 2025 14:39:48.512352943 CET	59270	8080	192.168.2.23	202.165.193.211
Mar 21, 2025 14:39:50.303895950 CET	42836	443	192.168.2.23	91.189.91.43
Mar 21, 2025 14:39:51.260669947 CET	37834	8080	192.168.2.23	216.215.60.21
Mar 21, 2025 14:39:52.287544966 CET	37834	8080	192.168.2.23	216.215.60.21
Mar 21, 2025 14:39:54.303405046 CET	37834	8080	192.168.2.23	216.215.60.21
Mar 21, 2025 14:39:54.399377108 CET	42516	80	192.168.2.23	109.202.202.202
Mar 21, 2025 14:39:58.494769096 CET	37834	8080	192.168.2.23	216.215.60.21
Mar 21, 2025 14:40:01.290966034 CET	58562	8080	192.168.2.23	147.252.1.254
Mar 21, 2025 14:40:01.464036942 CET	8080	58562	147.252.1.254	192.168.2.23
Mar 21, 2025 14:40:02.295571089 CET	36730	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:40:03.326004982 CET	36730	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:40:05.341742039 CET	36730	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:40:09.501245022 CET	36730	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:40:12.321266890 CET	53304	8080	192.168.2.23	83.143.80.227
Mar 21, 2025 14:40:13.340724945 CET	53304	8080	192.168.2.23	83.143.80.227
Mar 21, 2025 14:40:15.356389046 CET	53304	8080	192.168.2.23	83.143.80.227
Mar 21, 2025 14:40:18.971997976 CET	43928	443	192.168.2.23	91.189.91.42
Mar 21, 2025 14:40:19.483958960 CET	53304	8080	192.168.2.23	83.143.80.227
Mar 21, 2025 14:40:22.345907927 CET	41216	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:23.355297089 CET	41216	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:25.371021032 CET	41216	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:29.466557980 CET	41216	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:32.370604992 CET	41218	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:33.401987076 CET	41218	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:35.417630911 CET	41218	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:39.449129105 CET	41218	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:42.395078897 CET	58572	8080	192.168.2.23	147.252.1.254
Mar 21, 2025 14:40:42.566521883 CET	8080	58572	147.252.1.254	192.168.2.23
Mar 21, 2025 14:40:43.399746895 CET	58574	8080	192.168.2.23	147.252.1.254
Mar 21, 2025 14:40:43.570358992 CET	8080	58574	147.252.1.254	192.168.2.23
Mar 21, 2025 14:40:44.403819084 CET	58576	8080	192.168.2.23	147.252.1.254
Mar 21, 2025 14:40:44.574054003 CET	8080	58576	147.252.1.254	192.168.2.23
Mar 21, 2025 14:40:45.407897949 CET	41226	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:45.546519041 CET	39248	443	192.168.2.23	34.249.145.219
Mar 21, 2025 14:40:45.588341951 CET	443	39248	34.249.145.219	192.168.2.23
Mar 21, 2025 14:40:46.424118996 CET	41226	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:48.439856052 CET	41226	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:52.503390074 CET	41226	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:55.432096004 CET	41228	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:56.438735008 CET	41228	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:40:58.454505920 CET	41228	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:41:02.486010075 CET	41228	8080	192.168.2.23	202.28.32.30
Mar 21, 2025 14:41:05.457179070 CET	37856	8080	192.168.2.23	216.215.60.21
Mar 21, 2025 14:41:06.485357046 CET	37856	8080	192.168.2.23	216.215.60.21
Mar 21, 2025 14:41:08.501080036 CET	37856	8080	192.168.2.23	216.215.60.21
Mar 21, 2025 14:41:12.724627972 CET	37856	8080	192.168.2.23	216.215.60.21
Mar 21, 2025 14:41:15.478440046 CET	36750	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:41:16.500016928 CET	36750	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:41:18.515651941 CET	36750	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:41:22.707036972 CET	36750	8080	192.168.2.23	211.103.199.98
Mar 21, 2025 14:41:23.999202967 CET	443	39248	34.249.145.219	192.168.2.23

System Behavior

Analysis Process: conf.png PID: 6211, Parent PID: 6132

General

Start time (UTC):	13:39:18
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	/tmp/conf.png
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: conf.png PID: 6213, Parent PID: 6211

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

Network Activities

Socket Listening

Socket Connecting

Chronological Activities

Analysis Process: conf.png PID: 6215, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6215, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "echo \"nameserver 8.8.8.8\" > /etc/resolv.conf &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6217, Parent PID: 6215

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Written

Chronological Activities

Analysis Process: conf.png PID: 6218, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6218, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "chmod 700 /tmp/conf.png > /dev/null 2>&1 &"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6220, Parent PID: 6218

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: chmod PID: 6220, Parent PID: 1860

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/usr/bin/chmod
Arguments:	chmod 700 /tmp/conf.png
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

File Activities

File Opened

File Read

Permission Modified

Chronological Activities

Analysis Process: conf.png PID: 6221, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6221, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "touch -acmr /bin/ls /tmp/conf.png"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6223, Parent PID: 6221

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: touch PID: 6223, Parent PID: 6221

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/usr/bin/touch
Arguments:	touch -acmr /bin/ls /tmp/conf.png
File size:	100728 bytes
MD5 hash:	3859c173f5d3b37be3e531b7c84a9c68

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: conf.png PID: 6224, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6224, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "(crontab -l \| grep -v \"/tmp/conf.png\" \| grep -v \"no cron\" \| grep -v \"lesshts/run.sh\" > /var/run/.x00846930886) > /dev/null 2>&1"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6226, Parent PID: 6224

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6227, Parent PID: 6226

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: crontab PID: 6227, Parent PID: 6226

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/usr/bin/crontab
Arguments:	crontab -l
File size:	43720 bytes
MD5 hash:	66e521d421ac9b407699061bf21806f5

File Activities

File Opened

File Read

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: sh PID: 6228, Parent PID: 6226

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: grep PID: 6228, Parent PID: 6226

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/usr/bin/grep
Arguments:	grep -v /tmp/conf.png
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 6229, Parent PID: 6226

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: grep PID: 6229, Parent PID: 6226

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/usr/bin/grep
Arguments:	grep -v "no cron"
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 6230, Parent PID: 6226

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: grep PID: 6230, Parent PID: 6226

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/usr/bin/grep
Arguments:	grep -v lesshts/run.sh
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: conf.png PID: 6231, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6231, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "echo \"* * * * * /tmp/conf.png > /dev/null 2>&1 &\" >> /var/run/.x00846930886"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

File Written

Chronological Activities

Analysis Process: conf.png PID: 6237, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6237, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "crontab /var/run/.x00846930886"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6242, Parent PID: 6237

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: crontab PID: 6242, Parent PID: 6237

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/usr/bin/crontab
Arguments:	crontab /var/run/.x00846930886
File size:	43720 bytes
MD5 hash:	66e521d421ac9b407699061bf21806f5

File Activities

File Opened

File Read

File Written

File Moved

Permission Modified

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: conf.png PID: 6243, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6243, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "rm -rf /var/run/.x00846930886"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6248, Parent PID: 6243

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6248, Parent PID: 6243

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/usr/bin/rm
Arguments:	rm -rf /var/run/.x00846930886
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: conf.png PID: 6249, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6249, Parent PID: 6213

General

Start time (UTC):	13:39:19
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "cat /etc/inittab \| grep -v \"/tmp/conf.png\" > /etc/inittab2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6254, Parent PID: 6249

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: cat PID: 6254, Parent PID: 6249

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/usr/bin/cat
Arguments:	cat /etc/inittab
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: sh PID: 6255, Parent PID: 6249

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: grep PID: 6255, Parent PID: 6249

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/usr/bin/grep
Arguments:	grep -v /tmp/conf.png
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: conf.png PID: 6256, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6256, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "echo \"0:2345:respawn:/tmp/conf.png\" >> /etc/inittab2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

File Written

Chronological Activities

Analysis Process: conf.png PID: 6261, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6261, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "cat /etc/inittab2 > /etc/inittab"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6266, Parent PID: 6261

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: cat PID: 6266, Parent PID: 6261

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/usr/bin/cat
Arguments:	cat /etc/inittab2
File size:	43416 bytes
MD5 hash:	7e9d213e404ad3bb82e4ebb2e1f2c1b3

File Activities

File Opened

File Read

File Written

Chronological Activities

Analysis Process: conf.png PID: 6267, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6267, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "rm -rf /etc/inittab2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6272, Parent PID: 6267

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6272, Parent PID: 6267

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/usr/bin/rm
Arguments:	rm -rf /etc/inittab2
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: conf.png PID: 6273, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6273, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "touch -acmr /bin/ls /etc/inittab"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6278, Parent PID: 6273

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: touch PID: 6278, Parent PID: 6273

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/usr/bin/touch
Arguments:	touch -acmr /bin/ls /etc/inittab
File size:	100728 bytes
MD5 hash:	3859c173f5d3b37be3e531b7c84a9c68

File Activities

File Opened

File Read

Chronological Activities

Analysis Process: conf.png PID: 6279, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6279, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "/bin/uname -n"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6284, Parent PID: 6279

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: uname PID: 6284, Parent PID: 6279

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/uname
Arguments:	/bin/uname -n
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

File Activities

File Opened

File Read

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: conf.png PID: 6285, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6285, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "/bin/uname -n"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6291, Parent PID: 6285

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: uname PID: 6291, Parent PID: 6285

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/uname
Arguments:	/bin/uname -n
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

File Activities

File Opened

File Read

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: conf.png PID: 6292, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/tmp/conf.png
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Process Activities

Process Overlayed (Exec)

Thread Sleep

Chronological Activities

Analysis Process: sh PID: 6292, Parent PID: 6213

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	sh -c "/bin/uname -n"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

File Activities

File Opened

File Read

Process Activities

Process Forked

Chronological Activities

Analysis Process: sh PID: 6297, Parent PID: 6292

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: uname PID: 6297, Parent PID: 6292

General

Start time (UTC):	13:39:20
Start date (UTC):	21/03/2025
Path:	/bin/uname
Arguments:	/bin/uname -n
File size:	39288 bytes
MD5 hash:	4ac7c634c5bec95753c480e9d421dcc2

File Activities

File Opened

File Read

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: dash PID: 6355, Parent PID: 4331

General

Start time (UTC):	13:40:44
Start date (UTC):	21/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6355, Parent PID: 4331

General

Start time (UTC):	13:40:44
Start date (UTC):	21/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.U04JniX6To /tmp/tmp.83mzqoU2jO /tmp/tmp.JoCGz7H2nA
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 6356, Parent PID: 4331

General

Start time (UTC):	13:40:44
Start date (UTC):	21/03/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6356, Parent PID: 4331

General

Start time (UTC):	13:40:44
Start date (UTC):	21/03/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.U04JniX6To /tmp/tmp.83mzqoU2jO /tmp/tmp.JoCGz7H2nA
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Creation, File: File Metadata, File: File Modification, Firmware: Firmware Modification, Process: OS API Execution, Process: Process Creation, Script: Script Execution, Service: Service Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report conf.png

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/inittab

/etc/inittab2

/run/.x00846930886

/run/systemd/resolve/stub-resolv.conf

/var/spool/cron/crontabs/tmp.01vzQa

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: conf.png PID: 6211, Parent PID: 6132

General

File Activities

File Opened

File Read

Process Activities

Process Forked

Thread Sleep

System Activities

Query System Information (uname)

Chronological Activities

Analysis Process: conf.png PID: 6213, Parent PID: 6211

General

File Activities

File Opened

File Read

Linux Analysis Report
conf.png