4b95213d319a62985493ec0930d7742c0e892323e39e121204693099858ce791 | Triage

Analysis

max time kernel
0s
max time network
103s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28/09/2022, 13:48

Sharing

Report Analysis Logs

General

Target

bruteratel/adhoc_scripts/install.sh
Size

330B
MD5

824f22de9f76d0a488e117b397631521
SHA1

46a0146dc6a5f6e84cf00504bebe1fe9366c2e05
SHA256

2843bac3fdc0cfa82edb40dced2e17323097abbf4e3abd3cdce154920c916b90
SHA512

c5fed05e897769eb318fd4f0d039a966b6e82e4a977f8cf3a07fcc810be0c2f60cf9b01728ffdfa684833f3040772491d09d893600c3f0af7414f0252b392414

Score

8^/10

persistence

Malware Config

Signatures

Modifies hosts file 1 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
/etc/hosts	/etc/hosts	sudo

Writes DNS configuration 1 TTPs 1 IoCs

Writes data to DNS resolver config file.

Dynamic Resolution

description	ioc	Process
/etc/resolv.conf	/etc/resolv.conf	sudo

Creates/modifies environment variables 1 TTPs 1 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Hijack Execution Flow

description	ioc	Process
/etc/environment	/etc/environment	sudo

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	sudo
/proc/sys/kernel/ngroups_max	/proc/sys/kernel/ngroups_max	sudo
/proc/self/fd	/proc/self/fd	Process not Found
/proc/filesystems	/proc/filesystems	dpkg
/proc/filesystems	/proc/filesystems	dpkg
/proc/self/status	/proc/self/status	apt-esm-hook
/proc/589/cmdline	/proc/589/cmdline	apt-esm-hook
/proc/self/stat	/proc/self/stat	sudo
/proc/590/status	/proc/590/status	apt-esm-hook

Writes file to tmp directory 17 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
/tmp/fileutl.message.1MUesN	/tmp/fileutl.message.1MUesN	apt-get
/tmp/fileutl.message.DNXYgK	/tmp/fileutl.message.DNXYgK	apt-get
/tmp/fileutl.message.pRy4vu	/tmp/fileutl.message.pRy4vu	apt-get
/tmp/fileutl.message.xJAzor	/tmp/fileutl.message.xJAzor	apt-get
/tmp/fileutl.message.tUYV3l	/tmp/fileutl.message.tUYV3l	apt-get
/tmp/fileutl.message.XIdlYE	/tmp/fileutl.message.XIdlYE	apt-get
/tmp/fileutl.message.bgs3SX	/tmp/fileutl.message.bgs3SX	apt-get
/tmp/fileutl.message.nKhZNg	/tmp/fileutl.message.nKhZNg	apt-get
/tmp/fileutl.message.1x5xES	/tmp/fileutl.message.1x5xES	apt-get
/tmp/fileutl.message.HenFNw	/tmp/fileutl.message.HenFNw	apt-get
/tmp/fileutl.message.7o6yEP	/tmp/fileutl.message.7o6yEP	apt-get
/tmp/fileutl.message.DZPaAb	/tmp/fileutl.message.DZPaAb	apt-get
/tmp/fileutl.message.psjGo6	/tmp/fileutl.message.psjGo6	apt-get
/tmp/fileutl.message.hAEqw8	/tmp/fileutl.message.hAEqw8	apt-get
/tmp/fileutl.message.10Jha3	/tmp/fileutl.message.10Jha3	apt-get
/tmp/bruteratel/adhoc_scripts/install.sh	/tmp/bruteratel/adhoc_scripts/install.sh	install.sh
/tmp/fileutl.message.ruw9Iz	/tmp/fileutl.message.ruw9Iz	apt-get

/tmp/bruteratel/adhoc_scripts/install.sh
/tmp/bruteratel/adhoc_scripts/install.sh
1⤵
- Writes file to tmp directory
PID:580
- /usr/bin/sudo
  sudo apt-get install nasm mingw-w64
  2⤵
  - Modifies hosts file
  - Writes DNS configuration
  - Creates/modifies environment variables
  - Reads runtime system information
  PID:581
- - /usr/bin/apt-get
    apt-get install nasm mingw-w64
    3⤵
    - Writes file to tmp directory
    PID:582
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:583
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:584
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:592

/bin/sh
sh -c "[ ! -f /usr/lib/ubuntu-advantage/apt-esm-hook ] || /usr/lib/ubuntu-advantage/apt-esm-hook pre-invoke || true"
1⤵
PID:590
- /usr/lib/ubuntu-advantage/apt-esm-hook
  /usr/lib/ubuntu-advantage/apt-esm-hook pre-invoke
  2⤵
  - Reads runtime system information
  PID:591

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

Privilege Escalation

Hijack Execution Flow

Defense Evasion

Hijack Execution Flow

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Dynamic Resolution

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads