Overview

overview

5

Static

static

wunderbar_...ium.sh

ubuntu-18.04-amd64

5

wunderbar_...ium.sh

debian-9-armhf

5

wunderbar_...ium.sh

debian-9-mips

5

wunderbar_...ium.sh

debian-9-mipsel

5

Analysis

  • max time kernel
    0s
  • max time network
    135s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20221111-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20221111-enkernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    27-11-2022 18:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    wunderbar_emporium/wunderbar_emporium.sh

  • Size

    1KB

  • MD5

    a4bd78f8b9f69b508daca4268dcc66ce

  • SHA1

    02d29ddb69616a0d3d4cf4348f51d3f81f147e67

  • SHA256

    64206f3f7d6c962fb9bf49b161e636d8be4bedde1a11d2a0164006aa25748a7e

  • SHA512

    60ba980e3cd14c0dc71f0b34b8f79cca1d2349569832a526d5b052a78baa3ceec36e6b312876251b019b3371e898d175ba0b8c7e32f8ae9a140fdb9bffa6e3c6

Score
5/10

Malware Config

Signatures

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 23 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/wunderbar_emporium/wunderbar_emporium.sh
    /tmp/wunderbar_emporium/wunderbar_emporium.sh
    1⤵
    • Writes file to tmp directory
    PID:590
    • /bin/sed
      sed "s/\\/home\\/spender/\\/tmp\\/wunderbar_emporium/g" pwnkernel.c
      2⤵
        PID:594
      • /bin/mv
        mv pwnkernel.c pwnkernel2.c
        2⤵
          PID:595
        • /bin/mv
          mv pwnkernel1.c pwnkernel.c
          2⤵
          • Reads runtime system information
          PID:596
        • /usr/bin/killall
          killall -9 pulseaudio
          2⤵
          • Reads runtime system information
          PID:597
        • /bin/uname
          uname -p
          2⤵
            PID:598
          • /bin/cat
            cat /proc/sys/vm/mmap_min_addr
            2⤵
            • Reads runtime system information
            PID:599
          • /usr/bin/cc
            cc -fno-stack-protector -fPIC -m64 -shared -o exploit.so exploit.c
            2⤵
            • Writes file to tmp directory
            PID:600
          • /usr/bin/cc
            cc -m64 -o pwnkernel pwnkernel.c
            2⤵
            • Writes file to tmp directory
            PID:610
          • ./pwnkernel
            ./pwnkernel
            2⤵
              PID:615
            • /bin/mv
              mv -f pwnkernel2.c pwnkernel.c
              2⤵
              • Reads runtime system information
              PID:616
          • /bin/sed
            sed "s/\\//\\\\\\//g"
            1⤵
              PID:593
            • /usr/lib/gcc/x86_64-linux-gnu/7/cc1
              /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu exploit.c -quiet -dumpbase exploit.c -m64 "-mtune=generic" "-march=x86-64" -auxbase exploit -fno-stack-protector -fPIC -Wformat -Wformat-security -o /tmp/ccs63KSf.s
              1⤵
              • Writes file to tmp directory
              PID:601
            • /usr/local/sbin/as
              as --64 -o /tmp/ccINdTmf.o /tmp/ccs63KSf.s
              1⤵
                PID:607
              • /usr/local/bin/as
                as --64 -o /tmp/ccINdTmf.o /tmp/ccs63KSf.s
                1⤵
                  PID:607
                • /usr/sbin/as
                  as --64 -o /tmp/ccINdTmf.o /tmp/ccs63KSf.s
                  1⤵
                    PID:607
                  • /usr/bin/as
                    as --64 -o /tmp/ccINdTmf.o /tmp/ccs63KSf.s
                    1⤵
                    • Writes file to tmp directory
                    PID:607
                  • /usr/lib/gcc/x86_64-linux-gnu/7/collect2
                    /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccC6Lgjz.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -shared -z relro -o exploit.so /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccINdTmf.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
                    1⤵
                    • Writes file to tmp directory
                    PID:608
                  • /usr/bin/ld
                    /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccC6Lgjz.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -shared -z relro -o exploit.so /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccINdTmf.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
                    1⤵
                    • Writes file to tmp directory
                    PID:609
                  • /usr/lib/gcc/x86_64-linux-gnu/7/cc1
                    /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu pwnkernel.c -quiet -dumpbase pwnkernel.c -m64 "-mtune=generic" "-march=x86-64" -auxbase pwnkernel -fstack-protector-strong -Wformat -Wformat-security -o /tmp/cccTA0Zv.s
                    1⤵
                    • Writes file to tmp directory
                    PID:611
                  • /usr/local/sbin/as
                    as --64 -o /tmp/ccLTGLVR.o /tmp/cccTA0Zv.s
                    1⤵
                      PID:612
                    • /usr/local/bin/as
                      as --64 -o /tmp/ccLTGLVR.o /tmp/cccTA0Zv.s
                      1⤵
                        PID:612
                      • /usr/sbin/as
                        as --64 -o /tmp/ccLTGLVR.o /tmp/cccTA0Zv.s
                        1⤵
                          PID:612
                        • /usr/bin/as
                          as --64 -o /tmp/ccLTGLVR.o /tmp/cccTA0Zv.s
                          1⤵
                          • Writes file to tmp directory
                          PID:612
                        • /usr/lib/gcc/x86_64-linux-gnu/7/collect2
                          /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccQSXWSd.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o pwnkernel /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccLTGLVR.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
                          1⤵
                          • Writes file to tmp directory
                          PID:613
                        • /usr/bin/ld
                          /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccQSXWSd.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o pwnkernel /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccLTGLVR.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
                          1⤵
                          • Writes file to tmp directory
                          PID:614

                        Network

                        MITRE ATT&CK Matrix

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads