dd47d4418c7c3b1b971123d2364f988f29ca78b8a7687742e8937e9ffc3bc297

Analysis

max time kernel
0s
platform
linux_amd64
resource
ubuntu1804-amd64-en-20211208
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28-12-2022 23:25

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

gog_undertale_2.0.0.1.sh
Size

122.5MB
MD5

e740df4e15974ad8c21f45ebe8426fb0
SHA1

71b07640d9da478858ebf67c3c84c42260bb427d
SHA256

dd47d4418c7c3b1b971123d2364f988f29ca78b8a7687742e8937e9ffc3bc297
SHA512

a5c307d81f99fd8697f1ac8bd911e3a9847f5306d75d671136e43c44ddbc4a5a4fb6e520d37a058865381940b9889424fc265655741964388ac9787bd1f05400
SSDEEP

3145728:Yf4gqKOqQFRZX9/jPkGw1Kd6jAfI0+Y9Yb2iQY:YggqKOqQPZt/DkGw1KdAAfICib2iQY

Score

7^/10

Malware Config

Signatures

Write file to user bin folder 1 TTPs 1 IoCs

Hijack Execution Flow

T1574

description	ioc	Process
/usr/bin/which	/usr/bin/which	which

Writes file to shm directory 2 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
/dev/shm/mojosetup-plugin-pZesiD	/dev/shm/mojosetup-plugin-pZesiD	mojosetup
/dev/shm/mojosetup-plugin-vQqbue	/dev/shm/mojosetup-plugin-vQqbue	mojosetup

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
/proc/filesystems	/proc/filesystems	mkdir
/proc/self/mountinfo	/proc/self/mountinfo	df
/proc/filesystems	/proc/filesystems	tar
/proc/filesystems	/proc/filesystems	id
/proc/filesystems	/proc/filesystems	id

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

/tmp/gog_undertale_2.0.0.1.sh
/tmp/gog_undertale_2.0.0.1.sh
1⤵
- Writes file to tmp directory
PID:581
- /usr/bin/basename
  basename /tmp/gog_undertale_2.0.0.1.sh
  2⤵
  PID:584
- /bin/mkdir
  mkdir /tmp/selfgz581
  2⤵
  - Reads runtime system information
  PID:585
- /usr/bin/basename
  basename /usr/bin/md5sum
  2⤵
  PID:596
- /usr/bin/expr
  expr 1 + 1
  2⤵
  PID:611
- /usr/bin/expr
  expr 12450 + 575617
  2⤵
  PID:612
- /bin/chgrp
  chgrp -R 0 .
  2⤵
  PID:647
- /usr/bin/expr
  expr 12450 + 575617
  2⤵
  PID:651
- ./startmojo.sh
  ./startmojo.sh
  2⤵
  PID:652
- - /bin/uname
    uname
    3⤵
    PID:653
- - /bin/grep
    grep darwin
    3⤵
    PID:658
- - /bin/uname
    uname -m
    3⤵
    PID:659
- - /bin/grep
    grep i.86
    3⤵
    PID:661
- - /bin/grep
    grep 86pc
    3⤵
    PID:663
- - /bin/grep
    grep amd64
    3⤵
    PID:665
- - /bin/grep
    grep Power
    3⤵
    PID:667
- - /usr/bin/touch
    touch frontendstarted
    3⤵
    PID:668
- - /bin/chmod
    chmod +x bin/linux/x86_64/mojosetup
    3⤵
    PID:669
- - /tmp/selfgz581/bin/linux/x86_64/mojosetup
    /tmp/selfgz581/bin/linux/x86_64/mojosetup
    3⤵
    - Writes file to shm directory
    - Writes file to tmp directory
    PID:682
- /bin/rm
  /bin/rm -rf /tmp/selfgz581
  2⤵
  - Writes file to tmp directory
  PID:683

/usr/bin/dirname
dirname /tmp/gog_undertale_2.0.0.1.sh
1⤵
PID:583

/usr/bin/which
which md5sum
1⤵
- Write file to user bin folder
PID:588

/usr/bin/wc
wc -c
1⤵
PID:591

/usr/bin/head
head -n 519 /tmp/gog_undertale_2.0.0.1.sh
1⤵
- Writes file to tmp directory
PID:590

/usr/bin/tr
tr -d " "
1⤵
PID:592

/usr/bin/cut
cut "-d " -f1
1⤵
PID:595

/usr/bin/cut
cut "-d " -f1
1⤵
PID:599

/usr/bin/cut
cut -b-32
1⤵
PID:603

/usr/bin/expr
expr 575617 / 1024
1⤵
PID:604

/usr/bin/md5sum
/usr/bin/md5sum
1⤵
PID:605

/usr/bin/expr
expr 575617 "%" 1024
1⤵
PID:606

/bin/dd
dd "if=/tmp/gog_undertale_2.0.0.1.sh" "ibs=12450" "skip=1" "obs=1024" "conv=sync"
1⤵
PID:607

/bin/dd
dd "ibs=1024" "obs=1024" "count=562"
1⤵
PID:609

/bin/dd
dd "ibs=1" "obs=1024" "count=129"
1⤵
PID:610

/usr/bin/head
head -n 519 /tmp/gog_undertale_2.0.0.1.sh
1⤵
PID:614

/usr/bin/wc
wc -c
1⤵
PID:615

/usr/bin/tr
tr -d " "
1⤵
PID:616

/usr/bin/tail
tail -1
1⤵
PID:620

/bin/df
df -kP /tmp/selfgz581
1⤵
- Reads runtime system information
- Writes file to tmp directory
PID:619

/usr/bin/awk
awk "{ if (\$4 ~ /%/) {print \$3} else {print \$4} }"
1⤵
PID:621

/bin/gzip
gzip -cd
1⤵
PID:625

/bin/tar
tar xvf -
1⤵
- Reads runtime system information
PID:627

/usr/bin/expr
expr 4194304 / 4
1⤵
PID:626

/usr/bin/expr
expr 1048576 / 4
1⤵
PID:628

/usr/bin/expr
expr 575617 / 262144
1⤵
PID:629

/usr/bin/expr
expr 575617 "%" 262144
1⤵
PID:630

/bin/dd
dd "bs=12450" "count=0" "skip=1"
1⤵
PID:632

/usr/bin/expr
expr 0 + 262144
1⤵
PID:633

/bin/dd
dd "bs=262144" "count=1"
1⤵
PID:634

/usr/bin/expr
expr 575617 / 100
1⤵
PID:639

/usr/bin/expr
expr 262144 / 5756
1⤵
PID:640

/usr/bin/expr
expr 262144 + 262144
1⤵
PID:641

/bin/dd
dd "bs=262144" "count=1"
1⤵
PID:642

/usr/bin/expr
expr 575617 / 100
1⤵
PID:643

/usr/bin/expr
expr 524288 / 5756
1⤵
PID:644

/usr/bin/expr
expr 524288 + 262144
1⤵
PID:645

/bin/dd
dd "bs=51329" "count=1"
1⤵
PID:646

/usr/bin/id
id -u
1⤵
- Reads runtime system information
PID:648

/bin/chown
chown -R 0 .
1⤵
PID:649

/usr/bin/id
id -g
1⤵
- Reads runtime system information
PID:650

/usr/bin/tr
tr "[A-Z]" "[a-z]"
1⤵
PID:656

/bin/grep
grep fr_
1⤵
PID:673

/bin/grep
grep de_
1⤵
PID:676

/bin/grep
grep ru_
1⤵
PID:679

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hijack Execution Flow

T1574

Privilege Escalation

Hijack Execution Flow

T1574

Defense Evasion

Hijack Execution Flow

T1574

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

description	ioc	Process
/tmp/selfgz581/gtk-2.0/widgets/Others/null.png	/tmp/selfgz581/gtk-2.0/widgets/Others/null.png	rm
/tmp/selfgz581/gtk-2.0/widgets/Panel/handle-v.png	/tmp/selfgz581/gtk-2.0/widgets/Panel/handle-v.png	rm
/tmp/selfgz581/gtk-2.0/widgets/Panel/panel-button-active.png	/tmp/selfgz581/gtk-2.0/widgets/Panel/panel-button-active.png	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/breadcrumb_normal.png	/tmp/selfgz581/gtk-2.0/apps/Caja/breadcrumb_normal.png	rm
/tmp/selfgz581/gtk-2.0/apps/Null	/tmp/selfgz581/gtk-2.0/apps/Null	rm
/tmp/selfgz581/bin/linux/x86_64/guis/libmojosetupgui_gtkplus2.so	/tmp/selfgz581/bin/linux/x86_64/guis/libmojosetupgui_gtkplus2.so	rm
/tmp/selfgz581/startmojo.sh	/tmp/selfgz581/startmojo.sh	rm
/tmp/selfgz581/bin/linux	/tmp/selfgz581/bin/linux	rm
/tmp/gog_undertale_2.0.0.1.sh	/tmp/gog_undertale_2.0.0.1.sh	Process not Found
/tmp/selfgz581/gtk-2.0/widgets/Others	/tmp/selfgz581/gtk-2.0/widgets/Others	rm
/tmp/selfgz581/gtk-2.0/widgets/Null/null.png	/tmp/selfgz581/gtk-2.0/widgets/Null/null.png	rm
/tmp/selfgz581/gtk-2.0/widgets/panel.rc	/tmp/selfgz581/gtk-2.0/widgets/panel.rc	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/breadcrumb_active.png	/tmp/selfgz581/gtk-2.0/apps/Caja/breadcrumb_active.png	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/extra-widget.png	/tmp/selfgz581/gtk-2.0/apps/Caja/extra-widget.png	rm
/tmp/selfgz581/gtk-2.0	/tmp/selfgz581/gtk-2.0	rm
/tmp/selfgz581/gtk-2.0/widgets/Panel	/tmp/selfgz581/gtk-2.0/widgets/Panel	rm
/tmp/selfgz581/gtk-2.0/widgets/Panel/handle-h.png	/tmp/selfgz581/gtk-2.0/widgets/Panel/handle-h.png	rm
/tmp/selfgz581/gtk-2.0/apps	/tmp/selfgz581/gtk-2.0/apps	rm
/tmp/selfgz581/bin	/tmp/selfgz581/bin	rm
/tmp/selfgz581/frontendstarted	/tmp/selfgz581/frontendstarted	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/left_slider_normal.png	/tmp/selfgz581/gtk-2.0/apps/Caja/left_slider_normal.png	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/mode_prelight.png	/tmp/selfgz581/gtk-2.0/apps/Caja/mode_prelight.png	rm
/tmp/selfgz581/gtk-2.0/pixmaps/background.png	/tmp/selfgz581/gtk-2.0/pixmaps/background.png	rm
/tmp/selfgz581/bin/linux/x86/guis	/tmp/selfgz581/bin/linux/x86/guis	rm
/tmp/selfgz581/bin/linux/x86/guis/libmojosetupgui_ncurses.so	/tmp/selfgz581/bin/linux/x86/guis/libmojosetupgui_ncurses.so	rm
/tmp/selfgz581	/tmp/selfgz581	df
/tmp/gog_undertale_2.0.0.1.sh	/tmp/gog_undertale_2.0.0.1.sh	mojosetup
/tmp/selfgz581/bin/linux/x86_64	/tmp/selfgz581/bin/linux/x86_64	mojosetup
/tmp/mojosetup-plugin-LJx0GP	/tmp/mojosetup-plugin-LJx0GP	mojosetup
/tmp/selfgz581/gtk-2.0/apps/Caja/resize_grip.png	/tmp/selfgz581/gtk-2.0/apps/Caja/resize_grip.png	rm
/tmp/selfgz581/gtk-2.0/pixmaps	/tmp/selfgz581/gtk-2.0/pixmaps	rm
/tmp/selfgz581/gtk-2.0/widgets/Scale	/tmp/selfgz581/gtk-2.0/widgets/Scale	rm
/tmp/selfgz581/gtk-2.0/widgets/Panel/panel-bg.png	/tmp/selfgz581/gtk-2.0/widgets/Panel/panel-bg.png	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/right_slider_normal.png	/tmp/selfgz581/gtk-2.0/apps/Caja/right_slider_normal.png	rm
/tmp/selfgz581/bin/linux/x86_64/mojosetup	/tmp/selfgz581/bin/linux/x86_64/mojosetup	rm
/tmp/selfgz581/bin/linux/x86_64/guis	/tmp/selfgz581/bin/linux/x86_64/guis	rm
/tmp/selfgz581/gtk-2.0/gtkrc	/tmp/selfgz581/gtk-2.0/gtkrc	rm
/tmp/selfgz581/gtk-2.0/apps/stock_find.png	/tmp/selfgz581/gtk-2.0/apps/stock_find.png	rm
/tmp/selfgz581/gtk-2.0/apps/Handles/handle-caja.png	/tmp/selfgz581/gtk-2.0/apps/Handles/handle-caja.png	rm
/tmp/selfgz581/bin/linux/x86_64/guis/libmojosetupgui_ncurses.so	/tmp/selfgz581/bin/linux/x86_64/guis/libmojosetupgui_ncurses.so	mojosetup
/tmp/selfgz581/gtk-2.0/widgets/Scale/slider-ins.png	/tmp/selfgz581/gtk-2.0/widgets/Scale/slider-ins.png	rm
/tmp/selfgz581/gtk-2.0/apps/pcmanfm.rc	/tmp/selfgz581/gtk-2.0/apps/pcmanfm.rc	rm
/tmp/selfgz581/gtk-2.0/apps/Caja	/tmp/selfgz581/gtk-2.0/apps/Caja	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/breadcrumb_prelight.png	/tmp/selfgz581/gtk-2.0/apps/Caja/breadcrumb_prelight.png	rm
/tmp/selfgz581/bin/linux/x86_64	/tmp/selfgz581/bin/linux/x86_64	rm
/tmp/gog_undertale_2.0.0.1.sh	/tmp/gog_undertale_2.0.0.1.sh	head
/tmp/selfgz581/gtk-2.0/widgets/Scale/slider.png	/tmp/selfgz581/gtk-2.0/widgets/Scale/slider.png	rm
/tmp/selfgz581/gtk-2.0/apps/combo_down.png	/tmp/selfgz581/gtk-2.0/apps/combo_down.png	rm
/tmp/selfgz581/gtk-2.0/apps/Handles/resize_grip.png	/tmp/selfgz581/gtk-2.0/apps/Handles/resize_grip.png	rm
/tmp/selfgz581/bin/linux/x86/guis/libmojosetupgui_gtkplus2.so	/tmp/selfgz581/bin/linux/x86/guis/libmojosetupgui_gtkplus2.so	rm
/tmp/selfgz581/gtk-2.0/widgets/Panel/arrow-blank.png	/tmp/selfgz581/gtk-2.0/widgets/Panel/arrow-blank.png	rm
/tmp/selfgz581/gtk-2.0/widgets/Panel/panel-button-hover.png	/tmp/selfgz581/gtk-2.0/widgets/Panel/panel-button-hover.png	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/mode_pressed.png	/tmp/selfgz581/gtk-2.0/apps/Caja/mode_pressed.png	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/nautilus-toolbar.png	/tmp/selfgz581/gtk-2.0/apps/Caja/nautilus-toolbar.png	rm
/tmp/selfgz581/gtk-2.0/apps/pluma.rc	/tmp/selfgz581/gtk-2.0/apps/pluma.rc	rm
/tmp/selfgz581/bin/linux/x86_64/guis/libmojosetupgui_ncurses.so	/tmp/selfgz581/bin/linux/x86_64/guis/libmojosetupgui_ncurses.so	rm
/tmp/selfgz581/gtk-2.0/widgets/Others/close.png	/tmp/selfgz581/gtk-2.0/widgets/Others/close.png	rm
/tmp/selfgz581/gtk-2.0/widgets/Panel/arrow-down.png	/tmp/selfgz581/gtk-2.0/widgets/Panel/arrow-down.png	rm
/tmp/selfgz581/gtk-2.0/apps/stock_home.png	/tmp/selfgz581/gtk-2.0/apps/stock_home.png	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/trough.png	/tmp/selfgz581/gtk-2.0/apps/Caja/trough.png	rm
/tmp/selfgz581/gtk-2.0/apps/Caja/slider-prelight.png	/tmp/selfgz581/gtk-2.0/apps/Caja/slider-prelight.png	rm
/tmp/gog_undertale_2.0.0.1.sh	/tmp/gog_undertale_2.0.0.1.sh	gog_undertale_2.0.0.1.sh
/tmp/selfgz581/gtk-2.0/widgets/Null	/tmp/selfgz581/gtk-2.0/widgets/Null	rm
/tmp/selfgz581/gtk-2.0/widgets/Panel/panel-button-inactive.png	/tmp/selfgz581/gtk-2.0/widgets/Panel/panel-button-inactive.png	rm

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads