Analysis

  • max time kernel
    4s
  • max time network
    1180s
  • platform
    linux_amd64
  • resource
    ubuntu1804-amd64-en-20211208
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-en-20211208kernel:4.15.0-161-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    01-07-2023 15:36

General

  • Target

    controlloid-server-master/dist/linux/start.sh

  • Size

    414B

  • MD5

    9b9aa7636bdb1df9e7da45fe72a29c71

  • SHA1

    b4f9643ed86ba2821b57d468467afa38d2bbf40b

  • SHA256

    62d7f98315d09ca7fd0e3b2bc34c831bd5fac624988485674a005f9ebc81d375

  • SHA512

    60673902da5b2bc899934aa72ec4c4e044cfb86a6119287cc0d05a98fbf43e75b2edbfa62bebe5d378a487b455bfd408769555f9995cb664cf4a4f06d34bcb9c

Score
3/10

Malware Config

Signatures

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/controlloid-server-master/dist/linux/start.sh
    /tmp/controlloid-server-master/dist/linux/start.sh
    1⤵
      PID:575
    • /usr/local/sbin/bash
      bash /tmp/controlloid-server-master/dist/linux/start.sh
      1⤵
        PID:575
      • /usr/local/bin/bash
        bash /tmp/controlloid-server-master/dist/linux/start.sh
        1⤵
          PID:575
        • /usr/sbin/bash
          bash /tmp/controlloid-server-master/dist/linux/start.sh
          1⤵
            PID:575
          • /usr/bin/bash
            bash /tmp/controlloid-server-master/dist/linux/start.sh
            1⤵
              PID:575
            • /sbin/bash
              bash /tmp/controlloid-server-master/dist/linux/start.sh
              1⤵
                PID:575
              • /bin/bash
                bash /tmp/controlloid-server-master/dist/linux/start.sh
                1⤵
                  PID:575
                  • /usr/bin/dirname
                    dirname /tmp/controlloid-server-master/dist/linux/start.sh
                    2⤵
                      PID:576
                    • /sbin/ip
                      ip -4 -o addr show scope global
                      2⤵
                        PID:579
                      • /usr/bin/awk
                        awk "{gsub(/\\/.*/,\"\",\$4); print \$2, \"http://\"\$4\":31415/\"}"
                        2⤵
                          PID:580
                        • /usr/bin/sort
                          sort
                          2⤵
                            PID:581
                          • /bin/sed
                            sed "s/\\(http.\\+\\)/\\1/"
                            2⤵
                            • Reads runtime system information
                            PID:582
                          • /tmp/controlloid-server-master/dist/linux/websocketd/websocketd
                            ./websocketd/websocketd --binary --port 31415 "--staticdir=." ./bin/ws_handler
                            2⤵
                              PID:583

                          Network

                          MITRE ATT&CK Matrix

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads