2e5417762343d2d13a7da7f4fac684947ea0d3720d6d6c252e60541db1c37a27 | Triage

Analysis

max time kernel
153s
max time network
159s
platform
debian-9_mips
resource
debian9-mipsbe-20231215-en
resource tags

arch:mipsimage:debian9-mipsbe-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem
submitted
22/12/2023, 02:52

Sharing

Report Analysis Logs

General

Target

gosh/a
Size

276B
MD5

ed0623474bb93d1f820b04d8582c24e6
SHA1

55d2d7da87c67f98004573bca4bb000f9b3e7436
SHA256

836366ac82a737ab916efe9a27ae428b157535f535ac2917fd7afc948aa54df5
SHA512

c894872ec37aa1ae444ce6401f3fe9f66596674eacf1fd5bfcc69b6cbc4e74738d532be95e2952b6bdd71e243e876ad8c60f0e469af0045deb932002f6eb23ce

Score

7^/10

Malware Config

Signatures

Changes its process name 4 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/usr/sbin/httpd	730	perl
Changes the process name, possibly in an attempt to hide itself	/usr/sbin/httpd	733	perl
Changes the process name, possibly in an attempt to hide itself	/usr/sbin/sshd	735	perl
Changes the process name, possibly in an attempt to hide itself	/usr/sbin/sshd	737	perl

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/gosh/mfu.txt

/tmp/gosh/a
/tmp/gosh/a
1⤵
PID:717
- /usr/bin/clear
  clear
  2⤵
  PID:729
- /usr/bin/perl
  perl screen
  2⤵
  - Changes its process name
  PID:730
- /usr/bin/perl
  perl screen
  2⤵
  - Changes its process name
  PID:733
- /usr/bin/perl
  perl screen
  2⤵
  - Changes its process name
  PID:735
- /usr/bin/perl
  perl screen
  2⤵
  - Changes its process name
  PID:737
- /bin/rm
  rm -rf .pscan.22
  2⤵
  PID:739
- /tmp/gosh/pscan2
  ./pscan2 22
  2⤵
  PID:740
- /bin/sleep
  sleep 5
  2⤵
  PID:741
- /bin/cat
  cat .pscan.22
  2⤵
  PID:789
- /usr/bin/sort
  sort
  2⤵
  PID:790
- /usr/bin/uniq
  uniq
  2⤵
  PID:791
- /bin/grep
  grep -c . mfu.txt
  2⤵
  PID:793
- /bin/sleep
  sleep 5
  2⤵
  PID:794
- /tmp/gosh/hpiod
  ./hpiod 75
  2⤵
  PID:795

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads