ff3bda813b7b60df1be10565cdb422224bb7bf05fc1872c9fbb233200ba25b75

Analysis

max time kernel
122s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20231222-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20231222-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22/12/2023, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.gosh/ps
Size

978B
MD5

0fb40555729b18c160840970b64efbd1
SHA1

fe0285a16a0af7e6e2b0517fedf33759a35f9815
SHA256

8cde776130ccffaa1e3147cec59c8b44e00634613395926ecb7c98d9cc21f983
SHA512

6c26ca3e36ada5884c383166b8b193bb6512456fe0c4447b7ebd2eb5829837f390500fa3a03555cb77a51cd0e721098699f4fb8fc938776c674616a0db9a4e17

Score

6^/10

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 4 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/523/stat	ps
File opened for reading	/proc/870/status	ps
File opened for reading	/proc/1643/cmdline	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/19/status	ps
File opened for reading	/proc/503/stat	ps
File opened for reading	/proc/403/status	ps
File opened for reading	/proc/1146/status	ps
File opened for reading	/proc/78/status	ps
File opened for reading	/proc/89/cmdline	ps
File opened for reading	/proc/1594/stat	ps
File opened for reading	/proc/400/cmdline	ps
File opened for reading	/proc/1029/cmdline	ps
File opened for reading	/proc/1146/stat	ps
File opened for reading	/proc/1592/stat	ps
File opened for reading	/proc/89/stat	ps
File opened for reading	/proc/1644/cmdline	ps
File opened for reading	/proc/580/stat	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/327/status	ps
File opened for reading	/proc/1374/cmdline	ps
File opened for reading	/proc/1015/status	ps
File opened for reading	/proc/1305/cmdline	ps
File opened for reading	/proc/1316/cmdline	ps
File opened for reading	/proc/1357/stat	ps
File opened for reading	/proc/523/cmdline	ps
File opened for reading	/proc/453/stat	ps
File opened for reading	/proc/uptime	ps
File opened for reading	/proc/162/status	ps
File opened for reading	/proc/711/status	ps
File opened for reading	/proc/31/stat	ps
File opened for reading	/proc/89/stat	ps
File opened for reading	/proc/1230/status	ps
File opened for reading	/proc/443/stat	ps
File opened for reading	/proc/1055/cmdline	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/79/stat	ps
File opened for reading	/proc/80/stat	ps
File opened for reading	/proc/85/status	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/517/cmdline	ps
File opened for reading	/proc/698/status	ps
File opened for reading	/proc/1035/stat	ps
File opened for reading	/proc/1029/stat	ps
File opened for reading	/proc/1615/stat	ps
File opened for reading	/proc/558/cmdline	ps
File opened for reading	/proc/422/status	ps
File opened for reading	/proc/503/cmdline	ps
File opened for reading	/proc/723/cmdline	ps
File opened for reading	/proc/249/stat	ps
File opened for reading	/proc/163/cmdline	ps
File opened for reading	/proc/1171/status	ps
File opened for reading	/proc/1179/status	ps
File opened for reading	/proc/152/stat	ps
File opened for reading	/proc/450/stat	ps
File opened for reading	/proc/163/cmdline	ps
File opened for reading	/proc/165/status	ps
File opened for reading	/proc/27/stat	ps
File opened for reading	/proc/1015/cmdline	ps
File opened for reading	/proc/1131/stat	ps
File opened for reading	/proc/1055/stat	ps
File opened for reading	/proc/1165/cmdline	ps
File opened for reading	/proc/81/stat	ps
File opened for reading	/proc/1637/cmdline	ps

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/.gosh/mfu.txt
File opened for modification	/tmp/.gosh/eth
File opened for modification	/tmp/.gosh/xxx.txt

/tmp/.gosh/ps
/tmp/.gosh/ps
1⤵
PID:1594
- /usr/bin/awk
  awk "{ for (i=1;i<=NF;i++) print \$i }"
  2⤵
  PID:1601
- /bin/grep
  grep default
  2⤵
  PID:1600
- /sbin/ip
  ip route show
  2⤵
  PID:1599
- /bin/rm
  rm -rf eth
  2⤵
  PID:1602
- /bin/grep
  grep -v ____
  2⤵
  PID:1605
- /bin/grep
  grep -v DUP
  2⤵
  PID:1604
- /bin/cat
  cat vuln.txt
  2⤵
  PID:1603
- /bin/rm
  rm -rf vul1n.txt xxx1.txt bios.txt mfu.txt
  2⤵
  PID:1606
- /tmp/.gosh/pscan2
  ././pscan2 22
  2⤵
  PID:1607
- /usr/bin/sort
  sort
  2⤵
  PID:1609
- /bin/cat
  cat bios.txt
  2⤵
  PID:1608
- /usr/bin/uniq
  uniq
  2⤵
  PID:1610
- /tmp/.gosh/prg
  ./prg 400
  2⤵
  PID:1611
- /bin/rm
  rm -rf bios.txt
  2⤵
  PID:1612
- /bin/sleep
  sleep 30
  2⤵
  PID:1613
- /bin/sleep
  sleep 30
  2⤵
  PID:1640
- /bin/grep
  grep -v ____
  2⤵
  PID:1647
- /bin/grep
  grep -v DUP
  2⤵
  PID:1646
- /bin/cat
  cat vuln.txt
  2⤵
  PID:1645
- /bin/rm
  rm -rf vul1n.txt xxx1.txt bios.txt mfu.txt
  2⤵
  PID:1648
- /tmp/.gosh/pscan2
  ././pscan2 22
  2⤵
  PID:1649
- /usr/bin/uniq
  uniq
  2⤵
  PID:1652
- /usr/bin/sort
  sort
  2⤵
  PID:1651
- /bin/cat
  cat bios.txt
  2⤵
  PID:1650
- /tmp/.gosh/prg
  ./prg 400
  2⤵
  PID:1653
- /bin/rm
  rm -rf bios.txt
  2⤵
  PID:1654
- /bin/sleep
  sleep 30
  2⤵
  PID:1655
- /bin/sleep
  sleep 30
  2⤵
  PID:1660
- /bin/grep
  grep -v DUP
  2⤵
  PID:1666
- /bin/cat
  cat vuln.txt
  2⤵
  PID:1665
- /bin/grep
  grep -v ____
  2⤵
  PID:1667
- /bin/rm
  rm -rf vul1n.txt xxx1.txt bios.txt mfu.txt
  2⤵
  PID:1668
- /tmp/.gosh/pscan2
  ././pscan2 22
  2⤵
  PID:1669
- /usr/bin/uniq
  uniq
  2⤵
  PID:1672
- /usr/bin/sort
  sort
  2⤵
  PID:1671
- /bin/cat
  cat bios.txt
  2⤵
  PID:1670
- /tmp/.gosh/prg
  ./prg 400
  2⤵
  PID:1673
- /bin/rm
  rm -rf bios.txt
  2⤵
  PID:1674
- /bin/sleep
  sleep 30
  2⤵
  PID:1675

/sbin/ip
ip route show
1⤵
PID:1596

/bin/grep
grep -v grep
1⤵
PID:1597

/bin/grep
grep -c default
1⤵
PID:1598

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1637

/bin/grep
grep -v grep
1⤵
PID:1638

/bin/grep
grep -c "./prg 400"
1⤵
PID:1639

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1642

/bin/grep
grep -v grep
1⤵
PID:1643

/bin/grep
grep -c "./prg 700"
1⤵
PID:1644

/bin/grep
grep -v grep
1⤵
PID:1658

/bin/grep
grep -c "./prg 400"
1⤵
PID:1659

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1657

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:1662

/bin/grep
grep -v grep
1⤵
PID:1663

/bin/grep
grep -c "./prg 700"
1⤵
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.gosh/eth

Filesize
56B

MD5
9dd8d4524e3431f117056101b75ee137

SHA1
a471b496de121e40af797b0ecd7e9ecc73dc10e1

SHA256
987cbd09830379f7e6df90dde7dea0aaa6e673ac75aae2839d2ba203c20d4998

SHA512
c61c25198aa7d7d32ab984ff187b07814001efe23901f54f482f9f4c70b9c6fdd3740bdcac33d101cf3ee7f3a57c72f023b45bbf766ce6ae65d0f0febf5e62fa

Download Submit