ff3bda813b7b60df1be10565cdb422224bb7bf05fc1872c9fbb233200ba25b75

Analysis

max time kernel
124s
platform
debian-9_armhf
resource
debian9-armhf-20231222-en
resource tags

arch:armhfimage:debian9-armhf-20231222-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
22/12/2023, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.gosh/ps
Size

978B
MD5

0fb40555729b18c160840970b64efbd1
SHA1

fe0285a16a0af7e6e2b0517fedf33759a35f9815
SHA256

8cde776130ccffaa1e3147cec59c8b44e00634613395926ecb7c98d9cc21f983
SHA512

6c26ca3e36ada5884c383166b8b193bb6512456fe0c4447b7ebd2eb5829837f390500fa3a03555cb77a51cd0e721098699f4fb8fc938776c674616a0db9a4e17

Score

6^/10

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 4 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/314/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/222/stat	ps
File opened for reading	/proc/782/stat	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/275/cmdline	ps
File opened for reading	/proc/750/stat	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/783/stat	ps
File opened for reading	/proc/meminfo	ps
File opened for reading	/proc/281/status	ps
File opened for reading	/proc/748/stat	ps
File opened for reading	/proc/109/status	ps
File opened for reading	/proc/29/status	ps
File opened for reading	/proc/272/cmdline	ps
File opened for reading	/proc/280/status	ps
File opened for reading	/proc/308/stat	ps
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/280/cmdline	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/23/status	ps
File opened for reading	/proc/28/status	ps
File opened for reading	/proc/794/status	ps
File opened for reading	/proc/18/cmdline	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/137/status	ps
File opened for reading	/proc/782/status	ps
File opened for reading	/proc/658/stat	ps
File opened for reading	/proc/106/status	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/576/stat	ps
File opened for reading	/proc/272/stat	ps
File opened for reading	/proc/661/stat	ps
File opened for reading	/proc/14/stat	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/759/status	ps
File opened for reading	/proc/25/stat	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/28/stat	ps
File opened for reading	/proc/43/cmdline	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/790/cmdline	ps
File opened for reading	/proc/41/status	ps
File opened for reading	/proc/272/cmdline	ps
File opened for reading	/proc/16/cmdline	ps
File opened for reading	/proc/17/cmdline	ps
File opened for reading	/proc/272/stat	ps
File opened for reading	/proc/162/stat	ps
File opened for reading	/proc/1/cmdline	ps
File opened for reading	/proc/21/cmdline	ps
File opened for reading	/proc/658/cmdline	ps
File opened for reading	/proc/76/status	ps
File opened for reading	/proc/662/status	ps
File opened for reading	/proc/292/status	ps
File opened for reading	/proc/15/stat	ps
File opened for reading	/proc/20/status	ps
File opened for reading	/proc/21/status	ps

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/.gosh/eth
File opened for modification	/tmp/.gosh/xxx.txt
File opened for modification	/tmp/.gosh/mfu.txt

/tmp/.gosh/ps
/tmp/.gosh/ps
1⤵
PID:684
- /sbin/ip
  ip route show
  2⤵
  PID:694
- /bin/grep
  grep default
  2⤵
  PID:695
- /usr/bin/awk
  awk "{ for (i=1;i<=NF;i++) print \$i }"
  2⤵
  PID:696
- /bin/rm
  rm -rf eth
  2⤵
  PID:698
- /bin/cat
  cat vuln.txt
  2⤵
  PID:699
- /bin/grep
  grep -v DUP
  2⤵
  PID:700
- /bin/grep
  grep -v ____
  2⤵
  PID:701
- /bin/rm
  rm -rf vul1n.txt xxx1.txt bios.txt mfu.txt
  2⤵
  PID:702
- /tmp/.gosh/pscan2
  ././pscan2 22
  2⤵
  PID:704
- /bin/cat
  cat bios.txt
  2⤵
  PID:705
- /usr/bin/sort
  sort
  2⤵
  PID:706
- /usr/bin/uniq
  uniq
  2⤵
  PID:707
- /tmp/.gosh/prg
  ./prg 400
  2⤵
  PID:708
- /bin/rm
  rm -rf bios.txt
  2⤵
  PID:709
- /bin/sleep
  sleep 30
  2⤵
  PID:710
- /bin/sleep
  sleep 30
  2⤵
  PID:752
- /bin/cat
  cat vuln.txt
  2⤵
  PID:763
- /bin/grep
  grep -v DUP
  2⤵
  PID:764
- /bin/grep
  grep -v ____
  2⤵
  PID:765
- /bin/rm
  rm -rf vul1n.txt xxx1.txt bios.txt mfu.txt
  2⤵
  PID:766
- /tmp/.gosh/pscan2
  ././pscan2 22
  2⤵
  PID:767
- /bin/cat
  cat bios.txt
  2⤵
  PID:768
- /usr/bin/sort
  sort
  2⤵
  PID:769
- /usr/bin/uniq
  uniq
  2⤵
  PID:770
- /tmp/.gosh/prg
  ./prg 400
  2⤵
  PID:771
- /bin/rm
  rm -rf bios.txt
  2⤵
  PID:772
- /bin/sleep
  sleep 30
  2⤵
  PID:773
- /bin/sleep
  sleep 30
  2⤵
  PID:784
- /bin/cat
  cat vuln.txt
  2⤵
  PID:795
- /bin/grep
  grep -v DUP
  2⤵
  PID:796
- /bin/grep
  grep -v ____
  2⤵
  PID:797
- /bin/rm
  rm -rf vul1n.txt xxx1.txt bios.txt mfu.txt
  2⤵
  PID:798
- /tmp/.gosh/pscan2
  ././pscan2 22
  2⤵
  PID:799
- /bin/cat
  cat bios.txt
  2⤵
  PID:800
- /usr/bin/sort
  sort
  2⤵
  PID:801
- /usr/bin/uniq
  uniq
  2⤵
  PID:802
- /tmp/.gosh/prg
  ./prg 400
  2⤵
  PID:803
- /bin/rm
  rm -rf bios.txt
  2⤵
  PID:804
- /bin/sleep
  sleep 30
  2⤵
  PID:805

/sbin/ip
ip route show
1⤵
PID:688

/bin/grep
grep -v grep
1⤵
PID:689

/bin/grep
grep -c default
1⤵
PID:690

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:749

/bin/grep
grep -v grep
1⤵
PID:750

/bin/grep
grep -c "./prg 400"
1⤵
PID:751

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:760

/bin/grep
grep -c "./prg 700"
1⤵
PID:762

/bin/grep
grep -v grep
1⤵
PID:761

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:781

/bin/grep
grep -c "./prg 400"
1⤵
PID:783

/bin/grep
grep -v grep
1⤵
PID:782

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:792

/bin/grep
grep -v grep
1⤵
PID:793

/bin/grep
grep -c "./prg 700"
1⤵
PID:794

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.gosh/eth

Filesize
32B

MD5
9fd3d018a46051e3707e92b2406d6a50

SHA1
2b3512a69d0655bfd755ea1938f5ee03bfc32abb

SHA256
f4c1e7ec20135a122df54d19f809e687ad27665b8cf30502144ff758bb70cdca

SHA512
b78a2b933522485ff915ad2429235bccf265c56c375ecf0a661c53aba54a0194300529d03667c8f0fc85a60996e9bfa7ca6b852d737aa3b0613f1bdec1a96227

Download Submit