ff3bda813b7b60df1be10565cdb422224bb7bf05fc1872c9fbb233200ba25b75

Analysis

max time kernel
128s
platform
debian-9_mipsel
resource
debian9-mipsel-20231215-en
resource tags

arch:mipselimage:debian9-mipsel-20231215-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem
submitted
22/12/2023, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.gosh/ps
Size

978B
MD5

0fb40555729b18c160840970b64efbd1
SHA1

fe0285a16a0af7e6e2b0517fedf33759a35f9815
SHA256

8cde776130ccffaa1e3147cec59c8b44e00634613395926ecb7c98d9cc21f983
SHA512

6c26ca3e36ada5884c383166b8b193bb6512456fe0c4447b7ebd2eb5829837f390500fa3a03555cb77a51cd0e721098699f4fb8fc938776c674616a0db9a4e17

Score

6^/10

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 4 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/22/status	ps
File opened for reading	/proc/397/stat	ps
File opened for reading	/proc/13/cmdline	ps
File opened for reading	/proc/19/cmdline	ps
File opened for reading	/proc/698/cmdline	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/tty/drivers	ps
File opened for reading	/proc/9/status	ps
File opened for reading	/proc/329/stat	ps
File opened for reading	/proc/492/cmdline	ps
File opened for reading	/proc/701/stat	ps
File opened for reading	/proc/492/stat	ps
File opened for reading	/proc/75/cmdline	ps
File opened for reading	/proc/filesystems	ps
File opened for reading	/proc/12/stat	ps
File opened for reading	/proc/76/status	ps
File opened for reading	/proc/831/status	ps
File opened for reading	/proc/4/stat	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/372/cmdline	ps
File opened for reading	/proc/16/stat	ps
File opened for reading	/proc/233/stat	ps
File opened for reading	/proc/328/stat	ps
File opened for reading	/proc/372/stat	ps
File opened for reading	/proc/728/cmdline	ps
File opened for reading	/proc/7/stat	ps
File opened for reading	/proc/148/stat	ps
File opened for reading	/proc/4/status	ps
File opened for reading	/proc/329/stat	ps
File opened for reading	/proc/4/cmdline	ps
File opened for reading	/proc/82/status	ps
File opened for reading	/proc/373/status	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/13/stat	ps
File opened for reading	/proc/22/stat	ps
File opened for reading	/proc/9/cmdline	ps
File opened for reading	/proc/11/stat	ps
File opened for reading	/proc/5/stat	ps
File opened for reading	/proc/15/status	ps
File opened for reading	/proc/104/stat	ps
File opened for reading	/proc/11/cmdline	ps
File opened for reading	/proc/72/status	ps
File opened for reading	/proc/716/cmdline	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/15/cmdline	ps
File opened for reading	/proc/680/cmdline	ps
File opened for reading	/proc/74/stat	ps
File opened for reading	/proc/12/cmdline	ps
File opened for reading	/proc/10/stat	ps
File opened for reading	/proc/2/status	ps
File opened for reading	/proc/21/stat	ps
File opened for reading	/proc/115/stat	ps
File opened for reading	/proc/8/stat	ps
File opened for reading	/proc/372/status	ps
File opened for reading	/proc/80/stat	ps
File opened for reading	/proc/505/cmdline	ps
File opened for reading	/proc/372/stat	ps
File opened for reading	/proc/36/status	ps
File opened for reading	/proc/382/status	ps
File opened for reading	/proc/14/status	ps
File opened for reading	/proc/37/stat	ps
File opened for reading	/proc/21/status	ps
File opened for reading	/proc/tty/drivers	ps

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc
File opened for modification	/tmp/.gosh/eth
File opened for modification	/tmp/.gosh/xxx.txt
File opened for modification	/tmp/.gosh/mfu.txt

/tmp/.gosh/ps
/tmp/.gosh/ps
1⤵
PID:716
- /sbin/ip
  ip route show
  2⤵
  PID:731
- /bin/grep
  grep default
  2⤵
  PID:732
- /usr/bin/awk
  awk "{ for (i=1;i<=NF;i++) print \$i }"
  2⤵
  PID:733
- /bin/rm
  rm -rf eth
  2⤵
  PID:735
- /bin/cat
  cat vuln.txt
  2⤵
  PID:736
- /bin/grep
  grep -v DUP
  2⤵
  PID:737
- /bin/grep
  grep -v ____
  2⤵
  PID:738
- /bin/rm
  rm -rf vul1n.txt xxx1.txt bios.txt mfu.txt
  2⤵
  PID:739
- /tmp/.gosh/pscan2
  ././pscan2 22
  2⤵
  PID:740
- /usr/bin/sort
  sort
  2⤵
  PID:742
- /bin/cat
  cat bios.txt
  2⤵
  PID:741
- /usr/bin/uniq
  uniq
  2⤵
  PID:743
- /tmp/.gosh/prg
  ./prg 400
  2⤵
  PID:744
- /bin/rm
  rm -rf bios.txt
  2⤵
  PID:745
- /bin/sleep
  sleep 30
  2⤵
  PID:747
- /bin/sleep
  sleep 30
  2⤵
  PID:830
- /bin/grep
  grep -v DUP
  2⤵
  PID:836
- /bin/cat
  cat vuln.txt
  2⤵
  PID:835
- /bin/grep
  grep -v ____
  2⤵
  PID:837
- /bin/rm
  rm -rf vul1n.txt xxx1.txt bios.txt mfu.txt
  2⤵
  PID:838
- /tmp/.gosh/pscan2
  ././pscan2 22
  2⤵
  PID:839
- /usr/bin/sort
  sort
  2⤵
  PID:841
- /usr/bin/uniq
  uniq
  2⤵
  PID:842
- /bin/cat
  cat bios.txt
  2⤵
  PID:840
- /tmp/.gosh/prg
  ./prg 400
  2⤵
  PID:843
- /bin/rm
  rm -rf bios.txt
  2⤵
  PID:844
- /bin/sleep
  sleep 30
  2⤵
  PID:845
- /bin/sleep
  sleep 30
  2⤵
  PID:850
- /bin/grep
  grep -v DUP
  2⤵
  PID:856
- /bin/grep
  grep -v ____
  2⤵
  PID:857
- /bin/cat
  cat vuln.txt
  2⤵
  PID:855
- /bin/rm
  rm -rf vul1n.txt xxx1.txt bios.txt mfu.txt
  2⤵
  PID:858
- /tmp/.gosh/pscan2
  ././pscan2 22
  2⤵
  PID:859
- /usr/bin/sort
  sort
  2⤵
  PID:861
- /usr/bin/uniq
  uniq
  2⤵
  PID:862
- /bin/cat
  cat bios.txt
  2⤵
  PID:860
- /tmp/.gosh/prg
  ./prg 400
  2⤵
  PID:863
- /bin/rm
  rm -rf bios.txt
  2⤵
  PID:864
- /bin/sleep
  sleep 30
  2⤵
  PID:865

/sbin/ip
ip route show
1⤵
PID:725

/bin/grep
grep -c default
1⤵
PID:727

/bin/grep
grep -v grep
1⤵
PID:726

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:827

/bin/grep
grep -v grep
1⤵
PID:828

/bin/grep
grep -c "./prg 400"
1⤵
PID:829

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:832

/bin/grep
grep -v grep
1⤵
PID:833

/bin/grep
grep -c "./prg 700"
1⤵
PID:834

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:847

/bin/grep
grep -c "./prg 400"
1⤵
PID:849

/bin/grep
grep -v grep
1⤵
PID:848

/bin/ps
ps ax
1⤵
- Reads CPU attributes
- Reads runtime system information
PID:852

/bin/grep
grep -v grep
1⤵
PID:853

/bin/grep
grep -c "./prg 700"
1⤵
PID:854

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/.gosh/eth

Filesize
35B

MD5
a0ff04a831025c7f39dffc02dd159c1d

SHA1
27dd20c510e1c0d50002160d596e3b47df9c3f17

SHA256
5f33a647ab5a2b8db1fd540fd6dcee8087852fecdc09f3ed44ca6b10afd65e08

SHA512
2112634c0b524c815a5ef55c1ff756272577d0e657f3fc9610ce9fd573d4d5096dd4bb6f46ddc8ed7c56b21d27da277a3beda6cfc37db1d1f00945440aa10345

Download Submit