Analysis
-
max time kernel
5s -
max time network
1677s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
-
submitted
25-02-2024 14:29
General
-
Target
script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh
-
Size
3KB
-
MD5
d0d36f169f1458806053aae482af5010
-
SHA1
e603944aceb5c0885a8627de12f36b159bbf2f05
-
SHA256
10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459
-
SHA512
982abe39731d8cc852c25650740ff73975c10d19027eccf610401260e2f508334f1de656f8dd332fa698dccc9f7d3bda610c8b9e84d276036a6e9408d826229a
Score
7/10
Malware Config
Signatures
-
Deletes Audit logs 1 TTPs 1 IoCs
Deletes logs related to the Linux Audit framework.
-
Deletes log files 1 TTPs 11 IoCs
Deletes log files on the system.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads CPU attributes 1 TTPs 17 IoCs
-
Reads hardware information 1 TTPs 1 IoCs
Accesses system info like serial numbers, manufacturer names etc.
-
Reads network interface configuration 2 TTPs 12 IoCs
Fetches information about one or more active network interfaces.
-
Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
-
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes
-
/tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh/tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh1⤵
-
/usr/bin/chmodchmod +x /tmp//encrypt2⤵
-
-
/usr/bin/findfind /usr/lib/vmware -type f -name index.html2⤵
-
-
/usr/bin/mvmv /etc/motd /etc/motd12⤵
-
-
/bin/find/bin/find / -name "*.log" -exec /bin/rm -rf "{}" ";"2⤵
- Reads CPU attributes
- Reads hardware information
- Reads network interface configuration
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
/bin/rm/bin/rm -rf /var/lib/gdm3/.local/share/gvfs-metadata/root-17e68493.log3⤵
-
-
/bin/rm/bin/rm -rf /var/log/auth.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /var/log/kern.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /var/log/fontconfig.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /var/log/gpu-manager.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /var/log/audit/audit.log3⤵
- Deletes Audit logs
-
-
/bin/rm/bin/rm -rf /var/log/dpkg.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /var/log/ubuntu-advantage.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /var/log/apt/history.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /var/log/apt/term.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /var/log/unattended-upgrades/unattended-upgrades-shutdown.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /var/log/alternatives.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /var/log/Xorg.0.log3⤵
- Deletes log files
-
-
/bin/rm/bin/rm -rf /root/.local/share/gvfs-metadata/home-d4da85ea.log3⤵
-
-
/bin/rm/bin/rm -rf /root/.local/share/gvfs-metadata/trash:-e5043e0b.log3⤵
-
-
/bin/rm/bin/rm -rf /root/.local/share/gvfs-metadata/root-7ac72d14.log3⤵
-
-
/bin/rm/bin/rm -rf /run/initramfs/fsck.log3⤵
-
-
-
/bin/rm/bin/rm -f /store/packages/vmtools.py2⤵
-
-
/bin/touch/bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/vmware/rhttpproxy/endpoints.conf2⤵
-
-
/bin/touch/bin/touch -r /etc/vmware/rhttpproxy/config.xml /bin/hostd-probe.sh2⤵
-
-
/bin/touch/bin/touch -r /etc/vmware/rhttpproxy/config.xml /etc/rc.local.d/local.sh2⤵
-
-
/bin/rm/bin/rm -f /tmp/encrypt /tmp/nohup.out /tmp/index.html /tmp/motd /tmp/public.pem /tmp/archieve.zip2⤵
-
-
/bin/sh/bin/sh /bin/auto-backup.sh2⤵
-
-
/bin/rm/bin/rm -- /tmp/script_malware/10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459.sh2⤵
-
-
/etc/init.d/SSH/etc/init.d/SSH start2⤵
-
-
/usr/bin/grepgrep "Config File"1⤵
-
/usr/bin/awkawk "{print \$3}"1⤵
-
/usr/bin/awkawk "{print \$2}"1⤵
-
/usr/bin/grepgrep vmx1⤵
-
/usr/bin/psps1⤵
- Reads CPU attributes
- Reads runtime system information
-
/usr/bin/awkawk "-F " "{print \$2}"1⤵
-
/usr/bin/grepgrep /vmfs/volumes/1⤵
-
/bin/wc/bin/wc -l1⤵
-
/bin/grep/bin/grep -v grep1⤵
-
/bin/grep/bin/grep encrypt1⤵
-
/bin/ps/bin/ps1⤵
- Reads CPU attributes
- Reads runtime system information
-
/bin/wc/bin/wc -l1⤵
-
/bin/grep/bin/grep " 7."1⤵
-
/bin/vmware/bin/vmware -l1⤵