Analysis

  • max time kernel
    0s
  • max time network
    128s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240226-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240226-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    07/05/2024, 01:02

General

  • Target

    gather.sh

  • Size

    20KB

  • MD5

    393327be1a6e7077833b5f2e3cd0a942

  • SHA1

    9b2ded8ff4138f7a6ac2c97998dcf892cbf4dd71

  • SHA256

    52606b0a9624eb1dcd834eb3b926d0250bf2b514377d480f0e9b9c0fdcb708c5

  • SHA512

    239c50c9a204343a342c58d7171148149b9055415ad86d540b43014a9e8abc7a8189d9345d1aa4f7e41226df3cfbcdd480173e759adceeb7cf8679e737929ceb

  • SSDEEP

    192:WrH5cIvpT2iT4HDvJQDvT/gkd8SElga9xMXK5i3Yz3JnD9F+zXMPk:Wf+HDvqokd8SEluK5iYdM

Score
3/10

Malware Config

Signatures

  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/gather.sh
    /tmp/gather.sh
    1⤵
      PID:1547
      • /bin/mkdir
        mkdir -p /tmp/report
        2⤵
        • Reads runtime system information
        PID:1548
      • /bin/cat
        cat /proc/version
        2⤵
        • Reads runtime system information
        PID:1549
      • /bin/sed
        sed "s/metric.*\$//g"
        2⤵
          PID:1554
        • /bin/sed
          sed "s/^.*src //g"
          2⤵
            PID:1553
          • /bin/grep
            grep -n "eth0\\s*proto\\s*kernel\\s*scope\\s*link\\s*src"
            2⤵
              PID:1552
            • /bin/ip
              ip route show
              2⤵
                PID:1551
              • /usr/bin/cut
                cut -d: -f1 /etc/passwd
                2⤵
                  PID:1557
                • /usr/bin/id
                  id root
                  2⤵
                  • Reads runtime system information
                  PID:1561
                • /usr/bin/id
                  id daemon
                  2⤵
                  • Reads runtime system information
                  PID:1562
                • /usr/bin/id
                  id bin
                  2⤵
                  • Reads runtime system information
                  PID:1563
                • /usr/bin/id
                  id sys
                  2⤵
                  • Reads runtime system information
                  PID:1564
                • /usr/bin/id
                  id sync
                  2⤵
                  • Reads runtime system information
                  PID:1565
                • /usr/bin/id
                  id games
                  2⤵
                  • Reads runtime system information
                  PID:1566
                • /usr/bin/id
                  id man
                  2⤵
                  • Reads runtime system information
                  PID:1567
                • /usr/bin/id
                  id lp
                  2⤵
                  • Reads runtime system information
                  PID:1568
                • /usr/bin/id
                  id mail
                  2⤵
                  • Reads runtime system information
                  PID:1569
                • /usr/bin/id
                  id news
                  2⤵
                  • Reads runtime system information
                  PID:1570
                • /usr/bin/id
                  id uucp
                  2⤵
                    PID:1571
                  • /usr/bin/id
                    id proxy
                    2⤵
                    • Reads runtime system information
                    PID:1572
                  • /usr/bin/id
                    id www-data
                    2⤵
                    • Reads runtime system information
                    PID:1573
                  • /usr/bin/id
                    id backup
                    2⤵
                    • Reads runtime system information
                    PID:1574
                  • /usr/bin/id
                    id list
                    2⤵
                    • Reads runtime system information
                    PID:1575
                  • /usr/bin/id
                    id irc
                    2⤵
                      PID:1576
                    • /usr/bin/id
                      id gnats
                      2⤵
                      • Reads runtime system information
                      PID:1577
                    • /usr/bin/id
                      id nobody
                      2⤵
                      • Reads runtime system information
                      PID:1578
                    • /usr/bin/id
                      id systemd-network
                      2⤵
                      • Reads runtime system information
                      PID:1579
                    • /usr/bin/id
                      id systemd-resolve
                      2⤵
                      • Reads runtime system information
                      PID:1580
                    • /usr/bin/id
                      id syslog
                      2⤵
                      • Reads runtime system information
                      PID:1581
                    • /usr/bin/id
                      id messagebus
                      2⤵
                      • Reads runtime system information
                      PID:1582
                    • /usr/bin/id
                      id _apt
                      2⤵
                      • Reads runtime system information
                      PID:1583
                    • /usr/bin/id
                      id uuidd
                      2⤵
                        PID:1584
                      • /usr/bin/id
                        id avahi-autoipd
                        2⤵
                        • Reads runtime system information
                        PID:1585
                      • /usr/bin/id
                        id usbmux
                        2⤵
                        • Reads runtime system information
                        PID:1586
                      • /usr/bin/id
                        id dnsmasq
                        2⤵
                        • Reads runtime system information
                        PID:1587
                      • /usr/bin/id
                        id rtkit
                        2⤵
                        • Reads runtime system information
                        PID:1588
                      • /usr/bin/id
                        id cups-pk-helper
                        2⤵
                        • Reads runtime system information
                        PID:1589
                      • /usr/bin/id
                        id saned
                        2⤵
                        • Reads runtime system information
                        PID:1590
                      • /usr/bin/id
                        id speech-dispatcher
                        2⤵
                        • Reads runtime system information
                        PID:1592
                      • /usr/bin/id
                        id whoopsie
                        2⤵
                        • Reads runtime system information
                        PID:1593
                      • /usr/bin/id
                        id colord
                        2⤵
                        • Reads runtime system information
                        PID:1594
                      • /usr/bin/id
                        id kernoops
                        2⤵
                        • Reads runtime system information
                        PID:1595
                      • /usr/bin/id
                        id pulse
                        2⤵
                        • Reads runtime system information
                        PID:1596
                      • /usr/bin/id
                        id avahi
                        2⤵
                        • Reads runtime system information
                        PID:1597
                      • /usr/bin/id
                        id hplip
                        2⤵
                          PID:1598
                        • /usr/bin/id
                          id geoclue
                          2⤵
                          • Reads runtime system information
                          PID:1599
                        • /usr/bin/id
                          id gnome-initial-setup
                          2⤵
                          • Reads runtime system information
                          PID:1600
                        • /usr/bin/id
                          id gdm
                          2⤵
                          • Reads runtime system information
                          PID:1601
                        • /usr/bin/id
                          id sshd
                          2⤵
                          • Reads runtime system information
                          PID:1602
                        • /usr/bin/id
                          id user
                          2⤵
                          • Reads runtime system information
                          PID:1603
                        • /bin/hostname
                          hostname
                          2⤵
                            PID:1604
                          • /bin/uname
                            uname -m
                            2⤵
                              PID:1605
                            • /usr/bin/whoami
                              whoami
                              2⤵
                                PID:1606

                            Network

                                  MITRE ATT&CK Matrix

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads