e50c1d912ef694a431c9747ea38a10e471bf8f76ad15213661854d91dd312d2f

Analysis

max time kernel
0s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
21/05/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wp-install.sh
Size

3KB
MD5

267edac3406be33a7664c9ed81f37a00
SHA1

a7734fa706f2322ecbec95d8f4f6b4e8b4705d6d
SHA256

e50c1d912ef694a431c9747ea38a10e471bf8f76ad15213661854d91dd312d2f
SHA512

c66f52a9458eb2d553f6ea203518095b736f406a890f58dc5c90ce2b73bdde91c51738f532399f70cb1fc06d189a4a7fa76ae94d01a9dc48660337cd7b64b957

Score

3^/10

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap

Reads runtime system information 5 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/cmdline	snap

Writes file to tmp directory 16 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.j9SVxu	apt
File opened for modification	/tmp/fileutl.message.Y7iR1t	apt
File opened for modification	/tmp/fileutl.message.TQg7Db	apt
File opened for modification	/tmp/fileutl.message.WWjWHQ	apt
File opened for modification	/tmp/fileutl.message.qgeCSa	apt
File opened for modification	/tmp/fileutl.message.WLnb7u	apt
File opened for modification	/tmp/fileutl.message.8YJBH9	apt
File opened for modification	/tmp/fileutl.message.eg1IoO	apt
File opened for modification	/tmp/fileutl.message.35e4xR	apt
File opened for modification	/tmp/fileutl.message.HRkzZP	apt
File opened for modification	/tmp/fileutl.message.Fongfa	apt
File opened for modification	/tmp/fileutl.message.gZWtoP	apt
File opened for modification	/tmp/fileutl.message.sWSxAw	apt
File opened for modification	/tmp/fileutl.message.ZcuQMv	apt
File opened for modification	/tmp/fileutl.message.ZxJvRO	apt
File opened for modification	/tmp/fileutl.message.j3aad9	apt

/tmp/wp-install.sh
/tmp/wp-install.sh
1⤵
PID:1506
- /usr/bin/apt
  apt install -y docker-ce
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1509
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1510
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1514
- - /bin/sh
    /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
    3⤵
    PID:1515
  - - /usr/bin/snap
      /usr/bin/snap advise-snap --from-apt
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/fileutl.message.35e4xR

Filesize
235KB

MD5
373fe2f2ef99005d2550a482f09a3e51

SHA1
68e6572b55b1e77f7d171ebac7b2579b7a6bd51d

SHA256
7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5

SHA512
def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b

Download Submit