Analysis
-
max time kernel
148s -
max time network
129s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
21/05/2024, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
addRepo-ports.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
addRepo-ports.sh
Resource
debian9-armhf-20240226-en
Behavioral task
behavioral3
Sample
addRepo-ports.sh
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral4
Sample
addRepo-ports.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
addRepo-ports.sh
-
Size
3KB
-
MD5
2e5aec65c4815ddaa9dada3f4fa0ba9a
-
SHA1
36f4087b10f5211a6e9c6862c16ccf6536b57260
-
SHA256
4e06726a6ae66aac75c6f0b2208acc902e4cfb14af7a65e53ea87f2ea3c080a7
-
SHA512
534e7aaac38984abcc4cbd878ec9f3b6744f405a0baed2d9c820122c7dce064c3ceef107ecf84cca79ec8210fed670a42313052ffb3bec139cbadd24435d216b
Malware Config
Signatures
-
Reads runtime system information 7 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems dpkg File opened for reading /proc/filesystems sudo
Processes
-
/tmp/addRepo-ports.sh/tmp/addRepo-ports.sh1⤵PID:1522
-
/bin/grepgrep -c Ubuntu2⤵PID:1525
-
-
/bin/catcat /etc/issue2⤵PID:1524
-
-
/usr/bin/dpkgdpkg --print-architecture2⤵
- Reads runtime system information
PID:1526
-
-
/usr/bin/sudosudo apt-get update2⤵
- Reads runtime system information
PID:1527
-
-
/usr/bin/sudosudo apt-get install curl2⤵
- Reads runtime system information
PID:1531
-
-
/usr/bin/curlcurl -O https://mirror.coganng.com/addRepo.sh2⤵PID:1532
-