1660c83ed3ff61e9658e5cc7372c353eca5fe08c71c3d49e20f5c1a91ee29a4b

General

Target

mainteanace.sh
Size

1KB
MD5

5121492c7ff75de55dfa6e917a42ded1
SHA1

010846349a560fefd585aae10ba015244c7cd6b1
SHA256

1660c83ed3ff61e9658e5cc7372c353eca5fe08c71c3d49e20f5c1a91ee29a4b
SHA512

16c8f4028a78c9481374c1f199ea9dd31f91fc0945cb15b9f416f0fd610a2c7321536add514d414d20cf64c119bf004990652e792dfb5cd5e8fda5c2378165eb

Score

6^/10

antivm

Malware Config

Signatures

Checks system information (zLinux) 1 TTPs 1 IoCs
Check system information on IBM zSystems which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

lscpu

description ioc process

File opened for reading /proc/sysinfo lscpu
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

lscpu

description ioc process

File opened for reading /proc/cpuinfo lscpu

description	ioc	process
File opened for reading	/proc/sysinfo	lscpu

description	ioc	process
File opened for reading	/proc/cpuinfo	lscpu

Reads CPU attributes 1 TTPs 24 IoCs

System Information Discovery

T1082

Processes:

lscpu

description	ioc	process
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/online	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/size	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/level	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/size	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/size	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/level	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/size	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/shared_cpu_map	lscpu
File opened for reading	/sys/devices/system/cpu/present	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/thread_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_id	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/physical_package_id	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/type	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/level	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/level	lscpu
File opened for reading	/sys/devices/system/cpu/kernel_max	lscpu
File opened for reading	/sys/devices/system/cpu/possible	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/topology/core_siblings	lscpu
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/type	lscpu

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

lscpu

description	ioc	process
File opened for reading	/sys/devices/system/node	lscpu
File opened for reading	/sys/devices/system/node/node0/cpumap	lscpu
File opened for reading	/sys/firmware/dmi/tables/DMI	lscpu

Reads runtime system information 27 IoCs

Reads data from /proc virtual filesystem.

Processes:

sudofindawklscpuawkawkawkawkdpkgawkfindxargsawklsdpkgawkawkawkawkawkdfls

description	ioc	process
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/bus/pci/devices	lscpu
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/self/fd	xargs
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/device-tree/compatible	lscpu
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/kernel/osrelease	lscpu
File opened for reading	/proc/self/status	lscpu
File opened for reading	/proc/self/mountinfo	df
File opened for reading	/proc/filesystems	ls

/tmp/mainteanace.sh
/tmp/mainteanace.sh
1⤵
PID:1522

/usr/bin/awk
awk "{print \$2, \$3, \$4}"
2⤵
- Reads runtime system information
PID:1525

/usr/bin/lsb_release
lsb_release -d
2⤵
PID:1524

/usr/bin/xargs
xargs
2⤵
- Reads runtime system information
PID:1530

/usr/local/sbin/echo
echo Intel Core Processor "(Broadwell)"
3⤵
PID:1531

/usr/local/bin/echo
echo Intel Core Processor "(Broadwell)"
3⤵
PID:1531

/usr/sbin/echo
echo Intel Core Processor "(Broadwell)"
3⤵
PID:1531

/usr/bin/echo
echo Intel Core Processor "(Broadwell)"
3⤵
PID:1531

/sbin/echo
echo Intel Core Processor "(Broadwell)"
3⤵
PID:1531

/bin/echo
echo Intel Core Processor "(Broadwell)"
3⤵
PID:1531

/usr/bin/awk
awk -F: "{print \$2}"
2⤵
- Reads runtime system information
PID:1529

/bin/grep
grep "Model name"
2⤵
PID:1528

/usr/bin/lscpu
lscpu
2⤵
- Checks system information (zLinux)
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1527

/usr/bin/awk
awk "{print }"
2⤵
- Reads runtime system information
PID:1534

/bin/df
df -H
2⤵
- Reads runtime system information
PID:1533

/usr/bin/awk
awk "{print}"
2⤵
- Reads runtime system information
PID:1537

/usr/bin/whoami
whoami
2⤵
PID:1536

/usr/bin/awk
awk "{print}"
2⤵
- Reads runtime system information
PID:1540

/bin/ls
ls /etc/nginx/sites-available
2⤵
- Reads runtime system information
PID:1539

/usr/bin/awk
awk "{print}"
2⤵
- Reads runtime system information
PID:1543

/bin/ls
ls /etc/apache/sites-available
2⤵
- Reads runtime system information
PID:1542

/usr/bin/awk
awk "{print}"
2⤵
- Reads runtime system information
PID:1546

/usr/bin/node
node -v
2⤵
PID:1545

/usr/bin/awk
awk "{print}"
2⤵
- Reads runtime system information
PID:1549

/usr/bin/awk
awk "FNR == 1 {print}"
2⤵
- Reads runtime system information
PID:1553

/bin/grep
grep mysql
2⤵
PID:1552

/usr/bin/dpkg
dpkg -l
2⤵
- Reads runtime system information
PID:1551

/usr/local/sbin/dpkg-query
dpkg-query --list --
2⤵
PID:1551

/usr/local/bin/dpkg-query
dpkg-query --list --
2⤵
PID:1551

/usr/sbin/dpkg-query
dpkg-query --list --
2⤵
PID:1551

/usr/bin/dpkg-query
dpkg-query --list --
2⤵
PID:1551

/usr/bin/awk
awk "FNR == 1 {print}"
2⤵
- Reads runtime system information
PID:1560

/bin/grep
grep mongo
2⤵
PID:1559

/usr/bin/dpkg
dpkg -l
2⤵
- Reads runtime system information
PID:1558

/usr/local/sbin/dpkg-query
dpkg-query --list --
2⤵
PID:1558

/usr/local/bin/dpkg-query
dpkg-query --list --
2⤵
PID:1558

/usr/sbin/dpkg-query
dpkg-query --list --
2⤵
PID:1558

/usr/bin/dpkg-query
dpkg-query --list --
2⤵
PID:1558

/usr/bin/awk
awk "{print}"
2⤵
- Reads runtime system information
PID:1563

/usr/bin/sudo
sudo find /var/log/ -name "*.gz" -type f -delete
2⤵
- Reads runtime system information
PID:1562

/usr/bin/sort
sort -u
2⤵
PID:1566

/usr/bin/find
find /opt/bitnami -type d -perm 777
2⤵
- Reads runtime system information
PID:1565

/usr/bin/sort
sort -u
2⤵
PID:1572

/usr/bin/find
find /var/www/html -maxdepth 3 -type d -perm 777
2⤵
- Reads runtime system information
PID:1571

/usr/bin/awk
awk "FNR == 1 {print}"
2⤵
- Reads runtime system information
PID:1575

/usr/bin/last
last -xF reboot
2⤵
PID:1574

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads