Analysis
-
max time kernel
0s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22/05/2024, 12:01
Static task
static1
Behavioral task
behavioral1
Sample
ssl_18s.sh
Resource
ubuntu1804-amd64-20240508-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
ssl_18s.sh
Resource
debian9-armhf-20240226-en
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ssl_18s.sh
Resource
debian9-mipsbe-20240418-en
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
ssl_18s.sh
Resource
debian9-mipsel-20240418-en
0 signatures
150 seconds
General
-
Target
ssl_18s.sh
-
Size
3KB
-
MD5
7867253fd64fbfc9edc14cd9ea5164bb
-
SHA1
6cf753d8c44e06c9ee944bd58f0b576a00d28029
-
SHA256
3b42d6122b6ec24d662be96cdd94e292565493d036331c2726c4794d0a6490be
-
SHA512
42c9c5b103fc656f8c4e85ee5da79e1e9af17348963ac953450eace29dc577d4f7f9257d182fe57f81e282ded9f7079ff628a3bf39b558079914ca7c427e8dec
Score
3/10
Malware Config
Signatures
-
Reads runtime system information 30 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/filesystems sudo
Processes
-
/tmp/ssl_18s.sh/tmp/ssl_18s.sh1⤵PID:1495
-
/usr/bin/sudosudo a2dissite default.conf2⤵
- Reads runtime system information
PID:1498
-
-
/usr/bin/sudosudo mv /etc/apache2/sites-available/default.conf /etc/apache2/sites-available/default-bak.conf2⤵
- Reads runtime system information
PID:1499
-
-
/usr/bin/sudosudo a2dissite default-le-ssl.conf2⤵
- Reads runtime system information
PID:1503
-
-
/usr/bin/sudosudo mv /etc/apache2/sites-available/default-le-ssl.conf /etc/apache2/sites-available/default-bak-le-ssl.conf2⤵
- Reads runtime system information
PID:1512
-
-
/usr/bin/sudosudo a2dissite 000-default.conf2⤵
- Reads runtime system information
PID:1513
-
-
/usr/bin/sudosudo a2dissite default-ssl.conf2⤵
- Reads runtime system information
PID:1520
-
-
/usr/bin/sudosudo cp /var/www/default_18s.conf /etc/apache2/sites-available/default.conf2⤵
- Reads runtime system information
PID:1521
-
-
/usr/bin/sudosudo a2ensite default.conf2⤵
- Reads runtime system information
PID:1527
-
-
/usr/bin/sudosudo service apache2 restart2⤵
- Reads runtime system information
PID:1531
-
-
/usr/bin/sudosudo certbot --authenticator webroot --installer apache -w /var/www/public -d freehome.site --redirect --keep-until-expiring --agree-tos -m "[email protected]" --no-eff-email2⤵
- Reads runtime system information
PID:1538
-