Analysis
-
max time kernel
0s -
max time network
128s -
platform
ubuntu-18.04_amd64 -
resource
ubuntu1804-amd64-20240508-en -
resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system -
submitted
22-05-2024 12:03
Static task
static1
Behavioral task
behavioral1
Sample
modify_agent_service.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
modify_agent_service.sh
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral3
Sample
modify_agent_service.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
modify_agent_service.sh
Resource
debian9-mipsel-20240226-en
General
-
Target
modify_agent_service.sh
-
Size
511B
-
MD5
d8acd22e90dd1a00f7924e7de8ae4fea
-
SHA1
2f4a01f72ad5a2181a204f065125f3713ea8db86
-
SHA256
d72716420f390d7401205df4d36477b89a4cf1582e03647fd3b07450b84666c1
-
SHA512
c38764e0f78f3d0247c975ec03fa160d7311461a0912c751ba70c68f1d8daecc549970cbbb7876164b24c871f1f2064bd49fcbfc5428378a3ae141e9a633c06d
Malware Config
Signatures
-
Reads runtime system information 15 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/self/stat sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/sys/kernel/ngroups_max sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/self/stat sudo File opened for reading /proc/filesystems sudo File opened for reading /proc/sys/kernel/ngroups_max sudo
Processes
-
/tmp/modify_agent_service.sh/tmp/modify_agent_service.sh1⤵PID:1496
-
/usr/bin/sudosudo mkdir /opt/scripts2⤵
- Reads runtime system information
PID:1497
-
-
/usr/bin/sudosudo chown -R ec2-user:ec2-user /opt/scripts2⤵
- Reads runtime system information
PID:1501
-
-
/usr/bin/sudosudo chown -R ec2-user:ec2-user /etc/zabbix/2⤵
- Reads runtime system information
PID:1503
-
-
/usr/bin/sudosudo chmod +x "/opt/scripts/*"2⤵
- Reads runtime system information
PID:1511
-
-
/usr/bin/sudosudo systemctl restart zabbix-agent.service2⤵
- Reads runtime system information
PID:1512
-