eda059f25e212b264ced6dff8ffb29c91c340f946abeb06f5c435a863b2b033c

Analysis

max time kernel
149s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-05-2024 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sb.sh
Size

25KB
MD5

d2b3a86dddf8cca8e96523cb1c72fdf9
SHA1

bdb88030cb5d94b8c53a7c3bf34c894ef23ea285
SHA256

eda059f25e212b264ced6dff8ffb29c91c340f946abeb06f5c435a863b2b033c
SHA512

19d25ec838dfc885cb2cb08170339373a9c2b7413fd06172dc7fa87289f1f7042c7e46a91e6b2c8aca70fad5e90bf8f2466f34ae3674da5dc4b9570173d0e3aa
SSDEEP

768:KLnoHx/WjXVqewjuDgyadveimN+oRMciVv:KMHl2qeiuDF6eimN3RMJt

Score

7^/10

antivm

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

sb.sh

ioc pid process

/root/.cache/bztmpDYDUDPjfk/sb.sh 1522 sb.sh

ioc	pid	process
/root/.cache/bztmpDYDUDPjfk/sb.sh	1522	sb.sh

Checks hardware identifiers (DMI) 1 TTPs 2 IoCs

Checks DMI information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

Processes:

systemd-detect-virt

description	ioc	process
File opened for reading	/sys/class/dmi/id/product_name	systemd-detect-virt
File opened for reading	/sys/class/dmi/id/sys_vendor	systemd-detect-virt

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

10 raw.githubusercontent.com
11 raw.githubusercontent.com
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

flow	ioc
10	raw.githubusercontent.com
11	raw.githubusercontent.com

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

snapsnapsnapsnap

description	ioc	process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap

Reads runtime system information 48 IoCs

Reads data from /proc virtual filesystem.

Processes:

snapaptdpkgsystemd-detect-virtsysctlsnapidsystemctldpkgsnapapt-getawksysctldpkgiddpkgdpkgsnapapt-getdpkgdpkgapt-getdpkgdpkgdpkgawkaptawkdpkg

description	ioc	process
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/1/sched	systemd-detect-virt
File opened for reading	/proc/sys/net/ipv4/tcp_congestion_control	sysctl
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/cmdline	snap
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/cmdline	snap
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/kernel/osrelease	systemd-detect-virt
File opened for reading	/proc/sys/net/ipv4/tcp_congestion_control	sysctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/cmdline	snap
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/stat	systemd-detect-virt
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/cmdline	snap
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	apt-get
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/sys/kernel/ngroups_max	apt-get
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/sys/kernel/ngroups_max	apt-get
File opened for reading	/proc/filesystems	systemd-detect-virt
File opened for reading	/proc/1/environ	systemd-detect-virt
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/cmdline	systemd-detect-virt
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/fd	apt

Writes file to tmp directory 64 IoCs

Malware often drops required files in the /tmp directory.

Processes:

aptapt-getapt-getaptapt-get

description	ioc	process
File opened for modification	/tmp/fileutl.message.ySIiiK	apt
File opened for modification	/tmp/fileutl.message.2Stzz1	apt-get
File opened for modification	/tmp/fileutl.message.wfxOq9	apt-get
File opened for modification	/tmp/fileutl.message.Bnzp4Q	apt
File opened for modification	/tmp/fileutl.message.rhe24c	apt
File opened for modification	/tmp/fileutl.message.Dx0Q9L	apt
File opened for modification	/tmp/fileutl.message.yV8cbO	apt-get
File opened for modification	/tmp/fileutl.message.z8M09E	apt-get
File opened for modification	/tmp/fileutl.message.T8UohY	apt-get
File opened for modification	/tmp/fileutl.message.woahpB	apt
File opened for modification	/tmp/fileutl.message.SX6iQF	apt
File opened for modification	/tmp/fileutl.message.I9dH72	apt
File opened for modification	/tmp/fileutl.message.e8GSro	apt-get
File opened for modification	/tmp/fileutl.message.9A54KM	apt
File opened for modification	/tmp/fileutl.message.5DCFwh	apt
File opened for modification	/tmp/fileutl.message.XvxTBc	apt-get
File opened for modification	/tmp/fileutl.message.tJV0J7	apt-get
File opened for modification	/tmp/fileutl.message.HR42Zg	apt-get
File opened for modification	/tmp/fileutl.message.nyyZ8C	apt-get
File opened for modification	/tmp/fileutl.message.hgmSiZ	apt-get
File opened for modification	/tmp/fileutl.message.xONyMZ	apt
File opened for modification	/tmp/fileutl.message.Bit7b4	apt
File opened for modification	/tmp/fileutl.message.E0Z4qf	apt
File opened for modification	/tmp/fileutl.message.qicQJS	apt-get
File opened for modification	/tmp/fileutl.message.oaVo4W	apt-get
File opened for modification	/tmp/fileutl.message.PSVKtl	apt-get
File opened for modification	/tmp/fileutl.message.4X0VAs	apt
File opened for modification	/tmp/fileutl.message.b0RFC8	apt
File opened for modification	/tmp/fileutl.message.jBERxD	apt
File opened for modification	/tmp/fileutl.message.24zTdV	apt-get
File opened for modification	/tmp/fileutl.message.e6THIr	apt-get
File opened for modification	/tmp/fileutl.message.BxeNY2	apt-get
File opened for modification	/tmp/fileutl.message.anwPxr	apt
File opened for modification	/tmp/fileutl.message.EXQIUh	apt-get
File opened for modification	/tmp/fileutl.message.nVmBCv	apt-get
File opened for modification	/tmp/fileutl.message.HE21zV	apt
File opened for modification	/tmp/fileutl.message.S4IQ0J	apt-get
File opened for modification	/tmp/fileutl.message.mdpReo	apt
File opened for modification	/tmp/fileutl.message.PAXx6D	apt
File opened for modification	/tmp/fileutl.message.Djs1Au	apt
File opened for modification	/tmp/fileutl.message.0wHTQv	apt-get
File opened for modification	/tmp/fileutl.message.OXOa9Q	apt-get
File opened for modification	/tmp/fileutl.message.E8EP2Q	apt-get
File opened for modification	/tmp/fileutl.message.Qs6ziM	apt-get
File opened for modification	/tmp/fileutl.message.5nLTlR	apt
File opened for modification	/tmp/fileutl.message.cvX1Qo	apt-get
File opened for modification	/tmp/fileutl.message.Gmxgxd	apt-get
File opened for modification	/tmp/fileutl.message.RDlh5J	apt-get
File opened for modification	/tmp/fileutl.message.N5UUlA	apt-get
File opened for modification	/tmp/fileutl.message.CQqWVA	apt-get
File opened for modification	/tmp/fileutl.message.2ovdUj	apt
File opened for modification	/tmp/fileutl.message.1GUypV	apt
File opened for modification	/tmp/fileutl.message.8VmiLO	apt
File opened for modification	/tmp/fileutl.message.DmC1Em	apt
File opened for modification	/tmp/fileutl.message.tgsTHc	apt-get
File opened for modification	/tmp/fileutl.message.VJI2Ly	apt-get
File opened for modification	/tmp/fileutl.message.gDaWOe	apt-get
File opened for modification	/tmp/fileutl.message.E3BwcH	apt-get
File opened for modification	/tmp/fileutl.message.kvMeFj	apt-get
File opened for modification	/tmp/fileutl.message.o3TcZw	apt
File opened for modification	/tmp/fileutl.message.If0gRt	apt
File opened for modification	/tmp/fileutl.message.kDlpkz	apt
File opened for modification	/tmp/fileutl.message.DoLKJ3	apt
File opened for modification	/tmp/fileutl.message.4CEfj2	apt-get

/tmp/sb.sh
/tmp/sb.sh
1⤵
PID:1507
- /usr/bin/id
  id -u -n
  2⤵
  - Reads runtime system information
  PID:1508
- /usr/bin/cut
  cut -d: -f6
  2⤵
  PID:1511
- /usr/bin/getent
  getent passwd root
  2⤵
  PID:1510
- /bin/mktemp
  mktemp -d /root/.cache/bztmpXXXXXXXXX
  2⤵
  PID:1513
- /usr/bin/basename
  basename /tmp/sb.sh
  2⤵
  PID:1514
- /usr/bin/tail
  tail -n +1
  2⤵
  PID:1517
- /bin/bzip2
  bzip2 -cd
  2⤵
  PID:1519
- /usr/bin/tail
  tail -n +75
  2⤵
  PID:1518
- /bin/chmod
  chmod 700 /root/.cache/bztmpDYDUDPjfk/sb.sh
  2⤵
  PID:1520
- /root/.cache/bztmpDYDUDPjfk/sb.sh
  /root/.cache/bztmpDYDUDPjfk/sb.sh
  2⤵
  - Executes dropped EXE
  PID:1522
- - /bin/grep
    grep -q -E -i debian
    3⤵
    PID:1524
- - /bin/cat
    cat /etc/issue
    3⤵
    PID:1523
- - /bin/grep
    grep -q -E -i ubuntu
    3⤵
    PID:1527
- - /bin/cat
    cat /etc/issue
    3⤵
    PID:1526
- - /usr/bin/cut
    cut -d . -f1
    3⤵
    PID:1531
- - /usr/bin/cut
    cut -d "\"" -f2
    3⤵
    PID:1530
- - /bin/grep
    grep -i version_id /etc/os-release
    3⤵
    PID:1529
- - /bin/cat
    cat /etc/redhat-release
    3⤵
    PID:1533
- - /usr/bin/cut
    cut -d "\"" -f2
    3⤵
    PID:1536
- - /bin/grep
    grep -i pretty_name
    3⤵
    PID:1535
- - /bin/cat
    cat /etc/os-release
    3⤵
    PID:1534
- - /bin/grep
    grep -i -E "arch|alpine"
    3⤵
    PID:1539
- - /usr/bin/cut
    cut -d - -f1
    3⤵
    PID:1542
- - /bin/uname
    uname -r
    3⤵
    PID:1541
- - /usr/bin/systemd-detect-virt
    systemd-detect-virt
    3⤵
    - Checks hardware identifiers (DMI)
    - Reads runtime system information
    PID:1544
- - /bin/uname
    uname -m
    3⤵
    PID:1545
- - /usr/bin/cut
    cut -d: -f2
    3⤵
    PID:1550
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1549
- - /bin/grep
    grep flags
    3⤵
    PID:1548
- - /bin/cat
    cat /proc/cpuinfo
    3⤵
    - Checks CPU configuration
    PID:1547
- - /usr/bin/awk
    awk -F " " "{print \$3}"
    3⤵
    - Reads runtime system information
    PID:1553
- - /sbin/sysctl
    sysctl net.ipv4.tcp_congestion_control
    3⤵
    - Reads runtime system information
    PID:1552
- - /usr/bin/awk
    awk -F " " "{print \$3}"
    3⤵
    - Reads runtime system information
    PID:1556
- - /sbin/sysctl
    sysctl net.ipv4.tcp_congestion_control
    3⤵
    - Reads runtime system information
    PID:1555
- - /bin/hostname
    hostname
    3⤵
    PID:1557
- - /usr/bin/apt
    apt update -y
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1559
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1560
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1561
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:1562
  - - /bin/sh
      sh -c "[ ! -e /run/systemd/system ] || [ \$(id -u) -ne 0 ] || systemctl start --no-block apt-news.service esm-cache.service || true"
      4⤵
      PID:1564
    - - /usr/bin/id
        
        id -u
        5⤵
        Reads runtime system information
        
        PID:1565
    - - /bin/systemctl
        
        systemctl start --no-block apt-news.service esm-cache.service
        5⤵
        Reads runtime system information
        
        PID:1566
  - - /usr/lib/apt/methods/https
      /usr/lib/apt/methods/https
      4⤵
      PID:1570
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1574
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1575
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1579
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1580
- - /usr/bin/apt
    apt install jq iptables-persistent -y
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1581
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1582
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1583
  - - /bin/sh
      /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
      4⤵
      PID:1584
    - - /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:1585
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1593
  - - /bin/sh
      /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
      4⤵
      PID:1594
    - - /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:1595
  - - /bin/sh
      /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
      4⤵
      PID:1603
    - - /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:1604
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1612
  - - /bin/sh
      /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
      4⤵
      PID:1616
    - - /usr/bin/snap
        
        /usr/bin/snap advise-snap --from-apt
        5⤵
        Enumerates kernel/hardware configuration
        Reads runtime system information
        
        PID:1617
- - /usr/bin/touch
    touch sbyg_update
    3⤵
    PID:1627
- - /usr/bin/apt-get
    apt-get install -y expect
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1629
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1630
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1631
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1632
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1633
- - /usr/bin/apt-get
    apt-get install -y qrencode
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1638
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1639
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1640
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1641
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1642
- - /usr/bin/apt-get
    apt-get install -y git
    3⤵
    - Reads runtime system information
    - Writes file to tmp directory
    PID:1647
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1648
  - - /usr/bin/dpkg
      /usr/bin/dpkg --print-foreign-architectures
      4⤵
      Reads runtime system information
      PID:1649
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1650
  - - /usr/lib/apt/methods/http
      /usr/lib/apt/methods/http
      4⤵
      PID:1651
- - /usr/bin/clear
    clear
    3⤵
    PID:1655
- - /bin/cat
    cat /etc/s-box/v
    3⤵
    PID:1657
- - /usr/bin/head
    head -n 1
    3⤵
    PID:1661
- - /usr/bin/awk
    awk -F 更新内容 "{print \$1}"
    3⤵
    - Reads runtime system information
    PID:1660
- - /usr/bin/curl
    curl -sL https://raw.githubusercontent.com/yonggekkk/sing-box_hysteria2_tuic_argo_reality/main/version
    3⤵
    PID:1659
- /bin/sleep
  sleep 5
  2⤵
  PID:1525
- /bin/rm
  rm -fr /root/.cache/bztmpDYDUDPjfk
  2⤵
  PID:1666

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/root/.cache/bztmpDYDUDPjfk/sb.sh

Filesize
143KB

MD5
3a6cceb40eee5c9ca2761b524c1ad80a

SHA1
0975b3e367ec535443b3899c10140bdabf6380c9

SHA256
b9dd2a4a8d7da7151359224874048a6dace0b3028d7b044a434a61aee02473ef

SHA512
cee398036a510fd24e72cbd4e9ca9f78f4703250f92c67815f9921ca2fc6a841dd3a6a66daa06136e043a2c28210a069a3be785ca38f112a28bd72fbea265973

Download Submit
/tmp/fileutl.message.9A54KM

Filesize
235KB

MD5
373fe2f2ef99005d2550a482f09a3e51

SHA1
68e6572b55b1e77f7d171ebac7b2579b7a6bd51d

SHA256
7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5

SHA512
def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b

Download Submit