Overview

overview

4

Static

static

1

run.sh

ubuntu-18.04-amd64

4

run.sh

debian-9-armhf

1

run.sh

debian-9-mips

run.sh

debian-9-mipsel

Analysis

  • max time kernel
    0s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    22/05/2024, 11:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    run.sh

  • Size

    319B

  • MD5

    b672d65a50a1b081ccbd274ebf633fb4

  • SHA1

    04a4b14245374e6ff407783c9fccd54454da953b

  • SHA256

    9425eeb253b62f1df0c4c2da16ac436fb7494c971733a2124aee1cc3897eca14

  • SHA512

    39226ccbc799b15e79bf5e6efe2468253740a280c2bfd9fa316fe5aaf741144a811b0a47567111bd39744d592d4a0628f06964f341e7bd2beb6015ad2481e4a6

Score
4/10

Malware Config

Signatures

  • Changes its process name 1 IoCs
  • Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/run.sh
    /tmp/run.sh
    1⤵
      PID:1471
    • /usr/local/sbin/bash
      bash /tmp/run.sh
      1⤵
        PID:1471
      • /usr/local/bin/bash
        bash /tmp/run.sh
        1⤵
          PID:1471
        • /usr/sbin/bash
          bash /tmp/run.sh
          1⤵
            PID:1471
          • /usr/bin/bash
            bash /tmp/run.sh
            1⤵
              PID:1471
            • /sbin/bash
              bash /tmp/run.sh
              1⤵
                PID:1471
              • /bin/bash
                bash /tmp/run.sh
                1⤵
                  PID:1471
                  • /usr/bin/npm
                    npm install
                    2⤵
                      PID:1473
                    • /usr/local/sbin/node
                      node /usr/bin/npm install
                      2⤵
                        PID:1473
                      • /usr/local/bin/node
                        node /usr/bin/npm install
                        2⤵
                          PID:1473
                        • /usr/sbin/node
                          node /usr/bin/npm install
                          2⤵
                            PID:1473
                          • /usr/bin/node
                            node /usr/bin/npm install
                            2⤵
                            • Changes its process name
                            • Enumerates kernel/hardware configuration
                            • Reads runtime system information
                            PID:1473

                        Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads