41a7cf0ca54429ebb581b4049cf7cb2e98e59a6836420105f015cd122cde4a78

General

Target

check_umailsystem.sh
Size

26KB
MD5

3ea10d71b89263cab6a0d5b9e74b53fd
SHA1

5a04274bc2044df3c469a43856fe0cc42875897f
SHA256

41a7cf0ca54429ebb581b4049cf7cb2e98e59a6836420105f015cd122cde4a78
SHA512

e112cebc9ca70042046b01a485a7faa497e0ca34214a52e47fa1fc5ed5309a26cd027daa0627ac2b219158f326edd1762407421b15a3808ded0e639e3b0cd494
SSDEEP

384:+JIv74xu2gPeLOxZhB4nyLdbfLyIlYO6zTOIqizeY:+JI0xu2qeLOxUTeiz3

Score

4^/10

antivm

Malware Config

Signatures

Checks CPU configuration 1 TTPs 5 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

Processes:

catcatcatcatcat

description	ioc	process
File opened for reading	/proc/cpuinfo	cat
File opened for reading	/proc/cpuinfo	cat
File opened for reading	/proc/cpuinfo	cat
File opened for reading	/proc/cpuinfo	cat
File opened for reading	/proc/cpuinfo	cat

Reads CPU attributes 1 TTPs 7 IoCs

System Information Discovery

T1082

Processes:

uptimeuptimetopfreefreefreefree

description	ioc	process
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	uptime
File opened for reading	/sys/devices/system/cpu/online	top
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free
File opened for reading	/sys/devices/system/cpu/online	free

Enumerates kernel/hardware configuration 1 TTPs 3 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

top

description	ioc	process
File opened for reading	/sys/devices/system/node	top
File opened for reading	/sys/devices/system/node/node0/meminfo	top
File opened for reading	/sys/devices/system/cpu	top

Reads runtime system information 51 IoCs

Reads data from /proc virtual filesystem.

Processes:

uptimeuptimeawkawktopawkawkawkawkawkawkawkawkawkawkawkfreeawksedawkawksedawkfreeseddffreeawksedsedawkawksedfreeawkseddfawkawkawkawk

description	ioc	process
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/stat	top
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/loadavg	uptime
File opened for reading	/proc/sys/kernel/osrelease	uptime
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/status	top
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/mountinfo	df
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/uptime	uptime
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/mountinfo	df
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/kernel/osrelease	top
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/meminfo	free
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/sys/kernel/osrelease	free
File opened for reading	/proc/self/maps	awk

/tmp/check_umailsystem.sh
/tmp/check_umailsystem.sh
1⤵
PID:1523

/bin/date
date "+%Y-%m-%d %H:%M:%S"
2⤵
PID:1524

/usr/bin/awk
awk "{print\$NF}"
2⤵
- Reads runtime system information
PID:1529

/usr/bin/uniq
uniq
2⤵
PID:1528

/bin/grep
grep "cpu cores"
2⤵
PID:1527

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1526

/usr/bin/wc
wc -l
2⤵
PID:1533

/bin/grep
grep processor
2⤵
PID:1532

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1531

/usr/bin/sort
sort -u
2⤵
PID:1538

/usr/bin/cut
cut -f2 -d:
2⤵
PID:1537

/bin/grep
grep name
2⤵
PID:1536

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1535

/usr/bin/cut
cut -f2 -d:
2⤵
PID:1542

/bin/grep
grep name
2⤵
PID:1541

/usr/bin/uniq
uniq -c
2⤵
PID:1543

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1540

/usr/bin/awk
awk "{print \$1}"
2⤵
- Reads runtime system information
PID:1549

/usr/bin/uniq
uniq -c
2⤵
PID:1548

/usr/bin/cut
cut -f2 -d:
2⤵
PID:1547

/bin/grep
grep name
2⤵
PID:1546

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1545

/usr/bin/awk
awk "{for(i=6;i<=NF;i++) printf \$i\"\"FS;print \"\"}"
2⤵
- Reads runtime system information
PID:1552

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1551

/bin/sed
sed "s/^[ \\t]*//g"
2⤵
- Reads runtime system information
PID:1558

/usr/bin/awk
awk -F. "{print \$1}"
2⤵
- Reads runtime system information
PID:1557

/usr/bin/awk
awk "-F," "{print \$1}"
2⤵
- Reads runtime system information
PID:1556

/usr/bin/awk
awk "-Fload average:" "{print \$2}"
2⤵
- Reads runtime system information
PID:1555

/usr/bin/uptime
uptime
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1554

/bin/grep
grep "Cpu(s)"
2⤵
PID:1561

/usr/bin/top
top -n 1
2⤵
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1560

/usr/bin/awk
awk "-F " "{print \$2}"
2⤵
- Reads runtime system information
PID:1565

/bin/grep
grep Mem:
2⤵
PID:1564

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1563

/usr/bin/awk
awk "-F " "{print \$2\"M\"}"
2⤵
- Reads runtime system information
PID:1569

/bin/grep
grep Mem:
2⤵
PID:1568

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1567

/usr/bin/awk
awk "-F " "{print \$4\"M\"}"
2⤵
- Reads runtime system information
PID:1573

/bin/grep
grep Mem:
2⤵
PID:1572

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1571

/usr/bin/awk
awk "-F " "{print \$3}"
2⤵
- Reads runtime system information
PID:1577

/bin/grep
grep Mem:
2⤵
PID:1576

/usr/bin/free
free -m
2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1575

/bin/sed
sed "s/%//g"
2⤵
- Reads runtime system information
PID:1581

/usr/bin/awk
awk "{print \$(NF-1)\"\\t\"\$NF\"\\t\"\$(NF-2)}"
2⤵
- Reads runtime system information
PID:1589

/bin/sed
sed 1d
2⤵
- Reads runtime system information
PID:1588

/bin/grep
grep -v /run/media
2⤵
PID:1587

/bin/grep
grep -v /boot
2⤵
PID:1586

/bin/grep
grep -v /var/lib/docker
2⤵
PID:1585

/bin/grep
grep -v tmpfs
2⤵
PID:1584

/bin/df
df -hP
2⤵
- Reads runtime system information
PID:1583

/usr/bin/awk
awk "{print \$1}"
2⤵
- Reads runtime system information
PID:1592

/usr/bin/awk
awk "{print \$2}"
2⤵
- Reads runtime system information
PID:1595

/usr/bin/awk
awk "{print \$3}"
2⤵
- Reads runtime system information
PID:1598

/bin/sed
sed "s/%//g"
2⤵
- Reads runtime system information
PID:1601

/usr/bin/awk
awk "{print \$1}"
2⤵
- Reads runtime system information
PID:1604

/usr/bin/awk
awk "{print \$2}"
2⤵
- Reads runtime system information
PID:1607

/usr/bin/awk
awk "{print \$3}"
2⤵
- Reads runtime system information
PID:1610

/bin/sed
sed "s/%//g"
2⤵
- Reads runtime system information
PID:1613

/usr/bin/awk
awk "{print \$NF\"分区 \" \"剩余空间\"\$(NF-2), \" 使用率\"\$(NF-1)}"
2⤵
- Reads runtime system information
PID:1619

/bin/sed
sed 1d
2⤵
- Reads runtime system information
PID:1618

/bin/grep
grep -v /boot
2⤵
PID:1617

/bin/grep
grep -v /var/lib/docker
2⤵
PID:1616

/bin/grep
grep -v tmpfs
2⤵
PID:1615

/bin/df
df -hP
2⤵
- Reads runtime system information
PID:1614

/bin/sed
sed "s/^[ \\t]*//g"
2⤵
- Reads runtime system information
PID:1624

/usr/bin/awk
awk "-F=" "{print \$2}"
2⤵
- Reads runtime system information
PID:1623

/bin/grep
grep mailroot
2⤵
PID:1622

/bin/cat
cat /usr/local/u-mail/config/custom.conf
2⤵
PID:1621

/usr/bin/awk
awk "{print\$1}"
2⤵
- Reads runtime system information
PID:1627

/usr/bin/du
du -sm /var/log
2⤵
PID:1626

/usr/bin/awk
awk "{print\$1}"
2⤵
- Reads runtime system information
PID:1630

/usr/bin/du
du -sm /usr/local/u-mail/log
2⤵
PID:1629

/usr/bin/awk
awk "{print \$NF}"
2⤵
- Reads runtime system information
PID:1634

/bin/grep
grep "^default"
2⤵
PID:1633

/usr/bin/head
head -n 1
2⤵
PID:1639

/usr/bin/awk
awk "{print \$2}"
2⤵
- Reads runtime system information
PID:1638

/bin/grep
grep inet
2⤵
PID:1637

/usr/bin/awk
awk "{print \$NF}"
2⤵
- Reads runtime system information
PID:1643

/bin/grep
grep "^default"
2⤵
PID:1642

/bin/grep
grep -Eo "([0-9]{1,3}\\.){3}[0-9]{1,3}"
2⤵
PID:1647

/bin/grep
grep default
2⤵
PID:1646

/sbin/ip
ip route
2⤵
PID:1645

/bin/grep
grep -Eo "([0-9]{1,3}\\.){3}[0-9]{1,3}"
2⤵
PID:1650

/bin/cat
cat /etc/resolv.conf
2⤵
PID:1649

/usr/bin/awk
awk "{print\$NF}"
2⤵
- Reads runtime system information
PID:1657

/bin/grep
grep IP
2⤵
PID:1656

/usr/bin/curl
curl -s cip.cc
2⤵
PID:1655

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads