cb55fa6572342241cc2c40a0c0ed26e2750d1ddc8f8c58a2e85266d7f51b9c15

Analysis

max time kernel
1s
max time network
128s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
22-05-2024 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

start.sh
Size

2KB
MD5

e8de2fd4cef85a80f236027638787b83
SHA1

92f5c8b7a44b97a30d6c675bf095875ca8e7f9c0
SHA256

cb55fa6572342241cc2c40a0c0ed26e2750d1ddc8f8c58a2e85266d7f51b9c15
SHA512

7d1bbd95432ea091aa7ef3653c7bede9f4ea9a713e4090acd631aaccfbc8deae612ccda3df17d6a1bf9c7de9081fa0417c5a761508b9099c6c2e2ba4b950e666

Score

3^/10

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/cmdline	snap
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/cmdline	snap
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/cmdline	snap
File opened for reading	/proc/cmdline	snap

Writes file to tmp directory 16 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.U6hqGD	apt
File opened for modification	/tmp/fileutl.message.UBLYvp	apt
File opened for modification	/tmp/fileutl.message.y0mRBe	apt
File opened for modification	/tmp/fileutl.message.4rlIuO	apt
File opened for modification	/tmp/fileutl.message.cd92Cc	apt
File opened for modification	/tmp/fileutl.message.Q4mDGN	apt
File opened for modification	/tmp/fileutl.message.EPR6xP	apt
File opened for modification	/tmp/fileutl.message.oTy0uq	apt
File opened for modification	/tmp/fileutl.message.iNHgu1	apt
File opened for modification	/tmp/fileutl.message.AkbLzB	apt
File opened for modification	/tmp/fileutl.message.sXsJtd	apt
File opened for modification	/tmp/fileutl.message.Al6xx0	apt
File opened for modification	/tmp/fileutl.message.m07zYQ	apt
File opened for modification	/tmp/fileutl.message.UEvxRr	apt
File opened for modification	/tmp/fileutl.message.kwMhL2	apt
File opened for modification	/tmp/fileutl.message.SLaRtC	apt

/tmp/start.sh
/tmp/start.sh
1⤵
PID:1525
- /usr/bin/apt
  apt install php -y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:1528
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1529
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1533
- - /bin/sh
    /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
    3⤵
    PID:1534
  - - /usr/bin/snap
      /usr/bin/snap advise-snap --from-apt
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:1535
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1543
- - /bin/sh
    /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
    3⤵
    PID:1544
  - - /usr/bin/snap
      /usr/bin/snap advise-snap --from-apt
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:1545
- - /bin/sh
    /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
    3⤵
    PID:1553
  - - /usr/bin/snap
      /usr/bin/snap advise-snap --from-apt
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:1554
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:1563
- - /bin/sh
    /bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
    3⤵
    PID:1567
  - - /usr/bin/snap
      /usr/bin/snap advise-snap --from-apt
      4⤵
      Enumerates kernel/hardware configuration
      Reads runtime system information
      PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/fileutl.message.m07zYQ

Filesize
235KB

MD5
373fe2f2ef99005d2550a482f09a3e51

SHA1
68e6572b55b1e77f7d171ebac7b2579b7a6bd51d

SHA256
7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5

SHA512
def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b

Download Submit