a6d82ccd29931ca47fccc01938d2a82df97f0592bd421b9d8e5a9a2c526ac8fc

Analysis

max time kernel
149s
max time network
130s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23-05-2024 12:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bt.sh
Size

24KB
MD5

29f1bd3fdd20dc611a3d962cdc22e91e
SHA1

92ec0b436fc0f34201ccb3f4bda75f82e399a963
SHA256

a6d82ccd29931ca47fccc01938d2a82df97f0592bd421b9d8e5a9a2c526ac8fc
SHA512

33c50f505f847921186adb6809e9fb14509aab934e5a76e068d10220f57b37aee92b5b8fa3c21f87178b248c2b0dce43c50b46aa2945997c3da3ce274c9df69c
SSDEEP

768:6JM1OGp112EWgOWsWbYRs/TPk0sl/g/N3xGH:UM1OGp11PWTWsWkRs/TPk0sl/g/N3xGH

Score

4^/10

antivm

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

cat

description ioc process

File opened for reading /proc/cpuinfo cat

description	ioc	process
File opened for reading	/proc/cpuinfo	cat

/tmp/bt.sh
/tmp/bt.sh
1⤵
PID:1497

/usr/bin/whoami
whoami
2⤵
PID:1498

/usr/bin/getconf
getconf LONG_BIT
2⤵
PID:1499

/usr/bin/wc
wc -l
2⤵
PID:1503

/bin/grep
grep processor
2⤵
PID:1502

/bin/cat
cat /proc/cpuinfo
2⤵
- Checks CPU configuration
PID:1501

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads