Analysis

  • max time kernel
    0s
  • max time network
    131s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    23/05/2024, 13:11

General

  • Target

    cron.sh

  • Size

    1KB

  • MD5

    84d382582ecd4c28eb11e72228b75d2d

  • SHA1

    d8ebe4e23c704d21a0ce974f91e7e74c6fa793a2

  • SHA256

    d449ec4359cb09e59731c3bf998c971a601f1fdd2159e70aff6c82153ada6e8b

  • SHA512

    544a76c5cd836f6321e448e62c732280ed4db63468b3dae517b0fb4a10abd3b7ea42dd1f75d3822ad7187073d6166e38bc58906553fdc4c9aa03a89217a675cc

Score
6/10

Malware Config

Signatures

  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Reads CPU attributes 1 TTPs 1 IoCs
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/cron.sh
    /tmp/cron.sh
    1⤵
      PID:1525
      • /usr/bin/which
        which php
        2⤵
          PID:1526
        • /bin/sed
          sed "s/cron\\.sh//g"
          2⤵
            PID:1529
          • /usr/bin/expr
            expr index cron.php /
            2⤵
              PID:1530
            • /bin/grep
              grep -v grep
              2⤵
                PID:1533
              • /bin/grep
                grep /tmp/cron.php
                2⤵
                  PID:1532
                • /bin/ps
                  ps auxwww
                  2⤵
                  • Reads CPU attributes
                  • Reads runtime system information
                  PID:1531
              • /tmp/cron.php
                /tmp/cron.php
                1⤵
                  PID:1534

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads