86d41ab47eb057f493046468e45e1590b815eb69e5d3d459d8283aec770ada55

Analysis

max time kernel
148s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
24/05/2024, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

oneclient-2102.sh
Size

5KB
MD5

0f965827f49e64c9090d34cf084965de
SHA1

b6d0b481ccecb1468a95f8440241c6467485bdfa
SHA256

86d41ab47eb057f493046468e45e1590b815eb69e5d3d459d8283aec770ada55
SHA512

8348fd4bd02577b4f7fcb0b8432f9222ee3f9b3d318ea6e90b66385b3ae533b8ae04202a350c043e4ce6e20fe3f0802a12d00bd2c1d5ae62037a6882fcecafaa
SSDEEP

96:3aKWUTvKxpbtoD/NyfLiL6JdE3IBT5g9ZBAvRwoPRP3LMD:GaSxzoD/NyjiL6RhYD

Score

3^/10

Malware Config

Signatures

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	find
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/self/fd	apt-config
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	sed

Writes file to tmp directory 12 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/gpg.1.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/gpgoutput.log	apt-key
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/.#lk0x000055711265f600.ubuntu1804-amd64-20240508-en-6.1544	gpg
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/trustdb.gpg	gpg
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/.#lk0x000055723f7ac500.ubuntu1804-amd64-20240508-en-6.1547	gpg
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/pubring.kbx	gpg
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg	apt-key
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/gpg.0.sh	apt-key
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/empty.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/.#lk0x0000557112660090.ubuntu1804-amd64-20240508-en-6.1544	gpg
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg	touch
File opened for modification	/tmp/apt-key-gpghome.rmFjsu29QK/pubring.orig.gpg	cp

/tmp/oneclient-2102.sh
/tmp/oneclient-2102.sh
1⤵
PID:1496
- /bin/uname
  uname -m
  2⤵
  PID:1497
- /usr/bin/id
  id -un
  2⤵
  - Reads runtime system information
  PID:1499
- /usr/bin/rev
  rev
  2⤵
  PID:1505
- /usr/bin/cut
  cut -c 2-
  2⤵
  PID:1504
- /usr/bin/rev
  rev
  2⤵
  PID:1503
- /usr/bin/tr
  tr "\\n" -
  2⤵
  PID:1502
- /usr/bin/lsb_release
  lsb_release -sic
  2⤵
  PID:1501
- /usr/bin/tr
  tr "[:upper:]" "[:lower:]"
  2⤵
  PID:1508
- /bin/sh
  sh -c "curl -sSL http://packages.onedata.org/onedata.gpg.key | apt-key add -"
  2⤵
  PID:1509
- - /usr/bin/apt-key
    apt-key add -
    3⤵
    - Writes file to tmp directory
    PID:1511
  - - /usr/bin/apt-config
      apt-config shell MASTER_KEYRING APT::Key::MasterKeyring
      4⤵
      Reads runtime system information
      PID:1513
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1514
  - - /usr/bin/apt-config
      apt-config shell ARCHIVE_KEYRING APT::Key::ArchiveKeyring
      4⤵
      Reads runtime system information
      PID:1516
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1521
  - - /usr/bin/apt-config
      apt-config shell REMOVED_KEYS APT::Key::RemovedKeys
      4⤵
      Reads runtime system information
      PID:1524
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1525
  - - /usr/bin/apt-config
      apt-config shell ARCHIVE_KEYRING_URI APT::Key::ArchiveKeyringURI
      4⤵
      Reads runtime system information
      PID:1526
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1527
  - - /usr/bin/apt-config
      apt-config shell TRUSTEDFILE Apt::GPGV::TrustedKeyring
      4⤵
      Reads runtime system information
      PID:1528
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1529
  - - /usr/bin/apt-config
      apt-config shell TRUSTEDFILE Dir::Etc::Trusted/f
      4⤵
      Reads runtime system information
      PID:1530
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1531
  - - /usr/bin/apt-config
      apt-config shell GPG_EXE Apt::Key::gpgcommand
      4⤵
      Reads runtime system information
      PID:1533
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1534
  - - /bin/mktemp
      mktemp --directory --tmpdir apt-key-gpghome.XXXXXXXXXX
      4⤵
      PID:1535
  - - /bin/chmod
      chmod 700 /tmp/apt-key-gpghome.rmFjsu29QK
      4⤵
      PID:1536
  - - /bin/sed
      sed -e "s#'#'\"'\"'#g"
      4⤵
      Reads runtime system information
      PID:1539
  - - /bin/sed
      sed -e "s#'#'\"'\"'#g"
      4⤵
      Reads runtime system information
      PID:1542
  - - /usr/bin/touch
      touch /tmp/apt-key-gpghome.rmFjsu29QK/empty.gpg
      4⤵
      Writes file to tmp directory
      PID:1543
  - - /usr/bin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.rmFjsu29QK --quiet --check-trustdb --keyring /tmp/apt-key-gpghome.rmFjsu29QK/empty.gpg
      4⤵
      Writes file to tmp directory
      PID:1544
  - - /bin/sh
      sh /tmp/apt-key-gpghome.rmFjsu29QK/gpg.0.sh --batch --import
      4⤵
      PID:1547
  - - /usr/local/sbin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.rmFjsu29QK --no-auto-check-trustdb --trust-model always --batch --import
      4⤵
      PID:1547
  - - /usr/local/bin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.rmFjsu29QK --no-auto-check-trustdb --trust-model always --batch --import
      4⤵
      PID:1547
  - - /usr/sbin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.rmFjsu29QK --no-auto-check-trustdb --trust-model always --batch --import
      4⤵
      PID:1547
  - - /usr/bin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.rmFjsu29QK --no-auto-check-trustdb --trust-model always --batch --import
      4⤵
      Writes file to tmp directory
      PID:1547
  - - /usr/bin/id
      id -u
      4⤵
      Reads runtime system information
      PID:1548
  - - /bin/readlink
      readlink -f /tmp/apt-key-gpghome.rmFjsu29QK
      4⤵
      PID:1549
  - - /bin/rm
      rm -f /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg
      4⤵
      PID:1550
  - - /usr/bin/touch
      touch /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg
      4⤵
      Writes file to tmp directory
      PID:1551
  - - /usr/bin/apt-config
      apt-config shell TRUSTEDPARTS Dir::Etc::TrustedParts/d
      4⤵
      Reads runtime system information
      PID:1552
    - - /usr/bin/dpkg
        
        /usr/bin/dpkg --print-foreign-architectures
        5⤵
        Reads runtime system information
        
        PID:1553
  - - /bin/readlink
      readlink -f /etc/apt/trusted.gpg.d/
      4⤵
      PID:1554
  - - /usr/bin/find
      find /etc/apt/trusted.gpg.d -mindepth 1 -maxdepth 1 "(" -name "*.gpg" -o -name "*.asc" ")"
      4⤵
      Reads runtime system information
      PID:1555
  - - /usr/bin/sort
      sort
      4⤵
      PID:1558
  - - /usr/bin/cmp
      cmp --silent "--bytes=1" - /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-archive.gpg
      4⤵
      PID:1560
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-archive.gpg
      4⤵
      PID:1562
  - - /usr/bin/cmp
      cmp --silent "--bytes=1" - /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg
      4⤵
      PID:1564
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg
      4⤵
      PID:1566
  - - /usr/bin/cmp
      cmp --silent "--bytes=1" - /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg
      4⤵
      PID:1568
  - - /bin/cat
      cat /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg
      4⤵
      PID:1570
  - - /bin/cp
      cp -a /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg /tmp/apt-key-gpghome.rmFjsu29QK/pubring.orig.gpg
      4⤵
      Reads runtime system information
      Writes file to tmp directory
      PID:1571
  - - /bin/sed
      sed -e "s#'#'\"'\"'#g"
      4⤵
      Reads runtime system information
      PID:1574
  - - /bin/sed
      sed -e "s#'#'\"'\"'#g"
      4⤵
      Reads runtime system information
      PID:1577
  - - /bin/sh
      sh /tmp/apt-key-gpghome.rmFjsu29QK/gpg.1.sh --quiet --batch --import -
      4⤵
      PID:1578
  - - /usr/local/sbin/sh
      sh /tmp/apt-key-gpghome.rmFjsu29QK/gpg.0.sh --keyring /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg --quiet --batch --import -
      4⤵
      PID:1578
  - - /usr/local/bin/sh
      sh /tmp/apt-key-gpghome.rmFjsu29QK/gpg.0.sh --keyring /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg --quiet --batch --import -
      4⤵
      PID:1578
  - - /usr/sbin/sh
      sh /tmp/apt-key-gpghome.rmFjsu29QK/gpg.0.sh --keyring /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg --quiet --batch --import -
      4⤵
      PID:1578
  - - /usr/bin/sh
      sh /tmp/apt-key-gpghome.rmFjsu29QK/gpg.0.sh --keyring /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg --quiet --batch --import -
      4⤵
      PID:1578
  - - /sbin/sh
      sh /tmp/apt-key-gpghome.rmFjsu29QK/gpg.0.sh --keyring /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg --quiet --batch --import -
      4⤵
      PID:1578
  - - /bin/sh
      sh /tmp/apt-key-gpghome.rmFjsu29QK/gpg.0.sh --keyring /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg --quiet --batch --import -
      4⤵
      PID:1578
  - - /usr/local/sbin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.rmFjsu29QK --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg --quiet --batch --import -
      4⤵
      PID:1578
  - - /usr/local/bin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.rmFjsu29QK --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg --quiet --batch --import -
      4⤵
      PID:1578
  - - /usr/sbin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.rmFjsu29QK --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg --quiet --batch --import -
      4⤵
      PID:1578
  - - /usr/bin/gpg
      gpg --ignore-time-conflict --no-options --no-default-keyring --homedir /tmp/apt-key-gpghome.rmFjsu29QK --no-auto-check-trustdb --trust-model always --keyring /tmp/apt-key-gpghome.rmFjsu29QK/pubring.gpg --quiet --batch --import -
      4⤵
      PID:1578
- - /usr/bin/curl
    curl -sSL http://packages.onedata.org/onedata.gpg.key
    3⤵
    PID:1510

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/apt-key-gpghome.rmFjsu29QK/.#lk0x000055711265f600.ubuntu1804-amd64-20240508-en-6.1544

Filesize
42B

MD5
2ce53448dd62d90c75fa9469388a1f64

SHA1
d20ecd66eff475f2231b6281f6aa083be14c6bcf

SHA256
d3e0abe0a49b3f47e8efe6493b57ae9e1ba8bb7a15332dd87fdbcc27227a721d

SHA512
98caa0ec1f36469522a50ceb501f4381a39a26beeae09fe6cfd9b7485a164b518cf39cb3294c24df15a2ec47ac10bfa18b634869ba2816391124640bc6d739d6

Download Submit
/tmp/apt-key-gpghome.rmFjsu29QK/.#lk0x000055723f7ac500.ubuntu1804-amd64-20240508-en-6.1547

Filesize
42B

MD5
1c2d99e312d817076ebc556423949289

SHA1
108d960a4c1bf66be9b807626a5bf9866e4485ec

SHA256
2c475bba76b82c157f820b0b0593d8abc586eb8362632f48484d77520d70903e

SHA512
998cfe93e5ebe4b220bc2584b13d037b21c54a5c75816111f1baa2a99a5ef05b4d3511c377c928e7f783750a4bacb64d72d3603ebfbba3d23fd0a671ebda47d5

Download Submit
/tmp/apt-key-gpghome.rmFjsu29QK/gpg.0.sh

Filesize
174B

MD5
970906d85ee13a0382d707ad170cf178

SHA1
f7aa24490eb59c095267243d30af107ab1ce84c4

SHA256
2286acecb137946067e6c580a58cb99925e031a61a131b2c6400315ac57784f3

SHA512
ca987dd277988046a49fa2f55dbde5c79a94cca8acdf9f5add5a6314e9108f6b933431153bbeac5a468710c335bf0cb28664ddf6fce584122d4615d453c4b382

Download Submit
/tmp/apt-key-gpghome.rmFjsu29QK/gpg.1.sh

Filesize
122B

MD5
b199f3a8f6858b4bc4b2da1d630e404c

SHA1
f16ac40e2c0d083592d161c4cdc6cdd5e1954c65

SHA256
cf1ea74f5772a39078fcc03120769b963012acef3b02eeb3e2427d74154cead1

SHA512
c46bc89443dd74d38b7d7cbb74873a40d5e4f202d039c28e886439d16a08a849da2ed6effd279c9009673063e41b32c79dfa7564178b845effc9df0798b7ba28

Download Submit
/tmp/apt-key-gpghome.rmFjsu29QK/pubring.orig.gpg

Filesize
7KB

MD5
b3bf35c5e796db394a50f96b908b690f

SHA1
b1e90de4d9d88bac6c67926c0ff6263e3ef7c2d2

SHA256
cf419d6c58bea5f2586043ecbad4c44f27d6f6060e5be19993b857105a5be094

SHA512
a97f8881c83ddc681623e4f503f8f758afe85ae6c34e2339a635e9521ae1303aebb90a6bef7c1136b6bd2b7418facacf98643f24e8bb40f1f93fb8a8ef714a96

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads