Overview

overview

7

Static

static

1

net.sh

ubuntu-18.04-amd64

7

net.sh

debian-9-armhf

1

net.sh

debian-9-mips

net.sh

debian-9-mipsel

Sharing

Copy URL
Twitter E-mail

General

  • Target

    net.sh

  • Size

    3KB

  • Sample

    240525-ntqchafe93

  • MD5

    ee7cbe65a1c87663a1f3171c129c3f7b

  • SHA1

    28a488f6de0ebd2284134119d7921c39fb7297af

  • SHA256

    7aa119d7971e575bb3674e91f421ea2fb33f91fc26f4e945f1c1a92fa994e7c3

  • SHA512

    b28a5c45ae2de0775c4b19063812575fe1cb0abe14069870cb4455c388b222e1412f5988fa1e3687059441f0ebc5297b20c0f8c82587069da6796957496d6e9b

Score
7/10
antivmlinuxrootkit

Malware Config

Targets

    • Target

      net.sh

    • Size

      3KB

    • MD5

      ee7cbe65a1c87663a1f3171c129c3f7b

    • SHA1

      28a488f6de0ebd2284134119d7921c39fb7297af

    • SHA256

      7aa119d7971e575bb3674e91f421ea2fb33f91fc26f4e945f1c1a92fa994e7c3

    • SHA512

      b28a5c45ae2de0775c4b19063812575fe1cb0abe14069870cb4455c388b222e1412f5988fa1e3687059441f0ebc5297b20c0f8c82587069da6796957496d6e9b

    Score
    7/10
    antivmrootkit

    • Loads a kernel module

      Loads a Linux kernel module, potentially to achieve persistence

      rootkit

    • Checks hardware identifiers (DMI)

      Checks DMI information which indicate if the system is a virtual machine.

      antivm
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks