Overview

overview

6

Static

static

1

sniff/.etc...ey.pub

windows7-x64

4

sniff/.etc...ey.pub

windows10-2004-x64

3

sniff/.etc...ey.pub

windows7-x64

4

sniff/.etc...ey.pub

windows10-2004-x64

3

sniff/.etc...ey.pub

windows7-x64

4

sniff/.etc...ey.pub

windows10-2004-x64

3

sniff/.etc...ey.pub

windows7-x64

4

sniff/.etc...ey.pub

windows10-2004-x64

3

sniff/.etc...ey.pub

windows7-x64

4

sniff/.etc...ey.pub

windows10-2004-x64

3

sniff/.etc...ey.pub

windows7-x64

4

sniff/.etc...ey.pub

windows10-2004-x64

3

sniff/.g/ln.sh

ubuntu-18.04-amd64

3

sniff/.g/ln.sh

debian-9-armhf

1

sniff/.g/ln.sh

debian-9-mips

sniff/.g/ln.sh

debian-9-mipsel

sniff/.g/max.sh

ubuntu-18.04-amd64

6

sniff/.g/max.sh

debian-9-armhf

1

sniff/.g/max.sh

debian-9-mips

sniff/.g/max.sh

debian-9-mipsel

sniff/.g/x64

ubuntu-20.04-amd64

1

sniff/.g/x86.sh

ubuntu-22.04-amd64

sniff/.g/xcron/sh64

ubuntu-24.04-amd64

1

sniff/.g/xcron/sh86

ubuntu-22.04-amd64

sniff/.g/x...ron.sh

ubuntu-18.04-amd64

1

sniff/.g/x...ron.sh

debian-9-armhf

1

sniff/.g/x...ron.sh

debian-9-mips

sniff/.g/x...ron.sh

debian-9-mipsel

sniff/03jf.txt

ubuntu-18.04-amd64

1

sniff/03jf.txt

debian-9-armhf

1

sniff/03jf.txt

debian-9-mips

sniff/03jf.txt

debian-9-mipsel

Analysis

  • max time kernel
    0s
  • max time network
    130s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240611-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    11/06/2024, 22:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sniff/.g/ln.sh
  • Size 417B
  • Sample240611-2tlk7svfle
  • SHA256 267e645cc707c78039866cd189feb8c2854136e01d98065b65cef39874ac108d
  • MD5 SHA1 SHA512
Score
3/10

Malware Config

Signatures

  • Reads runtime system information 1 IoCs

    Reads data from /proc virtual filesystem.

  • Writes file to tmp directory 10 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/sniff/.g/ln.sh
    /tmp/sniff/.g/ln.sh
    1⤵
      PID:1522
      • /bin/mkdir
        mkdir /tmp/ln
        2⤵
        • Reads runtime system information
        PID:1523
      • /bin/ln
        ln /bin/ping /tmp/ln/target
        2⤵
          PID:1524
        • /bin/rm
          rm -rf /tmp/ln/
          2⤵
            PID:1525
          • /usr/bin/gcc
            gcc -w -fPIC -shared -o /tmp/ln x.c
            2⤵
            • Writes file to tmp directory
            PID:1526
            • /usr/lib/gcc/x86_64-linux-gnu/7/cc1
              /usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu x.c -quiet -dumpbase x.c "-mtune=generic" "-march=x86-64" -auxbase x -w -fPIC -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccI2BVA8.s
              3⤵
              • Writes file to tmp directory
              PID:1527
            • /usr/local/sbin/as
              as -W --64 -o /tmp/ccwO6xAI.o /tmp/ccI2BVA8.s
              3⤵
                PID:1528
              • /usr/local/bin/as
                as -W --64 -o /tmp/ccwO6xAI.o /tmp/ccI2BVA8.s
                3⤵
                  PID:1528
                • /usr/sbin/as
                  as -W --64 -o /tmp/ccwO6xAI.o /tmp/ccI2BVA8.s
                  3⤵
                    PID:1528
                  • /usr/bin/as
                    as -W --64 -o /tmp/ccwO6xAI.o /tmp/ccI2BVA8.s
                    3⤵
                    • Writes file to tmp directory
                    PID:1528
                  • /usr/lib/gcc/x86_64-linux-gnu/7/collect2
                    /usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccUPWjCi.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -shared -z relro -o /tmp/ln /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccwO6xAI.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
                    3⤵
                    • Writes file to tmp directory
                    PID:1529
                    • /usr/bin/ld
                      /usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so "-plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper" "-plugin-opt=-fresolution=/tmp/ccUPWjCi.res" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" "-plugin-opt=-pass-through=-lc" "-plugin-opt=-pass-through=-lgcc" "-plugin-opt=-pass-through=-lgcc_s" --build-id --eh-frame-hdr -m elf_x86_64 "--hash-style=gnu" --as-needed -shared -z relro -o /tmp/ln /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/ccwO6xAI.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o
                      4⤵
                      • Writes file to tmp directory
                      PID:1530
              • /proc/self/fd/3
                /proc/self/fd/3
                1⤵
                  PID:1522

                Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      ccI2BVA8.s
                      • Path /tmp/ccI2BVA8.s
                      • Size 557B
                      • SHA256 ddd3c42ddf61409b34f849143bd833f38984bc6f7bc4f5373ec06bf5c0dacde2
                      • MD5 SHA1 SHA512
                      Submit Download

                      ccwO6xAI.o
                      • Path /tmp/ccwO6xAI.o
                      • Size 1KB
                      • SHA256 ae6e0f20933bfd8c07c29f349f47760afa68a7e575ded8edd131338f66ad0a53
                      • MD5 SHA1 SHA512
                      Submit Download

                      ln
                      • Path /tmp/ln
                      • Size 7KB
                      • SHA256 a2c7228da26a81a55b27a422ed2c65affb6db1ee85dc31fa567114b04aead636
                      • MD5 SHA1 SHA512 SSDEEP
                      Submit Download