465b70e021acdc1da63fd940d99dc1849c62842855e9b056c01bef13d845c8fc | Triage™

Analysis

max time kernel
145s
max time network
132s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
11/06/2024, 22:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sniff/.g/max.sh
Size 1KB
Sample240611-2tlk7svfle
SHA256 7982564b8f651cc5bc2aa0f74aaeda9c6f2ddaf2c6f6d56c80a7660b169c2688
MD5 585fbcdac59b609c99a7e754e9312c2e
SHA1 7dabd278f466ae65a10070a1782e399b30533b36
SHA512 187292192934b1bf8ec650f3f0e1f20696b0a2f9484f0b4a38cb662e12461fbe9d63f8c1c2e55fe81df6448778283d6f4b74c17d3d6c16ae2263f13b7e5ba8cd
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

Scheduled Task/Job

description	ioc	Process
File opened for modification	/etc/cron.d/1718139165	ping
File opened for modification	/etc/cron.d/1718139165	max.sh

Writes file to tmp directory 3 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/tmp.waG0oKyp5Y	mktemp
File opened for modification	/tmp/tmp.waG0oKyp5Y.sh	touch
File opened for modification	/tmp/tmp.waG0oKyp5Y.sh	max.sh

/tmp/sniff/.g/max.sh
/tmp/sniff/.g/max.sh
1⤵
- Creates/modifies Cron job
- Writes file to tmp directory
PID:1496
- /bin/date
  date "+%s"
  2⤵
  PID:1497
- /bin/mktemp
  mktemp
  2⤵
  - Writes file to tmp directory
  PID:1498
- /bin/rm
  rm -f /tmp/tmp.waG0oKyp5Y
  2⤵
  PID:1499
- /usr/bin/touch
  touch /tmp/tmp.waG0oKyp5Y.sh
  2⤵
  - Writes file to tmp directory
  PID:1500
- /usr/bin/which
  which perl
  2⤵
  PID:1501
- /bin/ping
  ping
  2⤵
  - Creates/modifies Cron job
  PID:1502
- /bin/chmod
  chmod 755 /tmp/tmp.waG0oKyp5Y.sh
  2⤵
  PID:1503
- /bin/sleep
  sleep 5
  2⤵
  PID:1504
- /bin/date
  date
  2⤵
  PID:1508
- /bin/sleep
  sleep 5
  2⤵
  PID:1509
- /bin/date
  date
  2⤵
  PID:1510
- /bin/sleep
  sleep 5
  2⤵
  PID:1511
- /bin/date
  date
  2⤵
  PID:1512
- /bin/sleep
  sleep 5
  2⤵
  PID:1513
- /bin/date
  date
  2⤵
  PID:1514
- /bin/sleep
  sleep 5
  2⤵
  PID:1515
- /bin/date
  date
  2⤵
  PID:1516
- /bin/sleep
  sleep 5
  2⤵
  PID:1517
- /bin/date
  date
  2⤵
  PID:1520
- /bin/sleep
  sleep 5
  2⤵
  PID:1521
- /bin/date
  date
  2⤵
  PID:1522
- /bin/sleep
  sleep 5
  2⤵
  PID:1523
- /bin/date
  date
  2⤵
  PID:1524
- /bin/sleep
  sleep 5
  2⤵
  PID:1525
- /bin/date
  date
  2⤵
  PID:1526
- /bin/sleep
  sleep 5
  2⤵
  PID:1527
- /bin/date
  date
  2⤵
  PID:1528
- /bin/sleep
  sleep 5
  2⤵
  PID:1529
- /bin/date
  date
  2⤵
  PID:1530
- /bin/sleep
  sleep 5
  2⤵
  PID:1531
- /bin/date
  date
  2⤵
  PID:1532
- /bin/sleep
  sleep 5
  2⤵
  PID:1533
- /bin/date
  date
  2⤵
  PID:1534
- /bin/sleep
  sleep 5
  2⤵
  PID:1535
- /bin/date
  date
  2⤵
  PID:1536
- /bin/sleep
  sleep 5
  2⤵
  PID:1537
- /bin/date
  date
  2⤵
  PID:1538
- /bin/sleep
  sleep 5
  2⤵
  PID:1539
- /bin/date
  date
  2⤵
  PID:1540
- /bin/sleep
  sleep 5
  2⤵
  PID:1541
- /bin/date
  date
  2⤵
  PID:1542
- /bin/sleep
  sleep 5
  2⤵
  PID:1543
- /bin/date
  date
  2⤵
  PID:1544
- /bin/sleep
  sleep 5
  2⤵
  PID:1545
- /bin/date
  date
  2⤵
  PID:1546
- /bin/sleep
  sleep 5
  2⤵
  PID:1547
- /bin/date
  date
  2⤵
  PID:1548
- /bin/sleep
  sleep 5
  2⤵
  PID:1549
- /bin/date
  date
  2⤵
  PID:1550
- /bin/sleep
  sleep 5
  2⤵
  PID:1551
- /bin/date
  date
  2⤵
  PID:1552
- /bin/sleep
  sleep 5
  2⤵
  PID:1553
- /bin/date
  date
  2⤵
  PID:1554
- /bin/sleep
  sleep 5
  2⤵
  PID:1555
- /bin/date
  date
  2⤵
  PID:1556
- /bin/sleep
  sleep 5
  2⤵
  PID:1557
- /bin/date
  date
  2⤵
  PID:1558
- /bin/sleep
  sleep 5
  2⤵
  PID:1559
- /bin/date
  date
  2⤵
  PID:1560
- /bin/sleep
  sleep 5
  2⤵
  PID:1561
- /bin/date
  date
  2⤵
  PID:1562
- /bin/sleep
  sleep 5
  2⤵
  PID:1563
- /bin/date
  date
  2⤵
  PID:1564
- /bin/sleep
  sleep 5
  2⤵
  PID:1565
- /bin/date
  date
  2⤵
  PID:1566
- /bin/sleep
  sleep 5
  2⤵
  PID:1567

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1718139165

Path /etc/cron.d/1718139165
Size 4B
SHA256 3188f48a4e4f5b2bbaaea2d40d2c14c6c0daf0b2f925b59b3dc743f9dc2671fc
MD5 f291d367434f7b2b8e4be91a02172034
SHA1 639ccbc79b0a339f0173e7ba079771521af5302d
SHA512 9d0e22b1c49d7bf17be1638f532222c96034dfcf729e7cd088e7ca627f8628db754b9ba0bb365e350dbe85122f008ee95693b1c8511da59ab25d82e9ad886313
MD5 SHA1 SHA512

Submit Download

1718139165

Path /etc/cron.d/1718139165
Size 48B
SHA256 3766f1c2e4659e101347c44aca6efd4e364b9111ed2346828c849b1040a38e07
MD5 c8f7378cde3730b26a61f36c31e7c6da
SHA1 48bdd548d889fbfbac66db5fb587020f34e209a0
SHA512 012e96fe17d5e308191a774f262b8f3cd40d07d9d4f46fb50b5f5ced31a9d41dd9f00b162bca7eab13c05214e5b010b70a10ccb084c059994f091ca372b3094f
MD5 SHA1 SHA512

Submit Download