Resubmissions

12-06-2024 17:05

240612-vmcamasdqh 6

12-06-2024 16:56

240612-vft7vsscma 7

12-06-2024 16:50

240612-vcjxqasbna 6

12-06-2024 16:40

240612-t6wb6swank 6

Analysis

  • max time kernel
    5s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20240508-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20240508-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    12-06-2024 16:40

General

  • Target

    sketchyorignorant-main/installpkg

  • Size

    16KB

  • MD5

    a1f7273c0e0d69ccdc1aef7e57fad3c5

  • SHA1

    c0d2cf7c86a7f0bd7adc78f9c0a26746acbfa57f

  • SHA256

    54da37eee240a97630e3601f8b426ce1063c13be7dea6df98846de60537be906

  • SHA512

    471ab52d851f107adca654c2f4708acddc35984aa845f583d3bae62af261d7c66c163e47a93c745a7d144585ab99dd49d14c536e7bc0b1812d2cf2ddca2f2a06

  • SSDEEP

    384:CrsCWSAoyz7VnwcCFE/seOHkcbcQcBFjZ/D:CYSA3ZChBcBFjd

Score
6/10

Malware Config

Signatures

  • Deletes log files 1 TTPs 6 IoCs

    Deletes log files on the system.

  • Reads runtime system information 7 IoCs

    Reads data from /proc virtual filesystem.

Processes

  • /tmp/sketchyorignorant-main/installpkg
    /tmp/sketchyorignorant-main/installpkg
    1⤵
      PID:1512
      • /bin/tar
        tar --version
        2⤵
        • Reads runtime system information
        PID:1513
      • /bin/sleep
        sleep 5
        2⤵
          PID:1514
        • /bin/rm
          rm -rf /var/log/packages
          2⤵
          • Deletes log files
          PID:1518
        • /bin/mkdir
          mkdir -p /var/log/packages
          2⤵
          • Reads runtime system information
          PID:1519
        • /bin/chmod
          chmod 755 /var/log/packages
          2⤵
            PID:1520
          • /bin/rm
            rm -rf /var/log/removed_packages
            2⤵
            • Deletes log files
            PID:1521
          • /bin/mkdir
            mkdir -p /var/log/removed_packages
            2⤵
            • Reads runtime system information
            PID:1522
          • /bin/chmod
            chmod 755 /var/log/removed_packages
            2⤵
              PID:1523
            • /bin/rm
              rm -rf /var/log/removed_scripts
              2⤵
              • Deletes log files
              PID:1524
            • /bin/mkdir
              mkdir -p /var/log/removed_scripts
              2⤵
              • Reads runtime system information
              PID:1525
            • /bin/chmod
              chmod 755 /var/log/removed_scripts
              2⤵
                PID:1526
              • /bin/rm
                rm -rf /var/log/scripts
                2⤵
                • Deletes log files
                PID:1527
              • /bin/mkdir
                mkdir -p /var/log/scripts
                2⤵
                • Reads runtime system information
                PID:1528
              • /bin/chmod
                chmod 755 /var/log/scripts
                2⤵
                  PID:1529
                • /bin/rm
                  rm -rf /var/log/setup
                  2⤵
                  • Deletes log files
                  PID:1530
                • /bin/mkdir
                  mkdir -p /var/log/setup
                  2⤵
                  • Reads runtime system information
                  PID:1531
                • /bin/chmod
                  chmod 755 /var/log/setup
                  2⤵
                    PID:1532
                  • /bin/rm
                    rm -rf /var/log/setup/tmp
                    2⤵
                    • Deletes log files
                    PID:1533
                  • /bin/mkdir
                    mkdir -p /var/log/setup/tmp
                    2⤵
                    • Reads runtime system information
                    PID:1534
                  • /bin/chmod
                    chmod 700 /var/log/setup/tmp
                    2⤵
                      PID:1535
                    • /bin/cat
                      cat
                      2⤵
                        PID:1536

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads