fb8078997d6da092759d88b428f48d878d8ea43eaa244bbe3679f197bdbd6b01

Analysis

max time kernel
43s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
01-07-2024 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

requiremetns.sh
Size

8KB
MD5

881149037815f5f9d7cf7f44ac19ddc5
SHA1

b2a727881e910bdc50069c21e138f6ccd897aa9f
SHA256

fb8078997d6da092759d88b428f48d878d8ea43eaa244bbe3679f197bdbd6b01
SHA512

f4f7685745415555f60f408b3b2a7b351b9f113f53b1e6ffbc50d416fe068c9747100955e2455e67d7b98dc92fca56bcebcbca59751d7cbce60534b336aacc01
SSDEEP

192:/Fa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:/EHexC+HSAHE3YUN+TC8SbmQUfd

Score

4^/10

antivm

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
antivm

Virtualization/Sandbox Evasion
T1497

Processes:

https

description ioc process

File opened for reading /proc/cpuinfo https

description	ioc	process
File opened for reading	/proc/cpuinfo	https

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

Processes:

aptdpkghttpsdpkgdpkgaptdpkg

description	ioc	process
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/sys/crypto/fips_enabled	https
File opened for reading	/proc/self/auxv	https
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/filesystems	dpkg

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

Processes:

aptapt

description	ioc	process
File opened for modification	/tmp/fileutl.message.C24xti	apt
File opened for modification	/tmp/fileutl.message.TyuMwk	apt
File opened for modification	/tmp/fileutl.message.bzMH4D	apt
File opened for modification	/tmp/fileutl.message.JBlXb9	apt
File opened for modification	/tmp/fileutl.message.5vHenM	apt
File opened for modification	/tmp/fileutl.message.hbuIri	apt
File opened for modification	/tmp/fileutl.message.Ox64Wj	apt
File opened for modification	/tmp/fileutl.message.s9jfFQ	apt
File opened for modification	/tmp/fileutl.message.Plqgvl	apt
File opened for modification	/tmp/fileutl.message.Dc3a2f	apt
File opened for modification	/tmp/fileutl.message.U2X0uv	apt

/tmp/requiremetns.sh
/tmp/requiremetns.sh
1⤵
PID:666

/usr/bin/apt
apt update
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:674

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
- Reads runtime system information
PID:676

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
PID:683

/usr/lib/apt/methods/https
/usr/lib/apt/methods/https
3⤵
PID:686

/usr/lib/apt/methods/https
/usr/lib/apt/methods/https
3⤵
- Checks CPU configuration
- Reads runtime system information
PID:693

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
PID:695

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
- Reads runtime system information
PID:700

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
- Reads runtime system information
PID:713

/usr/bin/apt
apt install curl nano sudo neofetch -y
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:714

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
- Reads runtime system information
PID:716

/usr/bin/cut
cut -f1 -d.
2⤵
PID:719

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads