fb8078997d6da092759d88b428f48d878d8ea43eaa244bbe3679f197bdbd6b01

Analysis

max time kernel
43s
max time network
10s
platform
debian-9_armhf
resource
debian9-armhf-20240611-en
resource tags

arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
01-07-2024 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

requiremetns.sh
Size

8KB
MD5

881149037815f5f9d7cf7f44ac19ddc5
SHA1

b2a727881e910bdc50069c21e138f6ccd897aa9f
SHA256

fb8078997d6da092759d88b428f48d878d8ea43eaa244bbe3679f197bdbd6b01
SHA512

f4f7685745415555f60f408b3b2a7b351b9f113f53b1e6ffbc50d416fe068c9747100955e2455e67d7b98dc92fca56bcebcbca59751d7cbce60534b336aacc01
SSDEEP

192:/Fa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:/EHexC+HSAHE3YUN+TC8SbmQUfd

Score

4^/10

antivm

Malware Config

Signatures

Checks CPU configuration 1 TTPs 1 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened for reading	/proc/cpuinfo	https

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/sys/crypto/fips_enabled	https
File opened for reading	/proc/self/auxv	https
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/filesystems	dpkg

Writes file to tmp directory 11 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.C24xti	apt
File opened for modification	/tmp/fileutl.message.TyuMwk	apt
File opened for modification	/tmp/fileutl.message.bzMH4D	apt
File opened for modification	/tmp/fileutl.message.JBlXb9	apt
File opened for modification	/tmp/fileutl.message.5vHenM	apt
File opened for modification	/tmp/fileutl.message.hbuIri	apt
File opened for modification	/tmp/fileutl.message.Ox64Wj	apt
File opened for modification	/tmp/fileutl.message.s9jfFQ	apt
File opened for modification	/tmp/fileutl.message.Plqgvl	apt
File opened for modification	/tmp/fileutl.message.Dc3a2f	apt
File opened for modification	/tmp/fileutl.message.U2X0uv	apt

/tmp/requiremetns.sh
/tmp/requiremetns.sh
1⤵
PID:666
- /usr/bin/apt
  apt update
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:674
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:676
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:683
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    PID:686
- - /usr/lib/apt/methods/https
    /usr/lib/apt/methods/https
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:693
- - /usr/lib/apt/methods/http
    /usr/lib/apt/methods/http
    3⤵
    PID:695
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:700
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:713
- /usr/bin/apt
  apt install curl nano sudo neofetch -y
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  PID:714
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:716
- /usr/bin/cut
  cut -f1 -d.
  2⤵
  PID:719

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads