fb8078997d6da092759d88b428f48d878d8ea43eaa244bbe3679f197bdbd6b01

General

Target

requiremetns.sh
Size

8KB
MD5

881149037815f5f9d7cf7f44ac19ddc5
SHA1

b2a727881e910bdc50069c21e138f6ccd897aa9f
SHA256

fb8078997d6da092759d88b428f48d878d8ea43eaa244bbe3679f197bdbd6b01
SHA512

f4f7685745415555f60f408b3b2a7b351b9f113f53b1e6ffbc50d416fe068c9747100955e2455e67d7b98dc92fca56bcebcbca59751d7cbce60534b336aacc01
SSDEEP

192:/Fa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:/EHexC+HSAHE3YUN+TC8SbmQUfd

Score

3^/10

Malware Config

Signatures

Enumerates kernel/hardware configuration 1 TTPs 4 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

System Information Discovery

T1082

Processes:

snapsnapsnapsnap

description	ioc	process
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap
File opened for reading	/sys/kernel/mm/transparent_hugepage/hpage_pmd_size	snap

Reads runtime system information 24 IoCs

Reads data from /proc virtual filesystem.

Processes:

aptsnapdpkgsystemctlaptdpkgsnapidsnapdpkgdpkgsnapdpkg

description	ioc	process
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/sys/kernel/osrelease	systemctl
File opened for reading	/proc/sys/kernel/ngroups_max	apt
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/cmdline	snap
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/cmdline	snap
File opened for reading	/proc/cmdline	snap
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/self/fd	apt
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/cgroups	snap
File opened for reading	/proc/cmdline	snap

Writes file to tmp directory 37 IoCs

Malware often drops required files in the /tmp directory.

Processes:

aptapt

description	ioc	process
File opened for modification	/tmp/fileutl.message.H428xq	apt
File opened for modification	/tmp/fileutl.message.MGcjTX	apt
File opened for modification	/tmp/fileutl.message.vCbOtv	apt
File opened for modification	/tmp/fileutl.message.VV9IW6	apt
File opened for modification	/tmp/fileutl.message.7deNm5	apt
File opened for modification	/tmp/fileutl.message.zGRZ7N	apt
File opened for modification	/tmp/fileutl.message.avcNGR	apt
File opened for modification	/tmp/fileutl.message.dSJrMR	apt
File opened for modification	/tmp/fileutl.message.nj6MPC	apt
File opened for modification	/tmp/fileutl.message.pya07D	apt
File opened for modification	/tmp/fileutl.message.SdRhPW	apt
File opened for modification	/tmp/fileutl.message.hU8S8U	apt
File opened for modification	/tmp/fileutl.message.PFPsSD	apt
File opened for modification	/tmp/fileutl.message.674jrc	apt
File opened for modification	/tmp/fileutl.message.BXicJh	apt
File opened for modification	/tmp/fileutl.message.kcC73p	apt
File opened for modification	/tmp/fileutl.message.XTHVkj	apt
File opened for modification	/tmp/fileutl.message.QQLya2	apt
File opened for modification	/tmp/fileutl.message.yTkC1i	apt
File opened for modification	/tmp/fileutl.message.yVozql	apt
File opened for modification	/tmp/fileutl.message.l3g2Ff	apt
File opened for modification	/tmp/fileutl.message.mSFkgH	apt
File opened for modification	/tmp/fileutl.message.KZlY7x	apt
File opened for modification	/tmp/fileutl.message.TamULF	apt
File opened for modification	/tmp/fileutl.message.YqvNBe	apt
File opened for modification	/tmp/fileutl.message.7p2qCm	apt
File opened for modification	/tmp/fileutl.message.4DWTsY	apt
File opened for modification	/tmp/fileutl.message.PikahK	apt
File opened for modification	/tmp/fileutl.message.9VPQbo	apt
File opened for modification	/tmp/fileutl.message.vY3N83	apt
File opened for modification	/tmp/fileutl.message.BvwJxb	apt
File opened for modification	/tmp/fileutl.message.VB7RkZ	apt
File opened for modification	/tmp/fileutl.message.XY69JD	apt
File opened for modification	/tmp/fileutl.message.9fRzTw	apt
File opened for modification	/tmp/fileutl.message.KxUgS8	apt
File opened for modification	/tmp/fileutl.message.ZcgsAP	apt
File opened for modification	/tmp/fileutl.message.HKpGvA	apt

/tmp/requiremetns.sh
/tmp/requiremetns.sh
1⤵
PID:1504

/usr/bin/apt
apt update
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:1505

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
- Reads runtime system information
PID:1506

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
PID:1508

/usr/lib/apt/methods/https
/usr/lib/apt/methods/https
3⤵
PID:1509

/bin/sh
sh -c "[ ! -e /run/systemd/system ] || [ \$(id -u) -ne 0 ] || systemctl start --no-block apt-news.service esm-cache.service || true"
3⤵
PID:1511

/usr/bin/id
id -u
4⤵
- Reads runtime system information
PID:1512

/bin/systemctl
systemctl start --no-block apt-news.service esm-cache.service
4⤵
- Reads runtime system information
PID:1513

/usr/lib/apt/methods/https
/usr/lib/apt/methods/https
3⤵
PID:1517

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
PID:1521

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
PID:1522

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
- Reads runtime system information
PID:1526

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
- Reads runtime system information
PID:1527

/usr/bin/apt
apt install curl nano sudo neofetch -y
2⤵
- Reads runtime system information
- Writes file to tmp directory
PID:1528

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
- Reads runtime system information
PID:1529

/usr/bin/dpkg
/usr/bin/dpkg --print-foreign-architectures
3⤵
- Reads runtime system information
PID:1530

/bin/sh
/bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
3⤵
PID:1531

/usr/bin/snap
/usr/bin/snap advise-snap --from-apt
4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1532

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
PID:1540

/bin/sh
/bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
3⤵
PID:1541

/usr/bin/snap
/usr/bin/snap advise-snap --from-apt
4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1542

/bin/sh
/bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
3⤵
PID:1550

/usr/bin/snap
/usr/bin/snap advise-snap --from-apt
4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1551

/usr/lib/apt/methods/http
/usr/lib/apt/methods/http
3⤵
PID:1559

/bin/sh
/bin/sh -c "[ ! -f /usr/bin/snap ] || /usr/bin/snap advise-snap --from-apt 2>/dev/null || true"
3⤵
PID:1563

/usr/bin/snap
/usr/bin/snap advise-snap --from-apt
4⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1564

/usr/bin/cut
cut -f1 -d.
2⤵
PID:1574

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads