29095ae1431f6c1f158fdd6976c5505df56bc0a31bc05d0ccb6bb591ed48e0ac

Resubmissions

23/07/2024, 21:32

240723-1d16aazdjk 1

23/07/2024, 21:32

240723-1dsh5ssgkh 6

23/07/2024, 21:10

240723-z1hrsasakd 1

Analysis

max time kernel
596s
max time network
598s
platform
ubuntu-22.04_amd64
resource
ubuntu2204-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2204-amd64-20240611-enkernel:5.15.0-105-genericlocale:en-usos:ubuntu-22.04-amd64system
submitted
23/07/2024, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gosh/go
Size

868B
MD5

0dc890627d049393e848d9d2f9aeab0e
SHA1

cd96f6776ca92377ab0a77dc5fe34ae1fead1798
SHA256

09088269595f513a22e9abfc122e25be31fd05291980f300528570423484ffbc
SHA512

1814a4d026a98a9702161859e4b911751e35005f6720f423583ccfba6ca9549cc861ebc57cac7df9c3013f5337af3f94be0cec75da3006fd5e727794560ddaf5

Score

6^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[migration/1]	1570	perl

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

description	ioc	Process
File opened for reading	/proc/self/maps	grep

Writes file to tmp directory 1 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/gosh/mfu.txt	go

/tmp/gosh/go
/tmp/gosh/go
1⤵
- Writes file to tmp directory
PID:1569
- /usr/bin/perl
  perl common
  2⤵
  - Changes its process name
  PID:1570
- /usr/bin/rm
  rm -rf common
  2⤵
  PID:1572
- /tmp/gosh/ss
  ./ss 22 -a -i eth0 -s 10
  2⤵
  PID:1573
- /usr/bin/uniq
  uniq
  2⤵
  PID:1576
- /usr/bin/sort
  sort
  2⤵
  PID:1575
- /usr/bin/cat
  cat bios.txt
  2⤵
  PID:1574
- /usr/bin/grep
  grep -c . mfu.txt
  2⤵
  - Reads runtime system information
  PID:1577
- /usr/bin/sleep
  sleep 5
  2⤵
  PID:1578
- /tmp/gosh/bash
  bash 400
  2⤵
  PID:1588
- /usr/bin/sleep
  sleep 15
  2⤵
  PID:1589
- /usr/bin/rm
  rm -rf mfu.txt bios.txt
  2⤵
  PID:1590

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...