d347e32185478f56ce1c96e1e5dc3ad80ffdcf623036ca6750c60c6183a5c779

Analysis

max time kernel
2s
max time network
60s
platform
debian-12_armhf
resource
debian12-armhf-20240418-en
resource tags

arch:armhfimage:debian12-armhf-20240418-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
submitted
28/09/2024, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sex.sh
Size

1KB
MD5

884dc57dd0892038d53a2d4b017504df
SHA1

52ab9780591ee9718ce6188a9edafc1afa05dcdf
SHA256

d347e32185478f56ce1c96e1e5dc3ad80ffdcf623036ca6750c60c6183a5c779
SHA512

25e1afb67512005fecdf47712dfc1f0c74ecb221ed0f3904ff47f3ef30948334e31426003f6590c580024f758c7ab8576412a280b5f5ce3f787b6208037db3ca

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
723	chmod
740	chmod
747	chmod
794	chmod
714	chmod
731	chmod
754	chmod
762	chmod
769	chmod
775	chmod
784	chmod
790	chmod
801	chmod

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
719	mips
720	rm
726	mipsel
727	rm

/tmp/sex.sh
/tmp/sex.sh
1⤵
PID:705
- /usr/bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:714
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:719
- /usr/bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:720
- /usr/bin/chmod
  chmod +x mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:723
- /tmp/mipsel
  ./mipsel
  2⤵
  - System Network Configuration Discovery
  PID:726
- /usr/bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:727
- /usr/bin/chmod
  chmod +x sh4
  2⤵
  - File and Directory Permissions Modification
  PID:731
- /tmp/sh4
  ./sh4
  2⤵
  PID:735
- /usr/bin/rm
  rm -rf sh4
  2⤵
  PID:736
- /usr/bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:740
- /tmp/x86
  ./x86
  2⤵
  PID:742
- /usr/bin/rm
  rm -rf x86
  2⤵
  PID:744
- /usr/bin/chmod
  chmod +x arm61
  2⤵
  - File and Directory Permissions Modification
  PID:747
- /tmp/arm61
  ./arm61
  2⤵
  PID:750
- /usr/bin/rm
  rm -rf arm61
  2⤵
  PID:751
- /usr/bin/chmod
  chmod +x i686
  2⤵
  - File and Directory Permissions Modification
  PID:754
- /tmp/i686
  ./i686
  2⤵
  PID:757
- /usr/bin/rm
  rm -rf i686
  2⤵
  PID:758
- /usr/bin/chmod
  chmod +x ppc
  2⤵
  - File and Directory Permissions Modification
  PID:762
- /tmp/ppc
  ./ppc
  2⤵
  PID:765
- /usr/bin/rm
  rm -rf ppc
  2⤵
  PID:767
- /usr/bin/chmod
  chmod +x 586
  2⤵
  - File and Directory Permissions Modification
  PID:769
- /tmp/586
  ./586
  2⤵
  PID:770
- /usr/bin/rm
  rm -rf 586
  2⤵
  PID:772
- /usr/bin/chmod
  chmod +x m68k
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/m68k
  ./m68k
  2⤵
  PID:779
- /usr/bin/rm
  rm -rf m68k
  2⤵
  PID:780
- /usr/bin/chmod
  chmod +x dc
  2⤵
  - File and Directory Permissions Modification
  PID:784
- /tmp/dc
  ./dc
  2⤵
  PID:787
- /usr/bin/rm
  rm -rf dc
  2⤵
  PID:788
- /usr/bin/chmod
  chmod +x dss
  2⤵
  - File and Directory Permissions Modification
  PID:790
- /tmp/dss
  ./dss
  2⤵
  PID:791
- /usr/bin/rm
  rm -rf dss
  2⤵
  PID:792
- /usr/bin/chmod
  chmod +x co
  2⤵
  - File and Directory Permissions Modification
  PID:794
- /tmp/co
  ./co
  2⤵
  PID:796
- /usr/bin/rm
  rm -rf co
  2⤵
  PID:798
- /usr/bin/chmod
  chmod +x scar
  2⤵
  - File and Directory Permissions Modification
  PID:801
- /tmp/scar
  ./scar
  2⤵
  PID:802
- /usr/bin/rm
  rm -rf scar
  2⤵
  PID:803

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads