d347e32185478f56ce1c96e1e5dc3ad80ffdcf623036ca6750c60c6183a5c779

Analysis

max time kernel
4s
max time network
16s
platform
debian-12_mipsel
resource
debian12-mipsel-20240729-en
resource tags

arch:mipselimage:debian12-mipsel-20240729-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
submitted
28/09/2024, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sex.sh
Size

1KB
MD5

884dc57dd0892038d53a2d4b017504df
SHA1

52ab9780591ee9718ce6188a9edafc1afa05dcdf
SHA256

d347e32185478f56ce1c96e1e5dc3ad80ffdcf623036ca6750c60c6183a5c779
SHA512

25e1afb67512005fecdf47712dfc1f0c74ecb221ed0f3904ff47f3ef30948334e31426003f6590c580024f758c7ab8576412a280b5f5ce3f787b6208037db3ca

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 13 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
830	chmod
775	chmod
791	chmod
811	chmod
821	chmod
826	chmod
807	chmod
816	chmod
750	chmod
760	chmod
768	chmod
783	chmod
802	chmod

System Network Configuration Discovery 1 TTPs 4 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
763	mipsel
765	rm
753	mips
756	rm

/tmp/sex.sh
/tmp/sex.sh
1⤵
PID:744
- /usr/bin/chmod
  chmod +x mips
  2⤵
  - File and Directory Permissions Modification
  PID:750
- /tmp/mips
  ./mips
  2⤵
  - System Network Configuration Discovery
  PID:753
- /usr/bin/rm
  rm -rf mips
  2⤵
  - System Network Configuration Discovery
  PID:756
- /usr/bin/chmod
  chmod +x mipsel
  2⤵
  - File and Directory Permissions Modification
  PID:760
- /tmp/mipsel
  ./mipsel
  2⤵
  - System Network Configuration Discovery
  PID:763
- /usr/bin/rm
  rm -rf mipsel
  2⤵
  - System Network Configuration Discovery
  PID:765
- /usr/bin/chmod
  chmod +x sh4
  2⤵
  - File and Directory Permissions Modification
  PID:768
- /tmp/sh4
  ./sh4
  2⤵
  PID:770
- /usr/bin/rm
  rm -rf sh4
  2⤵
  PID:772
- /usr/bin/chmod
  chmod +x x86
  2⤵
  - File and Directory Permissions Modification
  PID:775
- /tmp/x86
  ./x86
  2⤵
  PID:778
- /usr/bin/rm
  rm -rf x86
  2⤵
  PID:779
- /usr/bin/chmod
  chmod +x arm61
  2⤵
  - File and Directory Permissions Modification
  PID:783
- /tmp/arm61
  ./arm61
  2⤵
  PID:787
- /usr/bin/rm
  rm -rf arm61
  2⤵
  PID:788
- /usr/bin/chmod
  chmod +x i686
  2⤵
  - File and Directory Permissions Modification
  PID:791
- /tmp/i686
  ./i686
  2⤵
  PID:794
- /usr/bin/rm
  rm -rf i686
  2⤵
  PID:797
- /usr/bin/chmod
  chmod +x ppc
  2⤵
  - File and Directory Permissions Modification
  PID:802
- /tmp/ppc
  ./ppc
  2⤵
  PID:804
- /usr/bin/rm
  rm -rf ppc
  2⤵
  PID:805
- /usr/bin/chmod
  chmod +x 586
  2⤵
  - File and Directory Permissions Modification
  PID:807
- /tmp/586
  ./586
  2⤵
  PID:808
- /usr/bin/rm
  rm -rf 586
  2⤵
  PID:809
- /usr/bin/chmod
  chmod +x m68k
  2⤵
  - File and Directory Permissions Modification
  PID:811
- /tmp/m68k
  ./m68k
  2⤵
  PID:812
- /usr/bin/rm
  rm -rf m68k
  2⤵
  PID:813
- /usr/bin/chmod
  chmod +x dc
  2⤵
  - File and Directory Permissions Modification
  PID:816
- /tmp/dc
  ./dc
  2⤵
  PID:817
- /usr/bin/rm
  rm -rf dc
  2⤵
  PID:818
- /usr/bin/chmod
  chmod +x dss
  2⤵
  - File and Directory Permissions Modification
  PID:821
- /tmp/dss
  ./dss
  2⤵
  PID:822
- /usr/bin/rm
  rm -rf dss
  2⤵
  PID:824
- /usr/bin/chmod
  chmod +x co
  2⤵
  - File and Directory Permissions Modification
  PID:826
- /tmp/co
  ./co
  2⤵
  PID:827
- /usr/bin/rm
  rm -rf co
  2⤵
  PID:828
- /usr/bin/chmod
  chmod +x scar
  2⤵
  - File and Directory Permissions Modification
  PID:830
- /tmp/scar
  ./scar
  2⤵
  PID:831
- /usr/bin/rm
  rm -rf scar
  2⤵
  PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads